Skip to main content

Data Models

Snapshot (Debug format)

The debug format is returned by /pub/.../debug/...:
{
  "RequestID":            "550e8400-e29b-41d4-a716-446655440000",
  "DeviceID":             "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
  "VisitorID":            "7f3e9a12-4b5c-4d6e-8f9a-0b1c2d3e4f5a",
  "UserHID":              "e3b0c44298fc...",
  "IP":                   "93.184.216.34",
  "OS":                   "Windows",
  "Browser":              "Chrome",
  "Country":              "US",
  "Score":                42,
  "Details":              [{"Value": 20, "Description": "Is datacenter"}, ...],
  "ConnectionType":       "wifi",
  "DeviceType":           "desktop",
  "WebRtcConnectionType": "srflx",
  "WebRtcCountry":        "US",
  "WebRtcHIP":            "93.184.216.34",
  "TcpMss":               1460,
  "MtuHint":              "ethernet",
  "MtuValue":             1500,
  "CreatedAt":            "2026-04-14T10:00:00Z"
}
FieldTypeDescription
RequestIDUUIDUnique session identifier
DeviceIDhex stringBrowser fingerprint hash
VisitorIDUUIDPersistent visitor ID (localStorage)
UserHIDstringHashed user identifier
IPstringClient IP address
OSstringUser-Agent OS
BrowserstringDetected browser name
Countrystring2-letter ISO country (from IP)
ScoreintegerTrust Score (0–999)
DetailsarrayFired signals
ConnectionTypestringwifi, cellular, ethernet, etc.
DeviceTypestringdesktop, mobile, tablet
WebRtcConnectionTypestringsrflx, relay, host
WebRtcCountrystringCountry of WebRTC-detected IP
WebRtcHIPstringHidden IP discovered via WebRTC
TcpMssintegerTCP Maximum Segment Size (OS fingerprinting)
MtuHintstringNetwork interface type hint
MtuValueintegerDetected MTU value
CreatedAtISO 8601Timestamp

Score Detail

Each entry in the Details array:
{ "Value": 20, "Description": "Is datacenter" }
FieldTypeDescription
ValueintegerPoints added to total score
DescriptionstringSignal name — see Reasons

Site (Domain)

{
  "id":              "abc-123-uuid",
  "domain":          "example.com",
  "public_key":      "d932476e-...",
  "secret_key":      "89jb7aadz...",
  "callback":        "https://your-server.com/webhook",
  "enabled":         true,
  "domain_verified": false,
  "created_at":      "2026-01-15T09:00:00Z"
}

Pattern

{
  "id":                 42,
  "pattern_name":       "high_velocity_device",
  "entity_type":        "device_id",
  "entity_id":          "a1b2c3d4...",
  "level":              "dangerous",
  "current_value":      47,
  "first_detected":     "2026-04-10T08:00:00Z",
  "last_seen":          "2026-04-14T10:30:00Z",
  "weeks_active_4":     1,
  "became_suspicious":  "2026-04-10T08:00:00Z",
  "became_dangerous":   "2026-04-12T14:00:00Z"
}

PatternSummary

{
  "pattern_name":  "high_velocity_device",
  "entity_type":   "device_id",
  "suspicious":    12,
  "dangerous":     3,
  "total":         15,
  "last_seen":     "2026-04-14T10:30:00Z",
  "weeks_active_4": 2
}

Webhook Payload

{
  "Data": {
    "RequestID":       "550e8400-...",
    "DeviceID":        "a1b2c3d4...",
    "VisitorID":       "7f3e9a12-...",
    "UserHID":         "e3b0c442...",
    "IP":              "93.184.216.34",
    "OS":              "Windows",
    "Country":         "US",
    "Score":           42,
    "Details":         [{ "Value": 20, "Description": "Is datacenter" }],
    "LastRequestTime": "2026-04-14T10:00:00Z"
  },
  "Assing": "3d4e5f6a..."
}