# Field reference

> Every field in an IPScope lookup response and downloadable database record: type, nullability, and meaning.

Both the [REST API](https://ipscope.io/docs/api-reference) and the [downloadable databases](https://ipscope.io/docs/databases) (`.mmdb`, `.csv.gz`, `.parquet`) use the same canonical field structure. Expand any nested intelligence block below to inspect its fields.

```json Complete response
{
  "ip": "198.51.100.7",
  "ip_version": 4,
  "matched_network": "198.51.100.0/24",
  "geo": {
    "country_code": "US",
    "declared_country_code": "US",
    "physical_country_code": "US",
    "is_virtual_location": false,
    "location_type": "physical",
    "confidence": 0.94,
    "subdivision": "Virginia",
    "city": "Ashburn",
    "postal_code": "20147",
    "latitude": 39.0438,
    "longitude": -77.4874,
    "accuracy_radius_km": 10,
    "timezone": "America/New_York"
  },
  "network": {
    "asn": 64501,
    "organization": "Example Cloud LLC"
  },
  "connection": {
    "connection_type": "hosting",
    "is_hosting": true,
    "is_residential": false,
    "is_mobile": false,
    "is_business": false
  },
  "security": {
    "is_vpn": true,
    "is_hosting": true,
    "is_tor_exit": false,
    "is_proxy": false,
    "anonymizer_type": "vpn",
    "confidence": 0.96,
    "reason_codes": [
      "vpn_handshake_confirmed",
      "datacenter_asn_range"
    ]
  },
  "security_extensions": {
    "abuse_velocity_score": 18,
    "is_known_scanner": false,
    "observation_recency_hours": 12,
    "anonymizer_reason": "vpn_handshake_confirmed",
    "threat_level": "medium",
    "abuse_velocity": "low",
    "confidence": 0.96
  },
  "dataset_version": "2026-10-27T00:00:00Z.crawl-1793088000000",
  "updated_at": "2026-10-27T00:00:00Z"
}
```

**Top-level & intelligence blocks**

- `ip` (string, required): Canonical representation of the queried IPv4 or IPv6 address.
- `ip_version` (4 | 6, required): IP protocol version (`4` for IPv4, `6` for IPv6).
- `matched_network` (string, required): Longest-matching routed CIDR prefix in the IPScope routing tree (e.g. `"198.51.100.0/24"`).
- `bogon` (boolean): Present and `true` only on reserved, private (RFC 1918), loopback, or unrouted addresses.
- `geo` (object): Country and city geolocation (`geo_country` and `geo_city` families).
  - `country_code` (string | null): Effective ISO 3166-1 alpha-2 country code (`"US"`, `"DE"`, `"TR"`).
  - `declared_country_code` (string | null): Country code registered in RIR WHOIS/RDAP allocation records.
  - `physical_country_code` (string | null): Country code where the prefix is physically routed and serving traffic.
  - `is_virtual_location` (boolean): `true` when `declared_country_code` differs from `physical_country_code` (geofeed-relocated or cross-border announced prefix).
  - `location_type` ('physical' | 'geofeed_declared' | 'anycast' | 'unknown'): How the effective location was resolved.
  - `confidence` (number): Calibrated geolocation confidence score in `[0.0, 1.0]`.
  - `subdivision` (string | null): First-level administrative region or state (`"Virginia"`, `"California"`, `"Hesse"`). Included with `geo_city`.
  - `city` (string | null): English city name (`"Ashburn"`, `"Frankfurt am Main"`). Included with `geo_city`.
  - `postal_code` (string | null): Postal or ZIP code nearest the prefix centroid. Included with `geo_city`.
  - `latitude` (number | null): WGS 84 latitude of the resolved area centroid. Included with `geo_city`.
  - `longitude` (number | null): WGS 84 longitude of the resolved area centroid. Included with `geo_city`.
  - `accuracy_radius_km` (number | null): Estimated radius in kilometres around `(latitude, longitude)` covering the prefix’s endpoints.
  - `timezone` (string | null): IANA time zone identifier (`"America/New_York"`, `"Europe/Berlin"`).
- `network` (object): BGP origin autonomous system (`network` family).
  - `asn` (number | null): Origin Autonomous System Number without the `AS` prefix (`64501`, `13335`).
  - `organization` (string | null): Registered organization or network operator name (`"Cloudflare, Inc."`).
- `connection` (object): Access network classification (`connection` family).
  - `connection_type` ('residential' | 'mobile' | 'business' | 'hosting' | 'unknown'): Primary access network classification.
  - `is_hosting` (boolean): `true` for cloud providers, colocation facilities, and dedicated server networks.
  - `is_residential` (boolean): `true` for consumer fixed-line broadband (FTTH, cable, DSL) ISPs.
  - `is_mobile` (boolean): `true` for cellular carrier gateways (4G/5G CGNAT pools).
  - `is_business` (boolean): `true` for enterprise leased lines and corporate autonomous systems.
- `security` (object): VPN, proxy, Tor, and hosting detection (`anonymity` family).
  - `is_vpn` (boolean): `true` when the address is an active commercial or self-hosted VPN exit node.
  - `is_hosting` (boolean): `true` when routed by a datacenter, cloud, or hosting ASN.
  - `is_tor_exit` (boolean): `true` when listed in the active Tor Project exit consensus.
  - `is_proxy` (boolean): `true` for open HTTP/SOCKS proxies and residential proxy relays.
  - `anonymizer_type` ('none' | 'vpn' | 'tor' | 'proxy' | 'relay' | 'hosting'): Primary anonymizer classification.
  - `confidence` (number): Calibrated anonymity confidence score in `[0.0, 1.0]`.
- `security_extensions` (object): Explainable reason codes and abuse telemetry (`security_extensions` family).
  - `anonymizer_reason` (string | null): Deterministic evidence code (`"vpn_handshake_confirmed"`, `"tor_consensus_exit"`, `"datacenter_asn_range"`, `"clean_access_network"`).
  - `threat_level` ('low' | 'medium' | 'high'): Composite risk tier derived from anonymizer state and abuse velocity.
  - `abuse_velocity` ('none' | 'low' | 'medium' | 'high'): Recent scanner and brute-force telemetry activity observed from this prefix.
  - `confidence` (number): Confidence score in `[0.0, 1.0]` for the extended threat assessment.
- `dataset_version` (string, required): Identifier of the compiled IPScope dataset snapshot that answered the lookup.
- `updated_at` (string, required): ISO 8601 UTC timestamp when the snapshot was published.