
v3 API Goes Stable: The Beta Tag Comes Off
Ten months ago we launched an open beta of our v3 API and as of today, the v3 API is officially out of beta and is now our new stable API.
Before we get into what's changed, we want to say thank you. A beta is only as good as the people willing to use it before it's finished, breaking things, filing reports and rebuilding their integrations against a target that kept moving. Many people did exactly that for the better part of a year, and v3 is a far better API for it.
A Quick Look Back
We introduced the v3 beta back in August 2025, and since then we've shipped several major beta releases, each one chipping away at rough edges like the output format and adding new capability:
- August 2025: First beta with a brand new output format featuring nested categories and a new detections array.
- October 2025: Timestamps moved to the ISO 8601 format making them both machine and human readable without sacrificing per-second accuracy.
- November 2025: Confidence scores arrived, alongside first_seen and last_seen timestamps for every detection.
- February 2026: detection_history and attack_history became permanent fixtures of every response, and the operator section gained services and additional_operators.
- May 2026: A full OpenAPI v3.1.0 specification was published, covering both the v3 API and our Dashboard APIs.
Each release was a stepping stone, and today's stable version is all of that put together, polished, with an output format that can take us into the next decade.
What Actually Changed From v2
If you haven't been following the beta closely, here's the short version of what makes v3 a genuinely different API rather than just a version number bump.
Everything is nested and consistent. Instead of a flat list of fields that may or may not appear, you now get clearly organised sections: network, location, operator, and detections. Every section is always present. If we have nothing to tell you, you'll get a null rather than a missing key, so your code never has to guess whether a field exists at all.
Booleans instead of strings. No more checking if a string equals "yes". Proxy, VPN, TOR, hosting and the rest of our detections now return true or false, the way they always should have.
Multiple detections at once. An address can now be flagged as a VPN and a scraper and have a history of compromise simultaneously, rather than forcing a single label onto an address that's clearly doing more than one thing.
A far fuller response by default. Almost every query flag from v2 has been retired because v3 simply gives you the full picture without you needing to ask for it piece by piece. This lets us optimise for always generating a full result which improves cache hit rates and lowers response times for every request.
Real HTTP status codes. Denied and failed requests now come back with proper 401, 403, 429 and 400 codes instead of a 200 OK hiding a denial in the body of the response, so your monitoring and error handling can finally behave the way you'd expect from a modern API.
Confidence scores alongside risk scores. Risk tells you how dangerous an address looks. Confidence tells you how sure we are about the detection behind that score. Used together they let you build far more nuanced rules than a simple yes or no ever could.
Detection history and attack history as standard. You can now see whether a positive detection is still live or has been delisted, and exactly when, plus a clean breakdown of the kinds of attacks an address has been involved in.
Deeper operator intelligence. Knowing an address belongs to a VPN is useful. Knowing which VPN, what services that operator provides, and which other operators have also been seen running the same address is a different level of useful entirely, and that's exactly what the expanded operator section now gives you.
Smoother under load. On top of all the format changes, v3 is also simply faster and steadier at scale, with noticeably less jitter between responses when you're sending large volumes of requests.
What This Means If You're Still On v2
Nothing changes for you today, and nothing has to change for a very long time. We are committed to supporting the v2 API until 2035.
We mean that. There's no countdown clock hidden in the fine print and no plan to quietly nudge you off it before then. If v2 is doing its job for your application, keep using it. The same servers, the same reliability and the same support still backs it.
What going stable does mean is that v3 is no longer a moving target. The structure you build against today is the structure you'll be working with for the long haul, which is exactly the kind of stability you want before committing a production system to a new API version.
If you've been holding off starting a new integration until v3 settled down, or you're planning one now, this is a great time to make the move.
Getting Started
- Point your requests at the v3 endpoint. No version flag required, you'll automatically receive the latest stable release.
- Select Latest Stable Version from the version dropdown in your Customer Dashboard if you'd rather pin it explicitly.
- Read through the full API documentation for every field, flag and response type.
- Import our OpenAPI specification into Postman, Insomnia, Swagger UI or your code generator of choice.
- Take it for a spin in the test console before spending a single query against your daily allowance.
We genuinely couldn't have gotten v3 to this point without the people who used it while it was still in beta, filed the issues, asked the awkward questions and told us when something didn't sit right. Thank you, sincerely.
Here's to a stable v3, a supported v2, and another decade of keeping the internet a little more honest.
Thanks for reading and have a wonderful week!







