- About the IPQS APIs
- Proxy & VPN Detection API
- Email Verification API
- Phone Number Validation API
- Malicious URL Scanner API
- Device Fingerprint API
- Mobile Device Fingerprinting SDK
- Fraud Flows
- Transaction Scoring API
- Gaming Fraud Detection SDK
- Dark Web Leak API
- Malware File Scanner API
- Request List API
- Fraud Reporting API
- Account Management APIs
- Bulk Validation CSV
- Allowlist Blocklist APIs
- AI Fraud Analyst
- Plugins Platforms Integrations
- IP Reputation Database
- IP Address Abuse Feed
- Email Verification Database
-
Custom Integrations
- Getting Started
- Authentication
- Refresh Secret
- IP & Proxy Checks
- Email Verification Checks
- Phone Number Validity Checks
- Device Tracker
- List Device Trackers
- Device Tracker Statistics
- Login Tokens
- Overview Statistics
- Recent Proxy Statistics
- Recent Email Statistics
- Fraud Reporting
- Retrieve Requests by ID
- Device Fraud Risk Reasons API Documentation
- Transaction Risk Reasons API Documentation
- Country List API Documentation
- Release Notes
Response Parameters
Rate this article:
Select all that apply:
Email:
Response Field Definitions#
Learn about the parameters returned by the Device Fingerprint API. With clear definitions for every response value, you can fine tune your requests to better protect against fraud.
| Key | Description | Expected Values | Premium Account Feature |
|---|---|---|---|
success |
Status of the request. | boolean | |
device_id |
The Device ID is generated as a hash from the user's device hardware and personal settings. This value can be used to track users and detect duplicate accounts or passed to our callback endpoint for confirmation. | SHA256 / string | |
guid |
Hardware tracking ID, which uses a different algorithm for calculating a hash of the user's device. This value can overlap with other devices that share the same hardware configuration. Use in conjunction with guid_confidence. |
SHA256 / string | |
guid_confidence |
Accuracy of the guid match, which associates a GUID hardware profile with other users, where 0 = not likely and 100 = very likely. A result of 100 is a guaranteed match. Confidence levels below 100 use an intelligent "best guess" approach. Some guid results may overlap users, such as a device with factory settings for popular devices. |
int (0 - 100) | |
fraud_chance |
How likely this device is to commit fraud or engage in abusive behavior. 0 = not likely and 100 = very likely. 25 is the median result. Fraud Scores >= 85 are suspicious but not necessarily fraudulent. We recommend flagging or blocking traffic with Fraud Scores >= 90, but you may find it beneficial to use a higher or lower threshold. | int (0 - 100) | |
is_crawler |
Is this device associated with being a confirmed crawler from any of the following known search engines: Baidu, Google, Bing, Yahoo, Yandex, Sogou, Exabot, DuckDuckGo, Facebook, Twitter, Pinterest, Naver, UptimeRobot, AppleBot, ArchiveBot, CoccocBot, YisouBot, PetalBot, ByteDance, and MailRU. | boolean | |
connection_type |
Classification of the IP address connection type as Residential, Corporate, Education, Mobile, or Data Center. |
string | |
proxy |
Returns true if the lookup is on a Proxy, VPN, or Tor connection. | boolean | |
vpn |
Is this IP suspected of being a VPN connection? (in which case the proxy will always be true) |
boolean | |
tor |
Is this IP suspected of being a Tor connection? (in which case the proxy will always be true) |
boolean | |
active_vpn |
Identifies active VPN connections used by popular VPN services and private VPN servers. | boolean | Yes |
active_tor |
Premium Account Feature - Identifies active TOR exits on the TOR network. | boolean | Yes |
recent_abuse |
This value indicates if there has been any recently verified abuse across our network for this user. Abuse could be a confirmed chargeback, compromised device, fake app install, or similar malicious behavior within the past few days. | boolean | |
bot_status |
Indicates if this device is a bot, spoofed device, or non-human request. Provides stronger confidence in decision-making. | boolean | Yes |
reasons |
Premium Account Feature - Fraud Score Insights explains how this device's Fraud Score was calculated and provides further details on enhanced Fraud Scores and penalties. This data point is only available via the postback API, so real-time users cannot reverse engineer why they were penalized. | array[string] | Yes |
ssl_fingerprint |
Premium Account Feature - SSL fingerprint contains a sha256 of the SSL/TLS ciphers this device supports. Useful for detecting small changes in device fingerprints. This data point is only available via the postback API, so real-time users cannot reverse engineer why they were penalized. | string | Yes |
device_timezone |
Premium Account Feature - Time zone pulled directly from the user's device. This value may still look accurate and aligned to the user's IP location for high-risk users; however, we do detect location spoofing through other device signals. | boolean | Yes |
high_risk_device |
Premium Account Feature - Indicates devices with a high confidence of fraudulent activity, including emulators, virtual devices, location spoofing, and automated behavior. | boolean | Yes |
ISP |
Internet Service Provider of the IP address. If unavailable, then N/A. |
string | |
country |
Two-letter country code of the IP address, for example: US. |
string | |
city |
City of IP address if available or N/A if unknown. |
string | |
region |
Region or state of IP address if available or N/A if unknown. |
string | |
timezone |
Time zone of IP address if available or N/A if unknown. |
string | |
mobile |
Is this a mobile device? | boolean | |
operating_system |
Operating system name and version or N/A if unknown. |
string | |
browser |
Browser name and version or N/A if unknown. |
string | |
brand |
Brand name of the device or N/A if unknown. |
string | |
model |
Model name of the device or N/A if unknown. |
string | |
ip_address |
The IP address associated with the device in IPv4 or IPv6 format. | string | |
unique |
Returns "false" if this device ID has been seen on multiple IP addresses. Returns true if we haven't seen this ID on multiple IPs. |
boolean | |
canvas_hash |
A hash of the user's Canvas profile, calculated by the graphics card and other device hardware. This value is often not unique, so should not be used to identify a specific user. | SHA256 / string | |
webgl_hash |
A hash of the user's WebGL profile, calculated by the graphics card and other device hardware. This value is often not unique, so should not be used to identify a specific user. | SHA256 / string | |
request_id |
A unique identifier for this request that can be used to look up the request details, interact with our API reports, or send a postback conversion notice. | string | |
click_date |
Date Time of this request or N/A if no click date supplied. |
Date Time | Yes |
cookies |
Whether cookies are enabled on the device. | boolean | Yes |
first_seen |
Time of the first request. | Date Time | Yes |
last_seen |
Time of the most recent request. | Date Time | Yes |
longitude |
Measure of Longitude on a world map. | decimal | Yes |
latitude |
Measure of Latitude on a world map. | decimal | Yes |
organization |
The Organization associated with this request. | string | Yes |
adblock |
If the device is using an ad blocker. | bool | Yes |
cpu_cores |
The number of CPU cores on the device. | int | Yes |
graphics_card |
The graphics card used by the device (e.g., NVIDIA, NVIDIA GeForce RTX 3080 (0x00002216) Direct3D11 vs_5_0 ps_5_0, D3D11 ). |
string | Yes |
hostname |
The hostname of the device. | string | Yes |
iframe_detected |
If an inline frame element was detected. | bool | Yes |
interface |
The name of the connector for the network. | string | Yes |
language |
The language code in use by the device (e.g., en-US ). |
locale | Yes |
memory |
The amount of memory (RAM) available to the device, as reported by the device itself. Many devices report the approximate, rounded amount of device memory in gigabytes. | int | Yes |
mtu |
The maximum transition unit (MTU) size of the device in bytes. | int | Yes |
plugins |
What plugins are in use by the device's browser. | array | Yes |
resolution |
The screen resolution of the device (e.g., [1920, 1080] ). |
array | Yes |
true_os |
The operating system (OS) of the device (e.g., Windows ). |
string | Yes |
browser_fingerprint |
Hash of this user's browser and settings configuration which can be used to track the user. | string | Yes |
user_agent |
The user agent of the device (e.g., Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0). |
string | Yes |
recent_data_matches |
Returns recent matches for submitted data. Each match shows the value, its type, and how many times IPQS has seen that value in the last 7 days. | Object | |
recent_unique_user_values |
Returns counts of unique data values associated with customer-defined variables submitted with the request. | Object |
recent_data_matches fields#
The recent_data_matches object indicates how often IPQS has seen submitted values within the last 7 days. The matches array can return the standard types below, as well as customer-defined variables included with the request.
| Type | Description |
|---|---|
ip_address |
The submitted IP address. |
email_address |
The submitted email address. |
billing_email_address |
The submitted billing email address. |
shipping_email_address |
The submitted shipping email address. |
billing_address |
The submitted billing address. |
shipping_address |
The submitted shipping address. |
phone_number |
The submitted phone number. |
device_id |
The submitted device ID. |
Each entry in the matches array contains the following fields:
| Key | Description | Expected Values |
|---|---|---|
type |
The type of value that matched. This can be one of the standard types above or a customer-defined variable passed with the request. | String |
value |
The value that matched. | String |
recent_occurrences |
The number of times IPQS has seen the value in the last 7 days. | Integer |
recent_unique_user_values fields#
The recent_unique_user_values object returns counts of unique data values associated with customer-defined variables. For example, if a request includes userID=1234, the response can return types such as unique_userID_ip_addresses, unique_userID_email_addresses, unique_userID_phone_numbers, unique_userID_device_ids, unique_userID_billing_addresses, and unique_userID_shipping_addresses.
Each entry in the unique_values array contains the following fields:
| Key | Description | Expected Values |
|---|---|---|
type |
Identifies the customer-defined variable and the type of unique value counted. | String |
recent_occurrences |
The number of unique values associated with the customer-defined variable. | Integer |