// REFERENCE
How Wi-Fi positioning works
Everything you need to read a euqlid.space response correctly — the physics, the fields, the accuracy, and the rules of the road.
[ 01 ] Wi-Fi positioning 101
Every Wi-Fi access point broadcasts a globally-unique hardware address — its BSSID. Access points rarely move, so the set of BSSIDs a device hears is a stable fingerprint of where it physically is.
Mapping services have spent years observing which BSSIDs appear at which coordinates. euqlid.space runs a large US-focused observation graph of that relationship — given a BSSID we know roughly where it lives; given a coordinate we know which BSSIDs to expect.
[ 02 ] BSSID & OUI
A BSSID looks like aa:bb:cc:dd:ee:ff. The first three bytes (the OUI) are assigned by the IEEE to a manufacturer. We resolve the OUI to a vendor and device_class, and flag locally-administered addresses — the hallmark of a randomized or virtual MAC.
[ 03 ] hacc / vacc / altitude
- hacc_m — horizontal accuracy in metres; the per-point confidence radius. Smaller is better.
- vacc_m — vertical accuracy, when an altitude solution exists.
- alt_m — estimated altitude; useful to separate floors in tall buildings.
[ 04 ] Randomized MACs & twins
Phones rotate their MAC for privacy. These randomized MACs are marked is_random: true — poor anchors, discount them. We also detect twins: one BSSID seen at two locations, so you can judge whether the anchor is trustworthy.
[ 05 ] ZIP vs coordinate
You can query by exact lat/lon or by zip. They are not the same, and we never pretend otherwise:
| precision.mode | est_accuracy_m | meaning |
|---|---|---|
| coordinate | 5–30 | Address-level. Safe for verification. |
| zip_centroid | 2,000–10,000 | Centre of a ZIP. Coarse enrichment only — never proof. |
[ 06 ] Confidence & freshness
Access points move, get replaced, or vanish. A point last seen two years ago is weaker evidence than one seen last week. first_seen / last_seen expose this; confidence (0…1) and spread_m summarise a verify result.
Rule of thumb: confidence > 0.7 with spread < 100 m is a strong on-site match. Anything ZIP-derived is contextual, not conclusive.
[ 07 ] Field glossary
Every field below is returned for every network — in the paid API and the public demo alike. null means “not known”, not “hidden”; unmapped raw Apple attributes are preserved verbatim under extras.
| field | type | description |
|---|---|---|
| bssid | string | Normalised AP hardware address (MAC). |
| lat, lon | float | Estimated AP location (WGS-84). |
| hacc_m | int | Horizontal accuracy, metres. |
| vacc_m | int | Vertical accuracy, metres. |
| alt_m | int | Estimated altitude, metres. |
| ground_elevation_m | float | Ground/terrain elevation at the AP, metres (Copernicus DEM). |
| alt_vs_terrain_m | float | AP altitude above ground (alt_m − terrain), metres. |
| altitude_plausible | bool | Whether height-above-ground sits in a sane building band (anti-spoof). |
| address | object | Full reverse-geocoded street address (OpenStreetMap). |
| address_source | string | Origin of the address: nominatim, photon or cache. |
| channel | int | Wi-Fi channel hint (raw, as Apple reported). |
| provider | int | Raw Apple provider tag. |
| extras | object | Every other raw Apple Location.* field, verbatim — nothing dropped. |
| source | string | Origin of the record (e.g. apple-wloc). |
| in_bbox | bool | Whether the point is inside our harvested bounding box. |
| first_seen / last_seen | datetime | Observation window — your freshness signal. |
| distance_m | float | Distance from the query point (nearby queries). |
| altitude_delta_m | float | Altitude difference vs a queried altitude. |
| distance_3d_m | float | 3-D distance including altitude. |
| orig_lat / orig_lon | float | Original coordinates before any adjustment. |
| twin | object | A second sighting of the same BSSID (lat/lon/distance/seen). |
| zip_code / zip_city / zip_state | string | Reverse-geocoded ZIP context. |
| zip_bounds | float[] | ZIP bounding box [lat_min, lon_min, lat_max, lon_max]. |
| phone_area_codes | string[] | Area codes covering the location. |
| vendor | string | Manufacturer resolved from the OUI. |
| device_class | string | Inferred hardware type (router, AP, hotspot…). |
| device_icon | string | UI icon hint for the device class. |
| device_label | string | Human-readable device label. |
| is_random | bool | Locally-administered / randomized MAC. |
| company_address | string | Registered address of the OUI owner. |
| country_code | string | Country of the OUI owner. |
| assignment | string | IEEE registry block (MA-L / MA-M / MA-S). |
| transmission | string | Unicast vs multicast (low bit of first octet). |
| administration | string | Universally vs locally administered. |
| virtual_machine | bool | OUI belongs to a virtual-machine vendor. |
| is_valid | bool | Whether the MAC is structurally valid. |
| applications | array | Known protocols/uses associated with the OUI. |
| wireshark_notes | string | Notes from the Wireshark OUI manufacturer DB. |
| block_found | bool | Whether the OUI block was found in the registry. |
| ip_context.ip_geo | object | Requester-IP location (country/city/postal) from MaxMind GeoLite2; on /v1/verify. |
| ip_context.ip_asn | object | Requester-IP network operator (ASN + org) — flags hosting/VPN context. |
| ip_context.ip_vs_wifi_km | float | Distance between the IP location and the WiFi-derived location, km. |
| ip_context.looks_spoofed | bool | Anti-spoof verdict: IP location disagrees with the WiFi location. |
| POST /v1/cells/verify | endpoint | Score a claimed coordinate against a serving cell tower's known location. |
Enrichment data: includes GeoLite2 data created by MaxMind (maxmind.com); address data © OpenStreetMap contributors (ODbL); elevation by Open-Meteo / Copernicus DEM (CC-BY 4.0).
[ 08 ] Quickstart
Authenticate with the X-API-Key header. Base URL https://api.euqlid.space.
# verify observed BSSIDs
curl -s https://api.euqlid.space/v1/verify \
-H "X-API-Key: $FRAUDXXX_KEY" \
-d '{"bssids":["aa:bb:cc:dd:ee:ff","12:34:56:78:9a:bc"]}'
# reverse lookup (zip = coarse, lat/lon = precise)
curl -s "https://api.euqlid.space/v1/aps/nearby?lat=40.73&lon=-73.99&limit=25" \
-H "X-API-Key: $FRAUDXXX_KEY"
# every network comes back with the COMPLETE field set, e.g.:
# {
# "bssid": "aa:bb:cc:dd:ee:ff", "lat": 40.7414, "lon": -73.9893,
# "hacc_m": 12, "vacc_m": 8, "alt_m": 31, "channel": 36, "provider": 1,
# "vendor": "Cisco Systems", "device_class": "router", "is_random": false,
# "first_seen": "2025-02-10T...", "last_seen": "2026-05-30T...",
# "zip_code": "10003", "zip_city": "New York", "zip_state": "NY",
# "phone_area_codes": ["212","646"],
# "extras": { /* every other raw Apple Location.* field, verbatim */ }
# }[ 09 ] Acceptable use
euqlid.space is a B2B risk and verification signal. By using the API you agree:
- Permitted: fraud prevention, account-takeover defense, KYC/AML, geo-compliance, delivery/field verification, security research.
- Prohibited: stalking, surveillance of individuals, people-search, locating a specific person's home, consumer tracking without consent, bulk export or resale of the underlying data, or any unlawful use.
- Results are a probabilistic signal, not legal proof of any person's location. Never use as the sole basis for an adverse decision about an individual.
- Access is reviewed and may be revoked for abuse. Requests are logged.
[ 10 ] Privacy & opt-out
Networks whose SSID ends in _nomap are excluded upstream and not collected. To suppress a specific BSSID or report misuse, email privacy@euqlid.space; verified requests are suppressed promptly. privacy@euqlid.space
euqlid.space is not affiliated with, endorsed by, or connected to Apple Inc. or any network operator.