Decisions & Scores

Field	Type	Detail
account_id	String	Your UUID for the current user
decision	String {Real, Suspicious, Fake}	How risky the user is: Real, Suspicious, Fake - use this to create workflows (like blocking or challenging a user)
account_score	Float [0-1]	The risk probability on 0-100%, where 100% is riskiest
bot	Float [0-1]	Probability of automation / bot activity
risk_signals	Float [0-1]	Probability that the user is fraudulent or fake - based on device, network, and identifiers
multiple_accounts	Float [0-1]	Probability that the user has more accounts than allowed
accounts_linked	Integer	Number of other accounts the user is tied to
lists	Array	Any lists that the user is part of; use in workflows

Account Details

Field	Type	Detail
num_sessions	Integer	Count of unique sessions from account
first_seen	DateTime	Timestamp of first session we saw this account
last_seen	DateTime	Timestamp of most recent session

Field	Type	Detail
unique_devices	Integer	Count of unique devices used by account over time span (1 day or 7 days); time is relative to last_seen (not current time) More devices = more risk (and potential account sharing)
unique_networks	Integer	Count of unique IPs used by account over time span (1 day or 7 days); time is relative to last_seen (not current time) More networks = more risk (and potential account sharing)

Field	Type	Detail
personal	Boolean	Whether email is a known personal address domain (e.g., gmail)
disposable	Boolean	Whether email is a known temporary / disposable domain (fake email)
valid	Boolean	Whether email is valid / real

Time-based risk averages for each of our risk signals: Float [0-1]

Information about the IP address for the given session

Field	Type	Detail
ip_address	String	IP of connecting users
service_provider	String	Company / Internet Service provider that maintains connecting IP
connection_type	String {mobile, datacenter, business, education, government, hosting, banking}	Type of connecting IP address

Geolocation information based on the current session's IP address

Field	Type	Detail
continent	String	Continent of session IP address
country_code	String (2-letter format)	Country of session IP address
city	String	City of session IP address
zip_code	String	Zip Code of session IP address
latitude	Float	Coordinate of IP address
longitude	Float	Coordinate of IP address

Information about the current session's browser

Field	Type	Detail
type	String	Browser type (e.g., Chrome, Safari)
version	String	Browser major version
language	String	Browser preferred language

Data about the session's current device

Field	Type	Detail
category	String	The device category (e.g. desktop, mobile)
type	String	Device model (e.g., iPhone, Android)
os	String	Operating system
cpu_cores	String	Number of cores detected
gpu	String	Detected GPU (graphics processing unit)

Behavioral events observed for the given session at the time of prediction

Field	Type	Detail
mouse_num_events	Integer	Number of mouse events observed
click_num_events	Integer	Number of click events observed (1 click = 1 event)
keyboard_num_events	Integer	Number of keystrokes observed (1 up/down = 1 event)
touch_num_events	Integer	Number of touches observed (1 up/down = 1 event)
clipboard_num_events	Integer	Number of copy / pastes observed (1 copy or 1 paste = 1 event)

Risk probabilities about the current session

Field	Type	Detail
device_risk	Boolean	Current device is an emulator, virtual machine, or has suspicious characteristics
proxy	Boolean	Session IP is a detected Proxy IP (hiding their true IP and location)
vpn	Boolean	Session IP is a known VPN IP (hiding their true IP and location)
datacenter	Boolean	Session IP is a known datacenter IP (hiding their true IP and location)
tor	Boolean	User is connecting via known TOR network
spoofed_ip	Boolean	User is connecting via known fake / spoofed / invalid IP
recent_fraud_ip	Boolean	Current IP has been marked for fraud in last 30 days
impossible_travel	Boolean	User traveled impossible distance between recent sessions
device_network_mismatch	Boolean	Device characteristics of user don't match typical network connection characteristics for that device (indicates potentially suspicious device)