---
title: "Returns extended privacy detection information with detailed methodologies."
method: GET
path: "/{ip}/privacy_extended"
tags: ["privacy detection extended"]
---

# Returns extended privacy detection information with detailed methodologies.

`GET /{ip}/privacy_extended`

## Request

- Base URL: `https://ipinfo.io`
- URL: `https://ipinfo.io/{ip}/privacy_extended`
- Auth: one of:
  - HTTP basic
  - HTTP bearer
  - API key in query parameter `token`
- TypeScript: <https://skmtc.dev/ipinfo/apis/ipinfo-io-openapi-specification/docs/:ip/privacy_extended/get.ts> (a function with typed inputs; its response is checked against the schema)

The Privacy Detection Extended API provides detection methodology metadata to support risk scoring, confidence metrics, and IP reputation aspects.
Uses multi-modal detection methods including internet measurement, IP behavior analysis, and internet records metadata.
Includes detailed flags for VPN, proxy, Tor, relay, hosting, and service identification with confidence metrics.

## Path parameters

- `ip` string, required

## Response `200`

Privacy Detection Extended response with detailed methodologies.

- PrivacyExtendedResponse
  - `vpn` boolean, required: Indicates Virtual Private Network (VPN) service exit node IP address
  - `proxy` boolean, required: Indicates an open web proxy IP address
  - `tor` boolean, required: Indicates a Tor (The Onion Router) exit node IP address
  - `relay` boolean, required: Indicates a location-preserving anonymous relay service
  - `hosting` boolean, required: Indicates a hosting/cloud service/data center IP address
  - `service` string, required: Name of the privacy service provider - includes VPN, Proxy, and Relay service provider names
  - `confidence` integer: The level of confidence attributed to the best source associated with this range. Level 3 - Direct observation of commercial use (vpn_config). Level 2 - Direct observation of VPN software running on the range (census) + registrar information associated with VPNs or specific providers OR highly convincing device activity. Level 1 - Direct observation of VPN software running on the range (census) without known association to specific providers or VPNs in general OR suspicious device data not associated with hosting ranges
  - `coverage` number: For inferred ranges, represents the proportion of the range (in IP count) that we saw direct evidence of VPN activity on. For IPs/ranges we've fully directly observed VPN evidence on, this value is 1.0
  - `census` boolean: Ranges where we've observed VPN software/ports on; we run scans on ports and protocols commonly associated with VPN software. Ranges with the census flag are those where these scans obtained positive results
  - `census_ports` integer[]: The ports we've gotten positive results for when running our VPN detection census
  - `device_activity` boolean: Ranges on which we've observed device activity compatible with VPN usage (outside of known infrastructure area; simultaneous use around a large area; pingable and/or associated with hosting providers)
  - `inferred` boolean: Whether the range associated with the record is the result of direct observation or inference based on neighboring IPs
  - `vpn_config` boolean: Ranges where we confirmed VPN activity by directly running VPN software from almost 200 different providers and collecting exit IPs
  - `whois` boolean: Ranges where we've observed VPN software/ports on AND have a WHOIS association with either VPNs in general or specific VPN providers
  - `first_seen` string, date: Date when the activity on an anonymous IP address was first observed. Date in YYYY-MM-DD format, ISO-8601. Within the 3-month lookback period
  - `last_seen` string, date: Date when the activity on an anonymous IP address was last/recently observed. Date in YYYY-MM-DD format, ISO-8601

## Other responses

- `403`: Unknown token or invalid permission. We return the same error for blocking malicious IP addresses as well.
- `404`: Wrong ip. Please provide a valid IP address.
- `429`: Allocated API rate limit has been reached for the token. The user will be prompted with options to increase their API limit.
- `500`: Internal server error or server unavailable.

---

[API](https://skmtc.dev/ipinfo/apis/ipinfo-io-openapi-specification.md) - [All operations](https://skmtc.dev/ipinfo/apis/ipinfo-io-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/ipinfo/apis/ipinfo-io-openapi-specification/revisions/c63f11e4f26e?raw)