The MAC vendor database as JSON: format, and how to query it

The JSON download carries the same full block list as the CSV: every MA-L, MA-M, MA-S, IAB, and CID registration, as a single array of objects. Rebuilt from the live registry twice a day, same as every file on the downloads page.

Shape

[
  {
    "mac_prefix": "00:00:0C",
    "mask_bits": 24,
    "block_type": "MA-L",
    "organization": "CISCO SYSTEMS, INC.",
    "country": "US"
  },
  ...
]

address and country are omitted entirely from an object when IEEE didn't publish one, rather than sent as an empty string, so a plain key-existence check is enough to know whether either field is worth reading.

Querying it

jq, filter by name:

jq '.[] | select(.organization | test("Apple"; "i"))' vendors.json

jq, build a prefix-to-vendor lookup map:

jq 'map({(.mac_prefix): .organization}) | add' vendors.json > lookup.json

Node.js, an in-memory lookup table:

const vendors = require("./vendors.json");
const byPrefix = new Map(vendors.map(v => [v.mac_prefix, v.organization]));
byPrefix.get("00:00:0C"); // "CISCO SYSTEMS, INC."

Python:

import json
vendors = json.load(open("vendors.json"))
by_prefix = {v["mac_prefix"]: v["organization"] for v in vendors}

File vs. API

A bulk file like this one is the right call for offline environments, batch ETL jobs, or anything that would rather hold a few megabytes in memory than make a network call per lookup. If MAC addresses instead arrive one at a time on a live path, request handling, a streaming pipeline, an onboarding webhook, the free JSON API is usually the better fit: no file to keep refreshed, always current, and it also returns the IEEE 802c classification, randomization confidence, and EUI-64/IPv6 derivation a static file has no room for.