Skip to main content

Data Models

Snapshot (Debug format)

The debug format is returned by /pub/.../debug/...:
{
  "RequestID":            "550e8400-e29b-41d4-a716-446655440000",
  "DeviceID":             "6ba7b810-9dad-11d1-80b4-00c04fd430c9",
  "VisitorID":            "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "UserHID":              "e3b0c44298fc...",
  "IP":                   "93.184.216.34",
  "OS":                   "Windows",
  "Browser":              "Chrome",
  "Country":              "US",
  "Score":                42,
  "Details":              [{"Value": 10, "Description": "Is datacenter"}, ...],
  "ConnectionType":       "wifi",
  "DeviceType":           "desktop",
  "WebRtcConnectionType": "srflx",
  "WebRtcCountry":        "US",
  "WebRtcHIP":            "93.184.216.34",
  "TcpMss":               1460,
  "MtuHint":              "direct",
  "MtuValue":             1500,
  "CreatedAt":            "2026-04-14T10:00:00Z"
}
FieldTypeDescription
RequestIDUUIDUnique check identifier
DeviceIDUUIDDerived from stable MixVisit fingerprint components
VisitorIDUUIDDerived from DeviceID + CookieID pair
UserHIDstringHashed user identifier
IPstringClient IP address
OSstringUser-Agent OS
BrowserstringDetected browser name
Countrystring2-letter ISO country (from IP)
ScoreintegerTrust Score (0–999)
DetailsarrayFired signals
ConnectionTypestringwifi, cellular, ethernet, etc.
DeviceTypestringdesktop, mobile, tablet
WebRtcConnectionTypestringsrflx, relay, host
WebRtcCountrystringCountry of WebRTC-detected IP
WebRtcHIPstringIP discovered via WebRTC
TcpMssintegerTCP Maximum Segment Size
MtuHintstringdirect, vpn, tor_double_vpn, datacenter
MtuValueintegerDetected MTU value
CreatedAtISO 8601Timestamp

Score Detail

Each entry in the Details array:
{ "Value": 10, "Description": "Is datacenter" }
FieldTypeDescription
ValueintegerPoints added to total score
DescriptionstringSignal name — see Reasons

Site (Domain)

{
  "id":              "abc-123-uuid",
  "domain":          "example.com",
  "public_key":      "a3f8c2d1e9b0...",
  "secret_key":      "7e4b9a2c8d1f...",
  "callback":        "https://your-server.com/webhook",
  "enabled":         true,
  "domain_verified": false,
  "created_at":      "2026-01-15T09:00:00Z"
}

Pattern

{
  "id":                 42,
  "pattern_name":       "high_velocity_device",
  "entity_type":        "device_id",
  "entity_id":          "6ba7b810-9dad-11d1-80b4-00c04fd430c9",
  "level":              "dangerous",
  "current_value":      47,
  "first_detected":     "2026-04-10T08:00:00Z",
  "last_seen":          "2026-04-14T10:30:00Z",
  "weeks_active_4":     1,
  "became_suspicious":  "2026-04-10T08:00:00Z",
  "became_dangerous":   "2026-04-12T14:00:00Z"
}

PatternSummary

{
  "pattern_name":  "high_velocity_device",
  "entity_type":   "device_id",
  "suspicious":    12,
  "dangerous":     3,
  "total":         15,
  "last_seen":     "2026-04-14T10:30:00Z",
  "weeks_active_4": 2
}

Webhook Payload

{
  "Data": {
    "RequestID":       "550e8400-...",
    "SessionID":       "7a1b2c3d-...",
    "CookieID":        "3f2e1d0c-...",
    "DeviceID":        "6ba7b810-...",
    "VisitorID":       "a1b2c3d4-...",
    "UserHID":         "e3b0c442...",
    "IP":              "93.184.216.34",
    "OS":              "Windows",
    "Country":         "US",
    "Score":           42,
    "Details":         [{ "Value": 10, "Description": "Is datacenter" }],
    "LastRequestTime": "2026-04-14T10:00:00Z",
    "Phase":           "initial"
  },
  "Assing": "3d4e5f6a..."
}