| Key | Description | Expected Values |
| success | Status of the request. | boolean |
| device_id | The Device ID is generated as a hash from the user's device hardware and personal settings. This value can be used to track users and detect duplicate accounts or passed to our callback endpoint for confirmation. | SHA256 / string |
| guid | Hardware tracking ID, which uses a different algorithm for calculating a hash of the user's device. This value can overlap with other devices that share the same hardware configuration. Use in conjunction with "guid_confidence". | SHA256 / string |
| guid_confidence | Accuracy of the "guid" match, which associates a GUID hardware profile with other users, where 0 = not likely and 100 = very likely. A result of 100 is a guaranteed match. Confidence levels below 100 use an intelligent "best guess" approach. Some "guid" results may overlap users, such as a device with factory settings for popular devices. | int (0 - 100) |
| fraud_chance | How likely this device is to commit fraud or engage in abusive behavior. 0 = not likely and 100 = very likely. 25 is the median result. Fraud Scores >= 85 are suspicious but not necessarily fraudulent. We recommend flagging or blocking traffic with Fraud Scores >= 90, but you may find it beneficial to use a higher or lower threshold. | int (0 - 100) |
| is_crawler | Is this device associated with being a confirmed crawler from a mainstream search engine such as Googlebot, Bingbot, Yandex, etc? | boolean |
| connection_type | Classification of the IP address connection type as "Residential", "Corporate", "Education", "Mobile", or "Data Center". | string |
| proxy | Returns true if the lookup is on a Proxy, VPN, or Tor connection. | boolean |
| vpn | Is this IP suspected of being a VPN connection? (in which case the proxy will always be "true") | boolean |
| tor | Is this IP suspected of being a Tor connection? (in which case the proxy will always be "true") | boolean |
| active_vpn | Premium Account Feature - Identifies active VPN connections used by popular VPN services and private VPN servers. | boolean |
| active_tor | Premium Account Feature - Identifies active TOR exits on the TOR network. | boolean |
| recent_abuse | This value indicates if there has been any recently verified abuse across our network for this user. Abuse could be a confirmed chargeback, compromised device, fake app install, or similar malicious behavior within the past few days. | boolean |
| bot_status | Premium Account Feature - Indicates if this device is a bot, spoofed device, or non-human request. Provides stronger confidence in decision-making. | boolean |
| reasons | Premium Account Feature - Fraud Score Insights explains how this device's Fraud Score was calculated and provides further details on enhanced Fraud Scores and penalties. This data point is only available via the postback API, so real-time users cannot reverse engineer why they were penalized. | array[string] |
| ssl_fingerprint | Premium Account Feature - SSL fingerprint contains a sha256 of the SSL/TLS ciphers this device supports. Useful for detecting small changes in device fingerprints. This data point is only available via the postback API, so real-time users cannot reverse engineer why they were penalized. | string |
| device_timezone | Premium Account Feature - Time zone pulled directly from the user's device. This value may still look accurate and aligned to the user's IP location for high-risk users; however, we do detect location spoofing through other device signals. | boolean |
| high_risk_device | Premium Account Feature - Indicates devices with a high confidence of fraudulent activity, including emulators, virtual devices, location spoofing, and automated behavior. | boolean |
| ISP | Internet Service Provider of the IP address. If unavailable, then "N/A". | string |
| country | Two-letter country code of the IP address, for example: "US". | string |
| city | City of IP address if available or "N/A" if unknown. | string |
| region | Region or state of IP address if available or "N/A" if unknown. | string |
| timezone | Time zone of IP address if available or "N/A" if unknown. | string |
| mobile | Is this a mobile device? | boolean |
| operating_system | Operating system name and version or "N/A" if unknown. | string |
| browser | Browser name and version or "N/A" if unknown. | string |
| brand | Brand name of the device or "N/A" if unknown. | string |
| model | Model name of the device or "N/A" if unknown. | string |
| ip_address | The IP address associated with the device in IPv4 or IPv6 format. | string |
| unique | Returns "false" if this device ID has been seen on multiple IP addresses. Returns "true" if we haven't seen this ID on multiple IPs. | boolean |
| canvas_hash | A hash of the user's Canvas profile, calculated by the graphics card and other device hardware. This value is often not unique, so should not be used to identify a specific user. | SHA256 / string |
| webgl_hash | A hash of the user's WebGL profile, calculated by the graphics card and other device hardware. This value is often not unique, so should not be used to identify a specific user. | SHA256 / string |
| request_id | A unique identifier for this request that can be used to look up the request details, interact with our API reports, or send a postback conversion notice. | string |
| click_date | Time of this request. (Premium feature) | Date Time |
| first_seen | Time of the first request. (Premium feature) | Date Time |
| last_seen | Time of the most recent request. (Premium feature) | Date Time |
| longitude | Measure of Longitude on a world map. (Premium feature) | decimal |
| latitude | Measure of Latitude on a world map. (Premium feature) | decimal |
| organization | The Organization associated with this request. (Premium feature) | string |
Response Parameters
Response Field Definitions