Sugra NetAtlas direction

Network intelligence Sugra builds itself - IP, ASN, BGP, RPKI, Tor - a daily atlas from primary sources, not resold.

Sugra NetAtlas is the internet-infrastructure direction of the Sugra API, and it is first party end to end. Sugra ingests registry and routing data from the primary operators of the internet - the five regional internet registries, public route collectors, RPKI repositories, the Tor directory, Certificate Transparency logs - and rebuilds a queryable atlas daily. Registry, domain, and measurement paths resolve live on top of that atlas.

Base namespace: https://sugra.ai/api/v1/network. Every endpoint requires the x-api-key header (see Authentication) and is available on every plan. Plans differ in daily request volume, and the SLA covers the paid plans (see Plans and billing).

Every response carries a _meta provenance envelope: product: "Sugra NetAtlas", the atlas build timestamp, the contributing sources, and a confidence rating.

What data lives here

The direction maps to one OpenAPI tag, Sugra NetAtlas (65 endpoints), all under the /api/v1/network namespace.

Module	Endpoints	What it covers
IP intelligence	6	`/ip/{ip}` overview plus `/asn`, `/geo`, `/privacy`, `/abuse`, `/rdns`
ASN	11	holder, peers, announced prefixes, routing status, geo distribution, registry routes, RPKI posture
Prefix and routing	7	prefix overview, RPKI validation, announcement history, more- and less-specifics, exact match
BGP hijack detection	3	recent suspected hijacks, filtered by ASN or prefix
Registry graph	6	whois objects, organisations, maintainers, abuse contacts, published geofeeds
Domains	3	`/domain/{host}/dns`, `/domain/{host}/whois`, `/domain/{host}/rdap`
TLS certificates	5	Certificate Transparency search, subdomain enumeration, issuers, revocations, history
Outages	4	country- and ASN-level connectivity alerts (IODA)
Tor	8	relay and bridge directory, bandwidth, clients, uptime, flags
Measurements	8	RIPE Atlas probes, anchors, measurements, and results
Search and bulk	3	free-text search, `POST /bulk/ip`, `POST /bulk/asn`
Provenance	1	`/sources/coverage` - which primary source feeds which field

Not in this direction: blockchain and crypto network metrics belong to Sugra Finance; airports and aviation belong to Sugra Earth.

All sources are Tier S (sovereign registries) or Tier A (academic and non-profit): RIR delegated statistics from ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC, RouteViews, RIPE RIS, RIPEstat, RIPE Atlas, RPKI ROAs, Tor Metrics (Onionoo), IODA, operator-published geofeeds (RFC 8805), GeoNames, curated open IP lists (firehol, X4BNet), and Certificate Transparency logs. There are no commercial data vendors in this direction. IP geolocation is country-level by design ("accuracy": "country-only" in _meta) because it derives from operator geofeeds and registry data, not a commercial geo database.

Flagship endpoints

IP privacy signals

GET /api/v1/network/ip/{ip}/privacy - is this address a Tor exit, VPN, hosting, anycast, or mobile endpoint, with a risk score.

{
  "ip": "9.9.9.9",
  "privacy": {
    "is_tor": false, "is_vpn_asn": false, "is_hosting": true,
    "is_anycast": true, "is_mobile": false,
    "risk_score": 10, "confidence": "high"
  },
  "_meta": {"product": "Sugra NetAtlas", "atlas_built_at": "2026-07-18T04:09:39.197520Z", "...": "..."}
}

ASN overview

GET /api/v1/network/asn/{asn} - holder, registry block, and announcement status for an autonomous system.

{
  "asn": 13335,
  "holder": "CLOUDFLARENET - Cloudflare, Inc.",
  "type": "as",
  "announced": true,
  "block": {"resource": "13312-15359", "desc": "Assigned by ARIN", "...": "..."},
  "_meta": {"product": "Sugra NetAtlas", "...": "..."}
}

RPKI validation

GET /api/v1/network/prefix/{cidr}/rpki?asn={asn} - validates a prefix-origin pair against published ROAs. Answers "is this announcement authorized" in one call.

{
  "asn": 13335,
  "prefix": "1.1.1.0/24",
  "status": "valid",
  "validating_roas": [{"origin": "13335", "prefix": "1.1.1.0/24", "validity": "valid", "max_length": 24}],
  "_meta": {"product": "Sugra NetAtlas", "...": "..."}
}

Certificate Transparency search

GET /api/v1/network/cert/search?domain={domain} - certificates logged for a domain and its subdomains, with issuer and revocation status. Cursor-paginated.

{
  "domain": "sugra.ai",
  "count": 2,
  "next_cursor": null,
  "certificates": [
    {
      "common_name": "api.economics.sugra.ai",
      "issuer": {"friendly_name": "DigiCert", "...": "..."},
      "not_before": "2026-02-21T00:00:00Z",
      "not_after": "2026-08-21T23:59:59Z",
      "revoked": false
    },
    {"common_name": "api.sugra.ai", "...": "..."}
  ]
}

Other frequently used entry points: GET /tor/summary (relay and bridge directory), GET /hijack/recent (suspected origin hijacks over the last 7 days), GET /outage/alerts (connectivity drops by country or ASN), and POST /bulk/ip for enriching up to a batch of addresses in one request.

Who uses it

Fraud and abuse teams enrich sign-ups and inbound traffic with /ip/{ip}/privacy and /ip/{ip}/abuse before scoring, and pull the registry abuse contact for takedown workflows.

Network operators and security researchers watch their own ASNs: announced prefixes, RPKI validity, /hijack/asn/{asn} alerts, and country-level outage signals.

Attack-surface and domain-intelligence workflows enumerate subdomains from CT logs (/cert/subdomains), track issuance and revocation, and resolve /domain/{host} DNS, whois, and RDAP in one namespace.

Where to go next

API reference: the Sugra NetAtlas tag groups all 65 endpoints; GET /api/v1/network/sources/coverage returns the live provenance map of the atlas itself.

Sources: the Sugra NetAtlas sources page; it lists every registry and research network named above, with tier and license.

Authentication and rate limits: see the Authentication page for the x-api-key header and X-RateLimit-* response headers.

Sugra NetAtlas direction

What data lives here#

Flagship endpoints#

IP privacy signals#

ASN overview#

RPKI validation#

Certificate Transparency search#

Who uses it#

Where to go next#