{
  "$schema": "https://json-structure.org/meta/core/v0/#",
  "$id": "https://raw.githubusercontent.com/api-evangelist/ipinfo/main/json-structure/ipinfo-privacy-extended-response-structure.json",
  "name": "PrivacyExtendedResponse",
  "description": "PrivacyExtendedResponse schema from IPinfo API",
  "type": "object",
  "properties": {
    "vpn": {
      "type": "boolean",
      "description": "Indicates Virtual Private Network (VPN) service exit node IP address"
    },
    "proxy": {
      "type": "boolean",
      "description": "Indicates an open web proxy IP address"
    },
    "tor": {
      "type": "boolean",
      "description": "Indicates a Tor (The Onion Router) exit node IP address"
    },
    "relay": {
      "type": "boolean",
      "description": "Indicates a location-preserving anonymous relay service"
    },
    "hosting": {
      "type": "boolean",
      "description": "Indicates a hosting/cloud service/data center IP address"
    },
    "service": {
      "type": "string",
      "description": "Name of the privacy service provider - includes VPN, Proxy, and Relay service provider names"
    },
    "confidence": {
      "type": "int32",
      "description": "The level of confidence attributed to the best source associated with this range. Level 3 - Direct observation of commercial use (vpn_config). Level 2 - Direct observation of VPN software running on the range (census) + registrar information associated with VPNs or specific providers OR highly convincing device activity. Level 1 - Direct observation of VPN software running on the range (census) without known association to specific providers or VPNs in general OR suspicious device data not associated with hosting ranges"
    },
    "coverage": {
      "type": "double",
      "description": "For inferred ranges, represents the proportion of the range (in IP count) that we saw direct evidence of VPN activity on. For IPs/ranges we've fully directly observed VPN evidence on, this value is 1.0"
    },
    "census": {
      "type": "boolean",
      "description": "Ranges where we've observed VPN software/ports on; we run scans on ports and protocols commonly associated with VPN software. Ranges with the census flag are those where these scans obtained positive results"
    },
    "census_ports": {
      "type": "array",
      "items": {
        "type": "int32"
      },
      "description": "The ports we've gotten positive results for when running our VPN detection census"
    },
    "device_activity": {
      "type": "boolean",
      "description": "Ranges on which we've observed device activity compatible with VPN usage (outside of known infrastructure area; simultaneous use around a large area; pingable and/or associated with hosting providers)"
    },
    "inferred": {
      "type": "boolean",
      "description": "Whether the range associated with the record is the result of direct observation or inference based on neighboring IPs"
    },
    "vpn_config": {
      "type": "boolean",
      "description": "Ranges where we confirmed VPN activity by directly running VPN software from almost 200 different providers and collecting exit IPs"
    },
    "whois": {
      "type": "boolean",
      "description": "Ranges where we've observed VPN software/ports on AND have a WHOIS association with either VPNs in general or specific VPN providers"
    },
    "first_seen": {
      "type": "date",
      "description": "Date when the activity on an anonymous IP address was first observed. Date in YYYY-MM-DD format, ISO-8601. Within the 3-month lookback period"
    },
    "last_seen": {
      "type": "date",
      "description": "Date when the activity on an anonymous IP address was last/recently observed. Date in YYYY-MM-DD format, ISO-8601"
    }
  },
  "required": [
    "vpn",
    "proxy",
    "tor",
    "relay",
    "hosting",
    "service"
  ]
}