detection_flags for decisions, signals for the score breakdown and risk_score for the final score. The dashboard groups related detections into readable labels.
Source signals
The table maps the scored payload fields and signal weights. Use the returned Risk Score as the final result; the individual weights do not reproduce it in every case.999 means Banned IP and is outside the normal 0–100 score scale. These are the 20 public boolean keys in the current scored webhook. Signal contribution names can differ from flag keys: for example, Anti-Detect Browser contributes as antidetect_browser but its flag is anti_detect_browser.
The os_mismatch flag reports operating-system inconsistency. The connection type private_relay is the same privacy-relay classification as the private_relay risk signal.
Dashboard labels
A dashboard label can represent several source signals. Counting labels or adding their displayed weights does not reproduce an identification’s score.
The combined contribution of each group is capped at 60 for Proxy, 30 for Check Incomplete and 90 for Bad bot. The overall Risk Score is capped at 100, except for the separate Banned IP value of 999.
For example, a Proxy label does not mean
detection_flags.proxy must be true. Inspect the source flags to distinguish a proxy verdict from latency or OS evidence.
Bots and automation
Good bot combines recognized search and AI traffic. Bad bot groups automation and spoofing detections. Recognized good bots receive a score of 0. ShieldLabs identifies the company behind a recognized search bot, AI bot or AI browser. The correspondingsearch_bot_owner, ai_bot_owner or ai_browser_owner field in webhook data contains one company name when known, alongside the matching signal. It does not name the program or the person controlling it and does not change the Risk Score. The dashboard displays the name beside the signal in Good bot; it may display Unknown when no name is available. The webhook does not send the string Unknown. See Bot provider.
Read Bot detection overview for automation checks, bot groups and integration. Read AI agent detection for browser-platform verification and AI assistant detection for assistant fetchers and AI crawlers. The bot directory lists supported clients and their provider attribution.
Informational flags
Incognito, Check Incomplete, Search bot, AI bots and AI browser have nominal weight 0. In the current scored webhook, each active zero-weight detection appears indetection_flags and in signals with weight 0.
IP Mismatch has weight 45 when detected. It is not a zero-weight flag. Use the returned detection flag rather than comparing IP strings yourself.
Connection type
connection_type summarizes the network path.
The
connection_type field contains one classification for a check, in both identification.scored and History. Use it to group traffic by connection type. direct does not guarantee the absence of every risk indicator; inspect the source flags and Risk Score.
Read signals for an account
Open the user in Analytics to inspect its identifications and graph. In code, read the History API byuser_hid. History has its own field names and response shape; it is not the webhook body.