| Key | Description | Expected Values | Premium Account Feature |
| success | Status of the request. | boolean | |
| device_id | The Device ID is generated as a hash from the user's device hardware and personal settings. This value can be used to track users and detect duplicate accounts or passed to our callback endpoint for confirmation. | SHA256 / string | |
| guid | Hardware tracking ID, which uses a different algorithm for calculating a hash of the user's device. This value can overlap with other devices that share the same hardware configuration. Use in conjunction with "guid_confidence". | SHA256 / string | |
| guid_confidence | Accuracy of the "guid" match, which associates a GUID hardware profile with other users, where 0 = not likely and 100 = very likely. A result of 100 is a guaranteed match. Confidence levels below 100 use an intelligent "best guess" approach. Some "guid" results may overlap users, such as a device with factory settings for popular devices. | int (0 - 100) | |
| fraud_chance | How likely this device is to commit fraud or engage in abusive behavior. 0 = not likely and 100 = very likely. 25 is the median result. Fraud Scores >= 85 are suspicious but not necessarily fraudulent. We recommend flagging or blocking traffic with Fraud Scores >= 90, but you may find it beneficial to use a higher or lower threshold. | int (0 - 100) | |
| is_crawler | Is this device associated with being a confirmed crawler from any of the following known search engines: Baidu, Google, Bing, Yahoo, Yandex, Sogou, Exabot, DuckDuckGo, Facebook, Twitter, Pinterest, Naver, UptimeRobot, AppleBot, ArchiveBot, CoccocBot, YisouBot, PetalBot, ByteDance, and MailRU. | boolean | |
| connection_type | Classification of the IP address connection type as "Residential", "Corporate", "Education", "Mobile", or "Data Center". | string | |
| proxy | Returns true if the lookup is on a Proxy, VPN, or Tor connection. | boolean | |
| vpn | Is this IP suspected of being a VPN connection? (in which case the proxy will always be "true") | boolean | |
| tor | Is this IP suspected of being a Tor connection? (in which case the proxy will always be "true") | boolean | |
| active_vpn | Identifies active VPN connections used by popular VPN services and private VPN servers. | boolean | Yes |
| active_tor | Premium Account Feature - Identifies active TOR exits on the TOR network. | boolean | Yes |
| recent_abuse | This value indicates if there has been any recently verified abuse across our network for this user. Abuse could be a confirmed chargeback, compromised device, fake app install, or similar malicious behavior within the past few days. | boolean | |
| bot_status | Indicates if this device is a bot, spoofed device, or non-human request. Provides stronger confidence in decision-making. | boolean | Yes |
| reasons | Premium Account Feature - Fraud Score Insights explains how this device's Fraud Score was calculated and provides further details on enhanced Fraud Scores and penalties. This data point is only available via the postback API, so real-time users cannot reverse engineer why they were penalized. | array[string] | Yes |
| ssl_fingerprint | Premium Account Feature - SSL fingerprint contains a sha256 of the SSL/TLS ciphers this device supports. Useful for detecting small changes in device fingerprints. This data point is only available via the postback API, so real-time users cannot reverse engineer why they were penalized. | string | Yes |
| device_timezone | Premium Account Feature - Time zone pulled directly from the user's device. This value may still look accurate and aligned to the user's IP location for high-risk users; however, we do detect location spoofing through other device signals. | boolean | Yes |
| high_risk_device | Premium Account Feature - Indicates devices with a high confidence of fraudulent activity, including emulators, virtual devices, location spoofing, and automated behavior. | boolean | Yes |
| ISP | Internet Service Provider of the IP address. If unavailable, then "N/A". | string | |
| country | Two-letter country code of the IP address, for example: "US". | string | |
| city | City of IP address if available or "N/A" if unknown. | string | |
| region | Region or state of IP address if available or "N/A" if unknown. | string | |
| timezone | Time zone of IP address if available or "N/A" if unknown. | string | |
| mobile | Is this a mobile device? | boolean | |
| operating_system | Operating system name and version or "N/A" if unknown. | string | |
| browser | Browser name and version or "N/A" if unknown. | string | |
| brand | Brand name of the device or "N/A" if unknown. | string | |
| model | Model name of the device or "N/A" if unknown. | string | |
| ip_address | The IP address associated with the device in IPv4 or IPv6 format. | string | |
| unique | Returns "false" if this device ID has been seen on multiple IP addresses. Returns "true" if we haven't seen this ID on multiple IPs. | boolean | |
| canvas_hash | A hash of the user's Canvas profile, calculated by the graphics card and other device hardware. This value is often not unique, so should not be used to identify a specific user. | SHA256 / string | |
| webgl_hash | A hash of the user's WebGL profile, calculated by the graphics card and other device hardware. This value is often not unique, so should not be used to identify a specific user. | SHA256 / string | |
| request_id | A unique identifier for this request that can be used to look up the request details, interact with our API reports, or send a postback conversion notice. | string | |
| click_date | Time of this request. | Date Time | Yes |
| cookies | Whether cookies are enabled on the device. | boolean | Yes |
| first_seen | Time of the first request. | Date Time | Yes |
| last_seen | Time of the most recent request. | Date Time | Yes |
| longitude | Measure of Longitude on a world map. | decimal | Yes |
| latitude | Measure of Latitude on a world map. | decimal | Yes |
| organization | The Organization associated with this request. | string | Yes |
| adblock | If the device is using an ad blocker. | bool | Yes |
| cpu_cores | The number of CPU cores on the device. | int | Yes |
| graphics_card | The graphics card used by the device (e.g., NVIDIA, NVIDIA GeForce RTX 3080 (0x00002216) Direct3D11 vs_5_0 ps_5_0, D3D11 ). | string | Yes |
| hostname | The hostname of the device. | string | Yes |
| iframe_detected | If an inline frame element was detected. | bool | Yes |
| interface | The name of the connector for the network. | string | Yes |
| language | The language code in use by the device (e.g., en-US ). | locale | Yes |
| memory | The amount of memory (RAM) available to the device, as reported by the device itself. Many devices report the approximate, rounded amount of device memory in gigabytes. | int | Yes |
| mtu | The maximum transition unit (MTU) size of the device in bytes. | int | Yes |
| plugins | What plugins are in use by the device's browser. | array | Yes |
| resolution | The screen resolution of the device (e.g., [1920, 1080] ). | array | Yes |
| true_os | The operating system (OS) of the device (e.g., Windows ). | string | Yes |
| user_agent | The user agent of the device (e.g., Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0 ). | string | Yes |