Firehose

Synthient streams every data feed in real time as newline-delimited JSON (NDJSON) over a long-lived HTTP connection. Each line of the response is one complete JSON event. Connections stay open for up to 30 minutes before the server cleanly closes them — clients should reconnect immediately on disconnect. The server also emits a blank-line heartbeat every 15 seconds so intermediaries don't drop idle connections.

The stream identifiers covered on this page are:

proxies, anonymizers, torrents.

Honeypot captures (honeypot_http, honeypot_https, honeypot_dns, honeypot_adb) are documented separately under Helios, the Synthient honeypot platform.

Authentication

All endpoints are served from https://api.synthient.com under /api/v4 and require your API key in the x-api-key header. Each stream requires its own scope (PROXY_FIREHOSE, ANONYMIZERS_STREAM, TORRENTS_STREAM).

curl -N https://api.synthient.com/api/v4/feeds/proxies/stream \
  -H "x-api-key: $API_KEY"

Use curl -N (or your client's equivalent unbuffered/streaming mode) so that lines are delivered to your handler as soon as they arrive. A single API key may only hold a small number of concurrent streams per feed; excess connections are rejected with 429.


Common response codes

Status CodeDescription
200 - StreamingNDJSON body — one JSON object per line, open up to 30 minutes.
401 - UnauthorizedMissing or invalid API key.
403 - ForbiddenAPI key lacks the per-stream feed scope.
429 - Too Many RequestsToo many concurrent streams from this client.
500 - Internal Server ErrorUnexpected server-side error.
503 - Service UnavailableStreaming backend is down — retry with backoff.

GET/api/v4/feeds/proxies/stream

Stream proxies

Real-time stream of proxy IP observations.

  • Name
    ip
    Type
    string
    Description

    IPv4 or IPv6 address of the proxy.

  • Name
    provider
    Type
    string
    Description

    Provider name, such as BRIGHTDATA or IPIDEA.

  • Name
    type
    Type
    string
    Description

    Proxy type, such as RESIDENTIAL_PROXY, DATACENTER_PROXY, or MOBILE_PROXY.

  • Name
    timestamp
    Type
    integer
    Description

    Unix timestamp in seconds when the proxy was observed.

  • Name
    country_code
    Type
    string
    Description

    ISO 3166-1 alpha-2 country of the proxy IP.

  • Name
    asn
    Type
    integer
    Description

    Autonomous System Number of the proxy IP.

Request

GET/api/v4/feeds/proxies/stream
curl -N https://api.synthient.com/api/v4/feeds/proxies/stream \
  -H "x-api-key: $API_KEY"

Sample event

{
  "ip": "38.238.45.9",
  "provider": "DATAIMPULSE",
  "type": "RESIDENTIAL_PROXY",
  "timestamp": 1762605697,
  "country_code": "US",
  "asn": 174
}

Events are delivered as newline-delimited JSON — each event arrives as a single line. The samples above are pretty-printed for readability.


GET/api/v4/feeds/anonymizers/stream

Stream anonymizers

Real-time stream of anonymizer observations — VPNs, Tor exits, and relay-class detections. Anonymizer events emit IP ranges rather than individual addresses.

  • Name
    range_start
    Type
    string
    Description

    First IP in the anonymizer range.

  • Name
    range_end
    Type
    string
    Description

    Last IP in the anonymizer range.

  • Name
    provider
    Type
    string
    Description

    Provider name, such as NORDVPN or MULLVAD.

  • Name
    type
    Type
    string
    Description

    Anonymizer type, such as COMMERCIAL_VPN, TOR_NODE, or PRIVATE_RELAY.

  • Name
    timestamp
    Type
    integer
    Description

    Unix timestamp in seconds when the range was observed.

Request

GET/api/v4/feeds/anonymizers/stream
curl -N https://api.synthient.com/api/v4/feeds/anonymizers/stream \
  -H "x-api-key: $API_KEY"

Sample event

{
  "range_start": "2.56.252.0",
  "range_end": "2.56.252.255",
  "provider": "NORDVPN",
  "type": "COMMERCIAL_VPN",
  "timestamp": 1762605697
}

GET/api/v4/feeds/torrents/stream

Stream torrents

Real-time stream of torrent peer sightings from the DHT network and trackers, with info hash, metadata, and observed peers.

  • Name
    info_hash
    Type
    string
    Description

    40-character hex SHA-1 info hash of the torrent.

  • Name
    name
    Type
    string
    Description

    Torrent name from metadata.

  • Name
    magnet_uri
    Type
    string
    Description

    Magnet URI for the torrent.

  • Name
    total_size
    Type
    integer
    Description

    Total size of files in bytes.

  • Name
    piece_length
    Type
    integer
    Description

    Piece length in bytes.

  • Name
    file_count
    Type
    integer
    Description

    Number of files in the torrent.

  • Name
    files
    Type
    array<object>
    Description

    Per-file path and length in bytes.

  • Name
    peers
    Type
    array<object>
    Description

    Observed peers — ip, port, source of DHT, PEX, or tracker, and encrypted.

  • Name
    timestamp
    Type
    integer
    Description

    Unix timestamp in seconds when the torrent was observed.

Request

GET/api/v4/feeds/torrents/stream
curl -N https://api.synthient.com/api/v4/feeds/torrents/stream \
  -H "x-api-key: $API_KEY"

Sample event

{
  "info_hash": "abcdef0123456789abcdef0123456789abcdef01",
  "name": "ubuntu-26.04-desktop-amd64.iso",
  "magnet_uri": "magnet:?xt=urn:btih:abcdef0123456789abcdef0123456789abcdef01&dn=ubuntu-26.04-desktop-amd64.iso",
  "total_size": 4831838208,
  "piece_length": 2097152,
  "file_count": 1,
  "files": [
    { "path": "ubuntu-26.04-desktop-amd64.iso", "length": 4831838208 }
  ],
  "peers": [
    { "ip": "203.0.113.42", "port": 51413, "source": "DHT", "encrypted": true },
    { "ip": "198.51.100.17", "port": 6881, "source": "PEX", "encrypted": false }
  ],
  "timestamp": 1762605697
}

Consuming streams

A minimal NDJSON consumer reads the response body line by line and parses each line as JSON. The server cleanly closes connections every ~30 minutes — treat that as the normal case and reconnect immediately. On a failed reconnect, use exponential backoff with jitter: start at 1s, double up to a 60s cap, randomize ±25% so concurrent workers don't synchronize. See Rate Limits for the full retry recipe.

NDJSON Consumer

import json, os, random, time, requests

URL = "https://api.synthient.com/api/v4/feeds/proxies/stream"
HEADERS = {"x-api-key": os.environ["API_KEY"]}

attempt = 0
while True:
    try:
        with requests.get(URL, headers=HEADERS, stream=True, timeout=None) as r:
            r.raise_for_status()
            attempt = 0  # successful connect — reset backoff
            for line in r.iter_lines(decode_unicode=True):
                if not line:
                    continue
                event = json.loads(line)
                handle(event)
    except requests.RequestException:
        delay = min(60, 2 ** attempt) * random.uniform(0.75, 1.25)
        time.sleep(delay)
        attempt += 1