# Migrating from Spur to Synthient

This guide contains information to help migrate from the Spur context API to Synthient. It includes the key differences between the fields and how to transition your application.

> **Have an agent do this migration**: run `/synthient:migrate spur` in [Claude Code](https://docs.synthient.com/ai/claude), or `$synthient-migrate spur` in [Codex](https://docs.synthient.com/ai/codex). The migration skill audits every Spur call site, maps the fields on this page, and shows you the report before it changes anything.

## API Routes

The Synthient IP lookup endpoint is `https://api.synthient.com/api/v4/lookup/ip/{ip_address}` and is authenticated with the `x-api-key` header.

**Spur IP Lookup** `GET /v2/context/:ip`

```bash title="cURL"
curl https://api.spur.us/v2/context/$IP \
  -H "Token: $SPUR_TOKEN"
```

**Synthient IP Lookup** `GET /api/v4/lookup/ip/{ip_address}`

```bash title="cURL"
curl -G https://api.synthient.com/api/v4/lookup/ip/$IP \
  -H "x-api-key: $SYNTHIENT_API_KEY"
```

## Fields

### Main Object

| Spur Field     | Synthient Field | Description                                                                                     |
| :------------- | :-------------- | :---------------------------------------------------------------------------------------------- |
| ip             | ip              | The IP address being queried.                                                                   |
| as             | network         | An object containing details about the Autonomous System and network provider.                  |
| location       | location        | An object with geographical information for the IP address.                                     |
| infrastructure | network.type    | The classification of the network the IP address belongs to, such as DATACENTER or RESIDENTIAL. |
| client         | intelligence    | An object containing client, device, and behavioral data.                                       |

### Network / AS

| Spur Field   | Synthient Field | Description                                                             |
| :----------- | :-------------- | :---------------------------------------------------------------------- |
| number       | asn             | The unique number assigned to the Autonomous System.                    |
| organization | isp             | The name of the organization or ISP that owns the AS.                   |
| -            | org             | The organization associated with the IP, which can differ from the ISP. |
| -            | abuse\_email    | The designated email address for reporting network abuse.               |
| -            | abuse\_phone    | The designated phone number for reporting network abuse.                |
| -            | domain          | The primary domain associated with the network provider.                |

### Location

| Spur Field | Synthient Field | Description                                               |
| :--------- | :-------------- | :-------------------------------------------------------- |
| country    | country         | The two-letter ISO 3166-1 alpha-2 country code.           |
| state      | state           | The state, region, or province associated with the IP.    |
| city       | city            | The city associated with the IP.                          |
| -          | timezone        | The IANA time zone identifier, such as Pacific/Auckland.  |
| -          | longitude       | The geographic longitude coordinate.                      |
| -          | latitude        | The geographic latitude coordinate.                       |
| -          | geo\_hash       | A geohash string representing the geographic coordinates. |

---

### Client, Risk & Proxy Details

#### **Behavior & Classification**

| Spur Field | Synthient Field          | Description                                                               |
| :--------- | :----------------------- | :------------------------------------------------------------------------ |
| risks      | intelligence.behavior    | A list of observed behaviors or risk classifications.                     |
| services   | intelligence.categories  | A list of service classifications or detected protocols.                  |
| -          | intelligence.risk\_score | A numerical score from 0-100 indicating the overall risk level of the IP. |

#### **Device & Client Attributes**

| Spur Field `client` | Synthient Field `intelligence` | Description                                                             |
| :------------------ | :----------------------------- | :---------------------------------------------------------------------- |
| types               | devices\[].os                  | The OS of devices observed from the IP, such as `ANDROID` or `WINDOWS`. |
| count               | devices.length                 | A count of distinct device signatures observed from the IP.             |

#### **Proxy / Tunnel Provider**

| Spur Field `tunnels` | Synthient Field `intelligence.providers` | Description                                                                         |
| :------------------- | :--------------------------------------- | :---------------------------------------------------------------------------------- |
| operator             | provider                                 | The commercial name of the VPN or proxy provider.                                   |
| type                 | type                                     | The classification of the service, such as `COMMERCIAL_VPN` or `RESIDENTIAL_PROXY`. |
| -                    | last\_seen                               | The date the IP was last confirmed to be associated with this provider.             |