Skip to main content
What changed across the ShieldLabs platform and these docs. Newest first.

​
June 2026

​
Documentation rebuilt from the production codebase

The developer docs were rewritten end to end to match exactly what ships in production. The previous docs described features and a score range that the product does not have. If you integrated against the old pages, review the highlights below.
The score is the Risk Score, a value from 0 to 100. There is no “Trust Score” and no 0 to 999 scale. There is no in-product rules engine: ShieldLabs returns a score and the signals behind it, and your own code decides whether to allow, challenge, review, or block.
What the rebuilt docs now cover accurately:

Risk Score 0 to 100

Explainable score with a Details array. Every entry is the signal that fired and the points it contributed. Bands: Clean (0 to 9), Low (10 to 29), Medium (30 to 59), High (60 to 100).

Single webhook per check

One signed webhook envelope per identification — event_type plus a data object (request_id, risk_score, signals, observed_at, and the rest). Waits up to 60s for an optional follow-up network check, then always delivers. Signed with X-Shield-Signature on the raw body, keyed per endpoint with whsec_…. At-most-once delivery — make handlers idempotent on request_id.

8 ready-made Patterns

Relationship patterns computed server-side and surfaced on the dashboard Patterns tab as Suspicious or Dangerous detections. An entity below the Suspicious threshold simply is not flagged. They are separate from the per-request scoring signals.

Visitors and Traffic Sources

Estimated unique Visitors and New Visitors counted by a fingerprint-derived identity, plus Traffic Sources that rank each channel by the anonymous-traffic share it delivers.

Server API

Read past results with the History API and fetch your domain profile. Server-side auth uses an Authorization: Bearer token with the X-Shield-Domain header.

Identifiers

DeviceID, VisitorID, CookieID, SessionID, RequestID, and the UserHID you pass in (hash it yourself before passing it). DeviceID is durable because it is derived from the browser environment, not stored.
Corrections from the previous docs:
  • Only four band labels exist: Clean, Low, Medium, High. There is no “Bot” or “Banned” band.
  • The dashboard feature is the Patterns catalog, not “Behavior Patterns” or a “velocity” pattern.
  • 999 is an internal rate-limit sentinel, never a customer Risk Score.
New to the platform? Start with the Quickstart, then read How it works and Acting on the Risk Score.