// REFERENCE

How Wi-Fi positioning works

Everything you need to read a euqlid.space response correctly — the physics, the fields, the accuracy, and the rules of the road.

[ 01 ] Wi-Fi positioning 101

Every Wi-Fi access point broadcasts a globally-unique hardware address — its BSSID. Access points rarely move, so the set of BSSIDs a device hears is a stable fingerprint of where it physically is.

Mapping services have spent years observing which BSSIDs appear at which coordinates. euqlid.space runs a large US-focused observation graph of that relationship — given a BSSID we know roughly where it lives; given a coordinate we know which BSSIDs to expect.

[ 02 ] BSSID & OUI

A BSSID looks like aa:bb:cc:dd:ee:ff. The first three bytes (the OUI) are assigned by the IEEE to a manufacturer. We resolve the OUI to a vendor and device_class, and flag locally-administered addresses — the hallmark of a randomized or virtual MAC.

[ 03 ] hacc / vacc / altitude

  • hacc_m — horizontal accuracy in metres; the per-point confidence radius. Smaller is better.
  • vacc_m — vertical accuracy, when an altitude solution exists.
  • alt_m — estimated altitude; useful to separate floors in tall buildings.

[ 04 ] Randomized MACs & twins

Phones rotate their MAC for privacy. These randomized MACs are marked is_random: true — poor anchors, discount them. We also detect twins: one BSSID seen at two locations, so you can judge whether the anchor is trustworthy.

[ 05 ] ZIP vs coordinate

You can query by exact lat/lon or by zip. They are not the same, and we never pretend otherwise:

precision.modeest_accuracy_mmeaning
coordinate5–30Address-level. Safe for verification.
zip_centroid2,000–10,000Centre of a ZIP. Coarse enrichment only — never proof.

[ 06 ] Confidence & freshness

Access points move, get replaced, or vanish. A point last seen two years ago is weaker evidence than one seen last week. first_seen / last_seen expose this; confidence (0…1) and spread_m summarise a verify result.

Rule of thumb: confidence > 0.7 with spread < 100 m is a strong on-site match. Anything ZIP-derived is contextual, not conclusive.

[ 07 ] Field glossary

Every field below is returned for every network — in the paid API and the public demo alike. null means “not known”, not “hidden”; unmapped raw Apple attributes are preserved verbatim under extras.

fieldtypedescription
bssidstringNormalised AP hardware address (MAC).
lat, lonfloatEstimated AP location (WGS-84).
hacc_mintHorizontal accuracy, metres.
vacc_mintVertical accuracy, metres.
alt_mintEstimated altitude, metres.
ground_elevation_mfloatGround/terrain elevation at the AP, metres (Copernicus DEM).
alt_vs_terrain_mfloatAP altitude above ground (alt_m − terrain), metres.
altitude_plausibleboolWhether height-above-ground sits in a sane building band (anti-spoof).
addressobjectFull reverse-geocoded street address (OpenStreetMap).
address_sourcestringOrigin of the address: nominatim, photon or cache.
channelintWi-Fi channel hint (raw, as Apple reported).
providerintRaw Apple provider tag.
extrasobjectEvery other raw Apple Location.* field, verbatim — nothing dropped.
sourcestringOrigin of the record (e.g. apple-wloc).
in_bboxboolWhether the point is inside our harvested bounding box.
first_seen / last_seendatetimeObservation window — your freshness signal.
distance_mfloatDistance from the query point (nearby queries).
altitude_delta_mfloatAltitude difference vs a queried altitude.
distance_3d_mfloat3-D distance including altitude.
orig_lat / orig_lonfloatOriginal coordinates before any adjustment.
twinobjectA second sighting of the same BSSID (lat/lon/distance/seen).
zip_code / zip_city / zip_statestringReverse-geocoded ZIP context.
zip_boundsfloat[]ZIP bounding box [lat_min, lon_min, lat_max, lon_max].
phone_area_codesstring[]Area codes covering the location.
vendorstringManufacturer resolved from the OUI.
device_classstringInferred hardware type (router, AP, hotspot…).
device_iconstringUI icon hint for the device class.
device_labelstringHuman-readable device label.
is_randomboolLocally-administered / randomized MAC.
company_addressstringRegistered address of the OUI owner.
country_codestringCountry of the OUI owner.
assignmentstringIEEE registry block (MA-L / MA-M / MA-S).
transmissionstringUnicast vs multicast (low bit of first octet).
administrationstringUniversally vs locally administered.
virtual_machineboolOUI belongs to a virtual-machine vendor.
is_validboolWhether the MAC is structurally valid.
applicationsarrayKnown protocols/uses associated with the OUI.
wireshark_notesstringNotes from the Wireshark OUI manufacturer DB.
block_foundboolWhether the OUI block was found in the registry.
ip_context.ip_geoobjectRequester-IP location (country/city/postal) from MaxMind GeoLite2; on /v1/verify.
ip_context.ip_asnobjectRequester-IP network operator (ASN + org) — flags hosting/VPN context.
ip_context.ip_vs_wifi_kmfloatDistance between the IP location and the WiFi-derived location, km.
ip_context.looks_spoofedboolAnti-spoof verdict: IP location disagrees with the WiFi location.
POST /v1/cells/verifyendpointScore a claimed coordinate against a serving cell tower's known location.

Enrichment data: includes GeoLite2 data created by MaxMind (maxmind.com); address data © OpenStreetMap contributors (ODbL); elevation by Open-Meteo / Copernicus DEM (CC-BY 4.0).

[ 08 ] Quickstart

Authenticate with the X-API-Key header. Base URL https://api.euqlid.space.

# verify observed BSSIDs
curl -s https://api.euqlid.space/v1/verify \
  -H "X-API-Key: $FRAUDXXX_KEY" \
  -d '{"bssids":["aa:bb:cc:dd:ee:ff","12:34:56:78:9a:bc"]}'

# reverse lookup (zip = coarse, lat/lon = precise)
curl -s "https://api.euqlid.space/v1/aps/nearby?lat=40.73&lon=-73.99&limit=25" \
  -H "X-API-Key: $FRAUDXXX_KEY"

# every network comes back with the COMPLETE field set, e.g.:
# {
#   "bssid": "aa:bb:cc:dd:ee:ff", "lat": 40.7414, "lon": -73.9893,
#   "hacc_m": 12, "vacc_m": 8, "alt_m": 31, "channel": 36, "provider": 1,
#   "vendor": "Cisco Systems", "device_class": "router", "is_random": false,
#   "first_seen": "2025-02-10T...", "last_seen": "2026-05-30T...",
#   "zip_code": "10003", "zip_city": "New York", "zip_state": "NY",
#   "phone_area_codes": ["212","646"],
#   "extras": { /* every other raw Apple Location.* field, verbatim */ }
# }

[ 09 ] Acceptable use

euqlid.space is a B2B risk and verification signal. By using the API you agree:

  • Permitted: fraud prevention, account-takeover defense, KYC/AML, geo-compliance, delivery/field verification, security research.
  • Prohibited: stalking, surveillance of individuals, people-search, locating a specific person's home, consumer tracking without consent, bulk export or resale of the underlying data, or any unlawful use.
  • Results are a probabilistic signal, not legal proof of any person's location. Never use as the sole basis for an adverse decision about an individual.
  • Access is reviewed and may be revoked for abuse. Requests are logged.

[ 10 ] Privacy & opt-out

Networks whose SSID ends in _nomap are excluded upstream and not collected. To suppress a specific BSSID or report misuse, email privacy@euqlid.space; verified requests are suppressed promptly. privacy@euqlid.space

euqlid.space is not affiliated with, endorsed by, or connected to Apple Inc. or any network operator.