Provenance
Provenance tells you how we know each thing we return. Every enrichment field carries an *_origin value, so you can weigh a data point by how it was obtained rather than trusting it blindly.
The six origin values
| Origin | What it indicates |
|---|---|
checked | We actively probed this in real time and got an answer. |
cached | We reused a recent result for this address or domain instead of re-probing. |
skipped | We did not attempt this — the depth tier or your plan did not call for it. Not billed. |
throttled | We tried, but the far end rate-limited us before we got an answer. Not billed. |
failed_open | A dependency was unavailable, so we let the record through rather than block your pipeline. Not billed. See your Fail policy in Settings. |
suppressed | We withheld a result because the address is on a suppression list (spam trap / abuse). Not billed. |
checked is not the same as certain
Read this carefully. checked means the probe ran and returned a response — nothing more. It does not mean the answer is guaranteed. A mail server can accept a recipient it will later bounce, a catch-all domain accepts everyone, and a server’s behaviour can change minute to minute. Treat checked as “we asked and this is what we were told,” not as “this is certified true.”
This is why the verdict and the evidence matter together: the verdict is our judgement, and the evidence is the raw exchange it was based on, so you can form your own.
Only checked and cached results can be billable. The other four origins are never charged — see How billing works.