Migrating from Spur to Synthient
This guide contains information to help migrate from the Spur context API to Synthient. It includes the key differences between the fields and how to transition your application.
Have an agent do this migration
The Synthient plugins ship a migration skill. It audits every Spur call site, maps the fields on this page, and shows you the report before it changes anything, leading with the semantic differences, since those are what break quietly.
API Routes
The Synthient IP lookup endpoint is https://api.synthient.com/api/v4/lookup/ip/{ip_address} and is authenticated with the x-api-key header.
Spur IP Lookup
GET/v2/context/:ip
curl https://api.spur.us/v2/context/$IP \
-H "Token: $SPUR_TOKEN"
Synthient IP Lookup
GET/api/v4/lookup/ip/{ip_address}
curl -G https://api.synthient.com/api/v4/lookup/ip/$IP \
-H "x-api-key: $SYNTHIENT_API_KEY"
Fields
Main Object
| Spur Field | Synthient Field | Description |
|---|---|---|
| ip | ip | The IP address being queried. |
| as | network | An object containing details about the Autonomous System and network provider. |
| location | location | An object with geographical information for the IP address. |
| infrastructure | network.type | The classification of the network the IP address belongs to, such as DATACENTER or RESIDENTIAL. |
| client | intelligence | An object containing client, device, and behavioral data. |
Network / AS
| Spur Field | Synthient Field | Description |
|---|---|---|
| number | asn | The unique number assigned to the Autonomous System. |
| organization | isp | The name of the organization or ISP that owns the AS. |
| - | org | The organization associated with the IP, which can differ from the ISP. |
| - | abuse_email | The designated email address for reporting network abuse. |
| - | abuse_phone | The designated phone number for reporting network abuse. |
| - | domain | The primary domain associated with the network provider. |
Location
| Spur Field | Synthient Field | Description |
|---|---|---|
| country | country | The two-letter ISO 3166-1 alpha-2 country code. |
| state | state | The state, region, or province associated with the IP. |
| city | city | The city associated with the IP. |
| - | timezone | The IANA time zone identifier, such as Pacific/Auckland. |
| - | longitude | The geographic longitude coordinate. |
| - | latitude | The geographic latitude coordinate. |
| - | geo_hash | A geohash string representing the geographic coordinates. |
Client, Risk & Proxy Details
Behavior & Classification
| Spur Field | Synthient Field | Description |
|---|---|---|
| risks | intelligence.behavior | A list of observed behaviors or risk classifications. |
| services | intelligence.categories | A list of service classifications or detected protocols. |
| - | intelligence.risk_score | A numerical score from 0-100 indicating the overall risk level of the IP. |
Device & Client Attributes
Spur Field client | Synthient Field intelligence | Description |
|---|---|---|
| types | devices[].os | The OS of devices observed from the IP, such as ANDROID or WINDOWS. |
| count | devices.length | A count of distinct device signatures observed from the IP. |
Proxy / Tunnel Provider
Spur Field tunnels | Synthient Field intelligence.providers | Description |
|---|---|---|
| operator | provider | The commercial name of the VPN or proxy provider. |
| type | type | The classification of the service, such as COMMERCIAL_VPN or RESIDENTIAL_PROXY. |
| - | last_seen | The date the IP was last confirmed to be associated with this provider. |