> ## Documentation Index > Fetch the complete documentation index at: https://docs.fingerprint.com/llms.txt > Use this file to discover all available pages before exploring further. # Search events > ## Search The `/v4/events` endpoint provides a convenient way to search for past events based on specific parameters. Typical use cases and queries include: - Searching for events associated with a single `visitor_id` within a time range to get historical behavior of a visitor. - Searching for events associated with a single `linked_id` within a time range to get all events associated with your internal account identifier. - Excluding all bot traffic from the query (`good` and `bad` bots) By default, the API searches events from the last 7 days, sorts them by newest first and returns the last 10 events. - Use `start` and `end` to specify the time range of the search. - Use `reverse=true` to sort the results oldest first. - Use `limit` to specify the number of events to return. - Use `pagination_key` to get the next page of results if there are more than `limit` events. ### Filtering events with the `suspect` flag The `/v4/events` endpoint unlocks a powerful method for fraud protection analytics. The `suspect` flag is exposed in all events where it was previously set by the update API. You can also apply the `suspect` query parameter as a filter to find all potentially fraudulent activity that you previously marked as `suspect`. This helps identify patterns of fraudulent behavior. ### Environment scoping If you use a secret key that is scoped to an environment, you will only get events associated with the same environment. With a workspace-scoped environment, you will get events from all environments. Smart Signals not activated for your workspace or are not included in the response. ## OpenAPI ````yaml get /events openapi: 3.1.1 info: title: Server API description: > Fingerprint Server API allows you to get, search, and update Events in a server environment. It can be used for data exports, decision-making, and data analysis scenarios. Server API is intended for server-side usage, it's not intended to be used from the client side, whether it's a browser or a mobile device. The API also supports collection of Automation Intelligence for requests to your server in edge, pre-origin, or middleware contexts. version: '4' contact: name: Fingerprint Support email: support@fingerprint.com license: name: MIT url: >- https://github.com/fingerprintjs/fingerprint-pro-server-api-openapi/blob/main/LICENSE servers: - url: https://api.fpjs.io/v4 description: Global - url: https://eu.api.fpjs.io/v4 description: EU - url: https://ap.api.fpjs.io/v4 description: Asia (Mumbai) security: - bearerAuth: [] tags: - name: Event description: | Get, update, or search for information about events. paths: /events: get: tags: - Events summary: Search events description: > ## Search The `/v4/events` endpoint provides a convenient way to search for past events based on specific parameters. Typical use cases and queries include: - Searching for events associated with a single `visitor_id` within a time range to get historical behavior of a visitor. - Searching for events associated with a single `linked_id` within a time range to get all events associated with your internal account identifier. - Excluding all bot traffic from the query (`good` and `bad` bots) By default, the API searches events from the last 7 days, sorts them by newest first and returns the last 10 events. - Use `start` and `end` to specify the time range of the search. - Use `reverse=true` to sort the results oldest first. - Use `limit` to specify the number of events to return. - Use `pagination_key` to get the next page of results if there are more than `limit` events. ### Filtering events with the `suspect` flag The `/v4/events` endpoint unlocks a powerful method for fraud protection analytics. The `suspect` flag is exposed in all events where it was previously set by the update API. You can also apply the `suspect` query parameter as a filter to find all potentially fraudulent activity that you previously marked as `suspect`. This helps identify patterns of fraudulent behavior. ### Environment scoping If you use a secret key that is scoped to an environment, you will only get events associated with the same environment. With a workspace-scoped environment, you will get events from all environments. Smart Signals not activated for your workspace or are not included in the response. operationId: searchEvents parameters: - name: limit in: query required: false schema: type: integer format: int32 minimum: 1 maximum: 100 examples: - 10 description: > Maximum number of events to return. Defaults to 10 when omitted. Results are selected from the time range (`start`, `end`), ordered by `reverse`, then truncated to provided `limit` size. So `reverse=true` returns the oldest N=`limit` events, otherwise the newest N=`limit` events. - name: pagination_key in: query schema: type: string examples: - >- S9rgMMUb4z3X5t5pr_tSgoSZlmyF0O8X7kCV2m981-iY1LmRTjraa1rTk3L-hQExnDWCi0RA-zAIjaVSTNO2AN2eqQWgzT0RjbieMxRfSdkM-HmOhdOgdQvYfPG3vqU1DJKh4Q description: > Use `pagination_key` to get the next page of results. When more results are available (e.g., you requested up to 100 results for your query using `limit`, but there are more than 100 events total matching your request), the `pagination_key` field is added to the response. The pagination key is an arbitrary string that should not be interpreted in any way and should be passed as-is. In the following request, use that value in the `pagination_key` parameter to get the next page of results: 1. First request, returning most recent 100 events: `GET api-base-url/events?limit=100` 2. Use `response.pagination_key` to get the next page of results: `GET api-base-url/events?limit=100&pagination_key=S9rgMMUb4z3X5t5pr_tSgoSZlmyF0O8X7kCV2m981-iY1LmRTjraa1rTk3L-hQExnDWCi0RA-zAIjaVSTNO2AN2eqQWgzT0RjbieMxRfSdkM-HmOhdOgdQvYfPG3vqU1DJKh4Q` - name: visitor_id in: query schema: type: string examples: - Ibk1527CUFmcnjLwIs4A9 description: > Unique [visitor identifier](https://docs.fingerprint.com/reference/js-agent-v4-get-function#visitor_id) issued by Fingerprint Identification and all active Smart Signals. Filter events by matching Visitor ID (`identification.visitor_id` property). - name: high_recall_id in: query schema: type: string examples: - Ibk1527CUFmcnjLwIs4A9 description: > The High Recall ID is a supplementary browser identifier designed for use cases that require wider coverage over precision. Compared to the standard visitor ID, the High Recall ID strives to match incoming browsers more generously (rather than precisely) with existing browsers and thus identifies fewer browsers as new. The High Recall ID is best suited for use cases that are sensitive to browsers being identified as new and where mismatched browsers are not detrimental. Filter events by matching High Recall ID (`supplementary_id_high_recall.visitor_id` property). - name: bot in: query schema: type: string enum: - all - good - bad - none description: > Filter events by the Bot Detection result, specifically: `all` - events where any kind of bot was detected. `good` - events where a good bot was detected. `bad` - events where a bad bot was detected. `none` - events where no bot was detected. > Note: When using this parameter, only events with the `bot` property set to a valid value are returned. Events without a `bot` Smart Signal result are left out of the response. - name: bot_info in: query schema: type: string enum: - all - none description: | Filter events by their Bot Info result, specifically: - `all` - events where any kind of bot was detected. - `none` - events where no bot was detected. - name: bot_info_category in: query style: form schema: type: array items: $ref: '#/components/schemas/BotInfoCategory' description: > Filter events by their Bot Info Category. Multiple categories can be provided using the repeated keys syntax. For example, `bot_info_category=ai_agent&bot_info_category=ai_assistant`, will match events with a Bot Info Category of `ai_agent` or `ai_assistant`. Other notations like comma-separated or bracket notation are not supported. - name: bot_info_identity in: query style: form schema: type: array items: $ref: '#/components/schemas/BotInfoIdentity' description: > Filter events by their Bot Info Identity type. Multiple identity types can be provided using the repeated keys syntax. For example, `bot_info_identity=verified&bot_info_identity=signed`, will match events with a Bot Info Identity of `verified` or `signed`. Other notations like comma-separated or bracket notation are not supported. - name: bot_info_confidence in: query style: form schema: type: array items: $ref: '#/components/schemas/BotInfoConfidence' description: > Filter events by their Bot Info Confidence. Multiple confidences can be provided using the repeated keys syntax. For example, `bot_info_confidence=high&bot_info_confidence=medium`, will match events with a Bot Info Confidence of `high` or `medium`. Other notations like comma-separated or bracket notation are not supported. - name: bot_info_provider in: query style: form schema: type: array items: type: string examples: - OpenAI description: > Filter events by their Bot Info Provider. The provider must match exactly, partial or wildcard matching is not supported. Multiple Providers can be provided using the repeated keys syntax. For example, `bot_info_provider=OpenAI&bot_info_provider=AWS`, will match events with a Bot Info Provider of `OpenAI` or `AWS`. Other notations like comma-separated or bracket notation are not supported. - name: bot_info_name in: query style: form schema: type: array items: type: string examples: - ChatGPT-User description: > Filter events by their Bot Info Name. The name must match exactly, partial or wildcard matching is not supported. Multiple Names can be provided using the repeated keys syntax. For example, `bot_info_name=ChatGPT%20Agent&bot_info_name=Bedrock%20AgentCore`, will match events with a Bot Info Name of `ChatGPT Agent` or `Bedrock AgentCore`. Other notations like comma-separated or bracket notation are not supported. - name: ip_address in: query schema: type: string examples: - 61.127.217.15 description: > Filter events by IP address or IP range (if CIDR notation is used). If CIDR notation is not used, a /32 for IPv4 or /128 for IPv6 is assumed. Examples of range based queries: 10.0.0.0/24, 192.168.0.1/32 - name: asn in: query schema: type: string examples: - '12876' description: > Filter events by the ASN associated with the event's IP address. This corresponds to the `ip_info.(v4|v6).asn` property in the response. - name: linked_id in: query schema: type: string examples: - somelinkedId description: > Filter events by your custom identifier. You can use [linked Ids](https://docs.fingerprint.com/reference/js-agent-v4-get-function#linkedid) to associate identification requests with your own identifier, for example, session Id, purchase Id, or transaction Id. You can then use this `linked_id` parameter to retrieve all events associated with your custom identifier. - name: url in: query schema: type: string examples: - https://example.com/login description: | Filter events by the URL (`url` property) associated with the event. - name: bundle_id in: query schema: type: string examples: - com.example.app description: | Filter events by the Bundle ID (iOS) associated with the event. - name: package_name in: query schema: type: string examples: - com.example.app description: > Filter events by the Package Name (Android) associated with the event. - name: origin in: query schema: type: string examples: - https://example.com description: > Filter events by the origin field of the event. This is applicable to web events only (e.g., https://example.com) - name: start in: query schema: oneOf: - type: integer format: int64 examples: - 1767225600000 - type: string format: date-time examples: - '2026-01-01T00:00:00Z' examples: - '2026-01-01T00:00:00Z' description: > Include events that happened after this point (with timestamp greater than or equal the provided `start` Unix milliseconds value or RFC3339 timestamp). Defaults to 7 days ago. Setting `start` does not change `end`'s default of `now` — adjust it separately if needed. - name: end in: query schema: oneOf: - type: integer format: int64 examples: - 1769903999000 - type: string format: date-time examples: - '2026-01-31T23:59:59Z' examples: - '2026-01-31T23:59:59Z' description: > Include events that happened before this point (with timestamp less than or equal the provided `end` Unix milliseconds value or RFC3339 timestamp). Defaults to now. Setting `end` does not change `start`'s default of `7 days ago` — adjust it separately if needed. - name: reverse in: query schema: type: boolean description: > When `true`, sort events oldest first (ascending timestamp order). Defaults to `false` (newest first, descending timestamp order). - name: suspect in: query schema: type: boolean description: > Filter events previously tagged as suspicious via the [Update API](https://docs.fingerprint.com/reference/server-api-v4-update-event). > Note: When using this parameter, only events with the `suspect` property explicitly set to `true` or `false` are returned. Events with undefined `suspect` property are left out of the response. - name: vpn in: query schema: type: boolean description: > Filter events by VPN Detection result. > Note: When using this parameter, only events with the `vpn` property set to `true` or `false` are returned. Events without a `vpn` Smart Signal result are left out of the response. - name: virtual_machine in: query schema: type: boolean description: > Filter events by Virtual Machine Detection result. > Note: When using this parameter, only events with the `virtual_machine` property set to `true` or `false` are returned. Events without a `virtual_machine` Smart Signal result are left out of the response. - name: tampering in: query schema: type: boolean description: > Filter events by Browser Tampering Detection result. > Note: When using this parameter, only events with the `tampering.result` property set to `true` or `false` are returned. Events without a `tampering` Smart Signal result are left out of the response. - name: anti_detect_browser in: query schema: type: boolean description: > Filter events by Anti-detect Browser Detection result. > Note: When using this parameter, only events with the `tampering.anti_detect_browser` property set to `true` or `false` are returned. Events without a `tampering` Smart Signal result are left out of the response. - name: incognito in: query schema: type: boolean description: > Filter events by Browser Incognito Detection result. > Note: When using this parameter, only events with the `incognito` property set to `true` or `false` are returned. Events without an `incognito` Smart Signal result are left out of the response. - name: privacy_settings in: query schema: type: boolean description: > Filter events by Privacy Settings Detection result. > Note: When using this parameter, only events with the `privacy_settings` property set to `true` or `false` are returned. Events without a `privacy_settings` Smart Signal result are left out of the response. - name: jailbroken in: query schema: type: boolean description: > Filter events by Jailbroken Device Detection result. > Note: When using this parameter, only events with the `jailbroken` property set to `true` or `false` are returned. Events without a `jailbroken` Smart Signal result are left out of the response. - name: frida in: query schema: type: boolean description: > Filter events by Frida Detection result. > Note: When using this parameter, only events with the `frida` property set to `true` or `false` are returned. Events without a `frida` Smart Signal result are left out of the response. - name: factory_reset in: query schema: type: boolean description: > Filter events by Factory Reset Detection result. > Note: When using this parameter, only events with a `factory_reset` time. Events without a `factory_reset` Smart Signal result are left out of the response. - name: cloned_app in: query schema: type: boolean description: > Filter events by Cloned App Detection result. > Note: When using this parameter, only events with the `cloned_app` property set to `true` or `false` are returned. Events without a `cloned_app` Smart Signal result are left out of the response. - name: emulator in: query schema: type: boolean description: > Filter events by Android Emulator Detection result. > Note: When using this parameter, only events with the `emulator` property set to `true` or `false` are returned. Events without an `emulator` Smart Signal result are left out of the response. - name: root_apps in: query schema: type: boolean description: > Filter events by Rooted Device Detection result. > Note: When using this parameter, only events with the `root_apps` property set to `true` or `false` are returned. Events without a `root_apps` Smart Signal result are left out of the response. - name: vpn_confidence in: query schema: type: string enum: - high - medium - low description: > Filter events by VPN Detection result confidence level. `high` - events with high VPN Detection confidence. `medium` - events with medium VPN Detection confidence. `low` - events with low VPN Detection confidence. > Note: When using this parameter, only events with the `vpn.confidence` property set to a valid value are returned. Events without a `vpn` Smart Signal result are left out of the response. - name: min_suspect_score in: query schema: type: number format: float examples: - 7.5 description: > Filter events with Suspect Score result above a provided minimum threshold. > Note: When using this parameter, only events where the `suspect_score` property set to a value exceeding your threshold are returned. Events without a `suspect_score` Smart Signal result are left out of the response. - name: developer_tools in: query schema: type: boolean description: > Filter events by Developer Tools detection result. > Note: When using this parameter, only events with the `developer_tools` property set to `true` or `false` are returned. Events without a `developer_tools` Smart Signal result are left out of the response. - name: location_spoofing in: query schema: type: boolean description: > Filter events by Location Spoofing detection result. > Note: When using this parameter, only events with the `location_spoofing` property set to `true` or `false` are returned. Events without a `location_spoofing` Smart Signal result are left out of the response. - name: mitm_attack in: query schema: type: boolean description: > Filter events by MITM (Man-in-the-Middle) Attack detection result. > Note: When using this parameter, only events with the `mitm_attack` property set to `true` or `false` are returned. Events without a `mitm_attack` Smart Signal result are left out of the response. - name: rare_device in: query schema: type: boolean description: > Filter events by Device Rarity detection result. > Note: When using this parameter, only events with the `rare_device` property set to `true` or `false` are returned. Events without a Device Rarity Smart Signal result are left out of the response. > This Smart Signal is currently in beta and only available to select customers. If you are interested, please [contact our support team](https://fingerprint.com/support/). - name: rare_device_percentile_bucket in: query schema: type: string enum: - Filter events by Device Rarity percentile bucket. ` This Smart Signal is currently in beta and only available to select customers. If you are interested, please [contact our support team](https://fingerprint.com/support/). - name: proxy in: query schema: type: boolean description: > Filter events by Proxy detection result. > Note: When using this parameter, only events with the `proxy` property set to `true` or `false` are returned. Events without a `proxy` Smart Signal result are left out of the response. - name: sdk_version in: query schema: type: string examples: - 3.11.14 description: > Filter events by a specific SDK version associated with the identification event (`sdk.version` property). Example: `3.11.14` - name: sdk_platform in: query schema: type: string enum: - js - android - ios description: > Filter events by the SDK Platform associated with the identification event (`sdk.platform` property) . `js` - Javascript agent (Web). `ios` - Apple iOS based devices. `android` - Android based devices. - name: environment in: query description: > Filter for events by providing one or more environment IDs (`environment_id` property). ### Array syntax To provide multiple environment IDs, use the repeated keys syntax (`environment=env1&environment=env2`). Other notations like comma-separated (`environment=env1,env2`) or bracket notation (`environment[]=env1&environment[]=env2`) are not supported. required: false schema: type: array items: type: string examples: - ae_47abaca3db2c7c43 style: form - name: proximity_id in: query schema: type: string examples: - C9rJYBlOFsAfBwQ description: > Filter events by the most precise Proximity ID provided by default. > Note: When using this parameter, only events with the `proximity.id` property matching the provided ID are returned. Events without a `proximity` result are left out of the response. - name: total_hits in: query schema: type: integer format: int64 minimum: 1 maximum: 1000 examples: - 100 description: > When set, the response will include a `total_hits` property with a count of total query matches across all pages, up to the specified limit. - name: tor_node in: query schema: type: boolean description: > Filter events by Tor Node detection result. > Note: When using this parameter, only events with the `tor_node` property set to `true` or `false` are returned. Events without a `tor_node` detection result are left out of the response. - name: incremental_identification_status in: query schema: type: string enum: - partially_completed - completed description: > Filter events by their incremental identification status (`incremental_identification_status` property). Non incremental identification events are left out of the response. - name: simulator in: query schema: type: boolean description: > Filter events by iOS Simulator Detection result. > Note: When using this parameter, only events with the `simulator` property set to `true` or `false` are returned. Events without a `simulator` Smart Signal result are left out of the response. - name: source in: query required: false schema: type: array maxItems: 1 items: type: string enum: - edge description: > Selects the source of events to search. When omitted, only traditional identification events generated from devices are returned (the default behavior). When set to `edge`, only Automation Intelligence (Edge) events are returned. To retrieve all events regardless of source, you must make two requests. One with the `source` parameter set to `edge`, and another with the `source` parameter omitted. > Note: The Automation Intelligence API is in public preview testing phase. If you encounter any issues, please [contact](https://fingerprint.com/support/) our support team. responses: '200': description: Events matching the filter(s). content: application/json: schema: $ref: '#/components/schemas/EventSearch' examples: 200-ok: summary: Example results value: events: - linked_id: somelinkedId tags: {} timestamp: 1708102555327 event_id: 1708102555327.NLOjmg incremental_identification_status: completed url: https://www.example.com/login?hope{this{works[! ip_address: 61.127.217.15 user_agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) .... device: Other os: Windows os_version: '7' client_referrer: https://example.com/blog/my-article browser_details: browser_name: Chrome browser_major_version: '74' browser_full_version: 74.0.3729 os: Windows os_version: '7' device: Other identification: visitor_id: Ibk1527CUFmcnjLwIs4A9 confidence: score: 0.97 version: '1.1' visitor_found: false first_seen_at: 1708102555327 last_seen_at: 1708102555327 supplementary_id_high_recall: visitor_id: 0jnGMkPYXX37DqVa4ZIO3f_hr visitor_found: true confidence: score: 0 version: Not Supported first_seen_at: 1778086556130 last_seen_at: 1778604975494 proximity: id: w1aTfd4MCvl precision_radius: 10 confidence: 0.95 bot: not_detected root_apps: false emulator: false ip_info: v4: address: 94.142.239.124 geolocation: accuracy_radius: 20 latitude: 50.05 longitude: 14.4 postal_code: 150 00 timezone: Europe/Prague city_name: Prague country_code: CZ country_name: Czechia continent_code: EU continent_name: Europe subdivisions: - iso_code: '10' name: Hlavni mesto Praha asn: '7922' asn_name: COMCAST-7922 asn_network: 73.136.0.0/13 asn_type: isp datacenter_result: true datacenter_name: DediPath v6: address: 2001:db8:3333:4444:5555:6666:7777:8888 geolocation: accuracy_radius: 5 latitude: 49.982 longitude: 36.2566 postal_code: '10112' timezone: Europe/Berlin city_name: Berlin country_code: DE country_name: Germany continent_code: EU continent_name: Europe subdivisions: - iso_code: BE name: Land Berlin asn: '6805' asn_name: Telefonica Germany asn_network: 2a02:3100::/24 asn_type: isp datacenter_result: false datacenter_name: '' ip_blocklist: email_spam: false attack_source: false tor_node: false proxy: true proxy_confidence: low proxy_details: proxy_type: residential last_seen_at: 1708102555327 provider: Massive proxy_ml_score: 0.2 vpn: false vpn_confidence: high vpn_ml_score: 0.2 vpn_origin_timezone: Europe/Berlin vpn_origin_country: unknown vpn_methods: timezone_mismatch: false public_vpn: false auxiliary_mobile: false os_mismatch: false relay: false ml_prediction: false incognito: false tampering: false tampering_confidence: high tampering_ml_score: 0.3231 tampering_details: anomaly_score: 0.1955 anti_detect_browser: false cloned_app: false factory_reset_timestamp: 0 jailbroken: false simulator: false frida: false privacy_settings: false virtual_machine: false virtual_machine_ml_score: 0.2 location_spoofing: false velocity: distinct_ip: 5_minutes: 1 1_hour: 1 24_hours: 1 distinct_country: 5_minutes: 1 1_hour: 2 24_hours: 2 events: 5_minutes: 1 1_hour: 5 24_hours: 5 ip_events: 5_minutes: 1 1_hour: 5 24_hours: 5 distinct_ip_by_linked_id: 5_minutes: 1 1_hour: 5 24_hours: 5 distinct_visitor_id_by_linked_id: 5_minutes: 1 1_hour: 5 24_hours: 5 developer_tools: false mitm_attack: false sdk: platform: js version: 3.11.10 integrations: - name: fingerprint-pro-react version: 3.11.10 subintegration: name: preact version: 10.21.0 replayed: false high_activity_device: false raw_device_attributes: math: 5f030fa7d2e5f9f757bfaf81642eb1a6 vendor: Google Inc. plugins: - description: Portable Document Format mimeTypes: - suffixes: pdf type: application/pdf - suffixes: pdf type: text/pdf name: PDF Viewer webgl_extensions: context_attributes: 6b1ed336830d2bc96442a9d76373252a extension_parameters: 86a8abb36f0cb30b5946dec0c761d042 extensions: 57233d7b10f89fcd1ff95e3837ccd72d parameters: ea118c48e308bc4b0677118bbb3019ec shader_precisions: f223dfbcd580cf142da156d93790eb83 unsupported_extensions: [] cookies_enabled: true webgl_basics: renderer: WebKit WebGL renderer_unmasked: >- ANGLE (Apple, ANGLE Metal Renderer: Apple M4, Unspecified Version) shading_language_version: WebGL GLSL ES 1.0 (OpenGL ES GLSL ES 1.0 Chromium) vendor: WebKit vendor_unmasked: Google Inc. (Apple) version: WebGL 1.0 (OpenGL ES 2.0 Chromium) canvas: geometry: db3c1462576a399a03ae93d0ab9eb5c4 text: 70c3d3f7eb4408dc37a6bf8af1c51029 winding: true hardware_concurrency: 10 languages: - - en-US color_depth: 24 fonts: - Arial Unicode MS - Gill Sans - Helvetica Neue - Menlo indexed_db: true touch_support: max_touch_points: 0 touch_event: false touch_start: false device_memory: 8 oscpu: Windows NT 6.1; Win64; x64 architecture: 127 screen_resolution: - 1920 - 1080 timezone: America/Sao_Paulo emoji: bottom: 32 font: Times height: 18 left: 8 right: 1608 top: 14 width: 1600 x: 8 'y': 14 font_preferences: apple: 147.5625 default: 147.5625 min: 9.234375 mono: 133.0625 sans: 144.015625 serif: 147.5625 system: 146.09375 platform: MacIntel local_storage: true session_storage: true date_time_locale: en-US audio: 124.04347745512496 rare_device: false rare_device_percentile_bucket: - S9rgMMUb4z3X5t5pr_tSgoSZlmyF0O8X7kCV2m981-iY1LmRTjraa1rTk3L-hQExnDWCi0RA-zAIjaVSTNO2AN2eqQWgzT0RjbieMxRfSdkM-HmOhdOgdQvYfPG3vqU1DJKh4Q '400': description: >- Bad request. One or more supplied search parameters are invalid, or a required parameter is missing. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: 400-limit-invalid: summary: Error response when no limit is supplied, or is invalid. value: error: code: request_cannot_be_parsed message: invalid limit 400-ip-address-invalid: summary: >- Error response when an invalid IP address is supplied, or is not using CIDR notation. value: error: code: request_cannot_be_parsed message: invalid ip address 400-bot-type-invalid: summary: >- Error response when an invalid bot type is specified, must be one of `good`, `bad`, `all`, or `none`. value: error: code: request_cannot_be_parsed message: invalid bot type 400-reverse-invalid: summary: Error response when the reverse parameter is invalid. value: error: code: request_cannot_be_parsed message: invalid reverse param 400-start-time-invalid: summary: Error response when an invalid start time is supplied. value: error: code: request_cannot_be_parsed message: invalid start time 400-end-time-invalid: summary: Error response when an invalid end time is supplied. value: error: code: request_cannot_be_parsed message: invalid end time 400-visitor-id-invalid: summary: Error response when an invalid visitor Id is supplied. value: error: code: request_cannot_be_parsed message: invalid visitor id 400-linked-id-invalid: summary: >- Error response when an invalid (too large) linked Id is supplied. value: error: code: request_cannot_be_parsed message: linked_id can't be greater than 256 characters long 400-pagination-key-invalid: summary: Error response when an invalid pagination key is supplied. value: error: code: request_cannot_be_parsed message: invalid pagination key '403': description: Forbidden. Access to this API is denied. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: 403-secret-api-key-required: summary: Error response when the secret API key was not provided. value: error: code: secret_api_key_required message: secret API key in header is missing or empty 403-secret-api-key-not-found: summary: >- Error response when the provided secret API key does not exist. value: error: code: secret_api_key_not_found message: >- no fingerprint workspace found for specified secret API key 403-wrong-region: summary: >- Error response when the API region does not match the region of your Fingerprint workspace. value: error: code: wrong_region message: wrong region '404': description: >- Not found. The requested visitor does not exist in this workspace's data. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: 404-visitor-not-found: summary: Error response when the provided visitor ID does not exist. value: error: code: visitor_not_found message: visitor not found '500': description: Workspace error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: 500-error: summary: Request failed value: error: code: failed message: internal server error components: schemas: BotInfoCategory: type: string enum: - advertising_and_marketing - aggregator - ai_agent - ai_assistant - ai_browser - ai_crawler - ai_search - browser_automation - ecommerce - monitoring_and_analytics - other - scraping - security - search_engine_crawler - search_engine_optimization - unknown description: | The type and purpose of the bot. BotInfoIdentity: type: string enum: - verified - signed - spoofed - unknown description: | The verification status of the bot's identity: * `verified` - well-known bot with publicly verifiable identity, directed by the bot provider. * `signed` - bot that signs its platform via Web Bot Auth, directed by the bot provider's customers. * `spoofed` - bot that claims a public identity but fails verification. * `unknown` - bot that does not publish a verifiable identity. BotInfoConfidence: type: string enum: - low - medium - high description: Confidence level of the bot identification. EventSearch: type: object description: >- Contains a list of all identification events matching the specified search criteria. additionalProperties: false required: - events properties: events: type: array items: $ref: '#/components/schemas/Event' pagination_key: type: string examples: - >- S9rgMMUb4z3X5t5pr_tSgoSZlmyF0O8X7kCV2m981-iY1LmRTjraa1rTk3L-hQExnDWCi0RA-zAIjaVSTNO2AN2eqQWgzT0RjbieMxRfSdkM-HmOhdOgdQvYfPG3vqU1DJKh4Q description: >- Use this value in the `pagination_key` parameter to request the next page of search results. total_hits: type: integer format: int64 examples: - 100 description: >- This value represents the total number of events matching the search query, up to the limit provided in the `total_hits` query parameter. Only present if the `total_hits` query parameter was provided. ErrorResponse: type: object additionalProperties: false required: - error properties: error: $ref: '#/components/schemas/Error' Event: type: object description: >- Contains results from Fingerprint Identification and all active Smart Signals. additionalProperties: false required: - event_id - timestamp properties: event_id: $ref: '#/components/schemas/EventId' x-platforms: - android - ios - browser timestamp: $ref: '#/components/schemas/Timestamp' x-platforms: - android - ios - browser incremental_identification_status: $ref: '#/components/schemas/IncrementalIdentificationStatus' x-platforms: - browser linked_id: $ref: '#/components/schemas/LinkedId' x-platforms: - android - ios - browser environment_id: $ref: '#/components/schemas/EnvironmentId' x-platforms: - android - ios - browser suspect: $ref: '#/components/schemas/Suspect' x-platforms: - android - ios - browser sdk: $ref: '#/components/schemas/SDK' x-platforms: - android - ios - browser replayed: $ref: '#/components/schemas/Replayed' x-platforms: - android - ios - browser identification: $ref: '#/components/schemas/Identification' x-platforms: - android - ios - browser supplementary_id_high_recall: $ref: '#/components/schemas/SupplementaryIDHighRecall' x-platforms: - android - ios - browser tags: $ref: '#/components/schemas/Tags' x-platforms: - android - ios - browser url: $ref: '#/components/schemas/Url' x-platforms: - browser bundle_id: $ref: '#/components/schemas/BundleId' x-platforms: - ios package_name: $ref: '#/components/schemas/PackageName' x-platforms: - android ip_address: $ref: '#/components/schemas/IpAddress' x-platforms: - android - ios - browser user_agent: $ref: '#/components/schemas/UserAgent' x-platforms: - android - ios - browser device: $ref: '#/components/schemas/Device' x-platforms: - android - ios - browser os: $ref: '#/components/schemas/Os' x-platforms: - android - ios - browser os_version: $ref: '#/components/schemas/OsVersion' x-platforms: - android - ios - browser client_referrer: $ref: '#/components/schemas/ClientReferrer' x-platforms: - browser browser_details: $ref: '#/components/schemas/BrowserDetails' x-platforms: - browser proximity: $ref: '#/components/schemas/Proximity' x-platforms: - android - ios - browser bot: $ref: '#/components/schemas/BotResult' x-platforms: - browser bot_type: $ref: '#/components/schemas/BotType' x-platforms: - browser bot_info: $ref: '#/components/schemas/BotInfo' x-platforms: - browser cloned_app: $ref: '#/components/schemas/ClonedApp' x-platforms: - android developer_tools: $ref: '#/components/schemas/DeveloperTools' x-platforms: - browser - android - ios emulator: $ref: '#/components/schemas/Emulator' x-platforms: - android factory_reset_timestamp: $ref: '#/components/schemas/FactoryReset' x-platforms: - android - ios frida: $ref: '#/components/schemas/Frida' x-platforms: - android - ios ip_blocklist: $ref: '#/components/schemas/IPBlockList' x-platforms: - android - ios - browser ip_info: $ref: '#/components/schemas/IPInfo' x-platforms: - android - ios - browser proxy: $ref: '#/components/schemas/Proxy' x-platforms: - android - ios - browser proxy_confidence: $ref: '#/components/schemas/ProxyConfidence' x-platforms: - android - ios - browser proxy_details: $ref: '#/components/schemas/ProxyDetails' x-platforms: - android - ios - browser proxy_ml_score: $ref: '#/components/schemas/ProxyMLScore' x-platforms: - browser incognito: $ref: '#/components/schemas/Incognito' x-platforms: - browser jailbroken: $ref: '#/components/schemas/Jailbroken' x-platforms: - ios location_spoofing: $ref: '#/components/schemas/LocationSpoofing' x-platforms: - android - ios mitm_attack: $ref: '#/components/schemas/MitMAttack' x-platforms: - android - ios privacy_settings: $ref: '#/components/schemas/PrivacySettings' x-platforms: - browser root_apps: $ref: '#/components/schemas/RootApps' x-platforms: - android rule_action: $ref: '#/components/schemas/EventRuleAction' simulator: $ref: '#/components/schemas/Simulator' x-platforms: - ios suspect_score: $ref: '#/components/schemas/SuspectScore' x-platforms: - android - ios - browser tampering: $ref: '#/components/schemas/Tampering' x-platforms: - android - ios - browser tampering_confidence: $ref: '#/components/schemas/TamperingConfidence' x-platforms: - android - ios - browser tampering_ml_score: $ref: '#/components/schemas/TamperingMlScore' x-platforms: - android - ios - browser tampering_details: $ref: '#/components/schemas/TamperingDetails' x-platforms: - android - ios - browser velocity: $ref: '#/components/schemas/Velocity' x-platforms: - android - ios - browser virtual_machine: $ref: '#/components/schemas/VirtualMachine' x-platforms: - browser virtual_machine_ml_score: $ref: '#/components/schemas/VirtualMachineMLScore' x-platforms: - browser vpn: $ref: '#/components/schemas/Vpn' x-platforms: - android - ios - browser vpn_confidence: $ref: '#/components/schemas/VpnConfidence' x-platforms: - android - ios - browser vpn_ml_score: $ref: '#/components/schemas/VpnMLScore' x-platforms: - browser vpn_origin_timezone: $ref: '#/components/schemas/VpnOriginTimezone' x-platforms: - android - ios - browser vpn_origin_country: $ref: '#/components/schemas/VpnOriginCountry' x-platforms: - android - ios vpn_methods: $ref: '#/components/schemas/VpnMethods' x-platforms: - android - ios - browser high_activity_device: $ref: '#/components/schemas/HighActivity' x-platforms: - android - ios - browser rare_device: $ref: '#/components/schemas/RareDevice' x-platforms: - browser rare_device_percentile_bucket: $ref: '#/components/schemas/RareDevicePercentileBucket' x-platforms: - browser raw_device_attributes: $ref: '#/components/schemas/RawDeviceAttributes' x-platforms: - browser - ios - android labels: $ref: '#/components/schemas/Labels' x-platforms: - browser - ios - android Error: type: object additionalProperties: false required: - code - message properties: code: $ref: '#/components/schemas/ErrorCode' message: type: string examples: - Forbidden EventId: type: string examples: - 1708102555327.NLOjmg description: > Unique identifier of the user's request. The first portion of the event_id is a unix epoch milliseconds timestamp. Timestamp: description: Timestamp of the event with millisecond precision in Unix time. type: integer format: int64 examples: - 1708102555327 IncrementalIdentificationStatus: type: string description: > Only included for requests using incremental identification. - `partially_completed` - Indicates this event corresponds to a 'minimal' request. Smart Signals, even if included in your plan, are not computed; hence, their values must be ignored. - `completed` - Indicates this event corresponds to a 'complete' request. Smart Signals, if included in your plan, are computed; hence, their values are valid and relevant. enum: - partially_completed - completed LinkedId: type: string examples: - somelinkedId description: A customer-provided id that was sent with the request. EnvironmentId: type: string examples: - ae_47abaca3db2c7c43 description: Environment Id of the event. Suspect: type: boolean description: >- Field is `true` if you have previously set the `suspect` flag for this event using the [Server API Update event endpoint](https://docs.fingerprint.com/reference/server-api-v4-update-event). SDK: type: object description: Contains information about the SDK used to perform the request. additionalProperties: false required: - platform - version properties: platform: type: string enum: - js - android - ios - unknown description: Platform of the SDK used for the identification request. version: type: string examples: - 3.11.10 description: Version string of the SDK used for the identification request. integrations: type: array items: $ref: '#/components/schemas/Integration' Replayed: type: boolean description: > `true` if we determined that this payload was replayed, `false` otherwise. Identification: type: object additionalProperties: false required: - visitor_id - visitor_found properties: visitor_id: type: string examples: - Ibk1527CUFmcnjLwIs4A9 description: >- String of 20 characters that uniquely identifies the visitor's browser or mobile device. confidence: $ref: '#/components/schemas/IdentificationConfidence' visitor_found: type: boolean description: Attribute represents if a visitor had been identified before. first_seen_at: type: integer format: int64 examples: - 1708102555327 description: > Unix epoch time milliseconds timestamp indicating the time at which this visitor ID was first seen. example: `1758069706642` - Corresponding to Wed Sep 17 2025 00:41:46 GMT+0000 last_seen_at: type: integer format: int64 examples: - 1708102555327 description: > Unix epoch time milliseconds timestamp indicating the time at which this visitor ID was last seen. example: `1758069706642` - Corresponding to Wed Sep 17 2025 00:41:46 GMT+0000 SupplementaryIDHighRecall: type: object additionalProperties: false description: >- The High Recall ID is a supplementary browser identifier designed for use cases that require wider coverage over precision. Compared to the standard visitor ID, the High Recall ID strives to match incoming browsers more generously (rather than precisely) with existing browsers and thus identifies fewer browsers as new. The High Recall ID is best suited for use cases that are sensitive to browsers being identified as new and where mismatched browsers are not detrimental. required: - visitor_id - visitor_found properties: visitor_id: type: string examples: - 0jnGMkPYXX37DqVa4ZIO3f_hr description: >- The High Recall identifier for the visitor's browser. It is an alphanumeric string with a maximum length of 25 characters. visitor_found: type: boolean description: >- True if this is a returning browser and has been previously identified. Otherwise, false. confidence: $ref: '#/components/schemas/IdentificationConfidence' first_seen_at: type: integer format: int64 examples: - 1778086556130 description: > Unix epoch timestamp (in milliseconds) indicating when the browser was first identified. example: `1758069706642` - Corresponding to Wed Sep 17 2025 00:41:46 GMT+0000 last_seen_at: type: integer format: int64 examples: - 1778604975494 description: > Unix epoch timestamp (in milliseconds) corresponding to the most recent visit by this browser. example: `1758069706642` - Corresponding to Wed Sep 17 2025 00:41:46 GMT+0000 Tags: type: object description: >- A customer-provided value or an object that was sent with the identification request or updated later. additionalProperties: true required: [] Url: type: string examples: - https://www.example.com/login description: Page URL from which the request was sent. BundleId: type: string examples: - com.foo.app description: > Bundle Id of the iOS application integrated with the Fingerprint SDK for the event. PackageName: type: string examples: - com.foo.app description: > Package name of the Android application integrated with the Fingerprint SDK for the event. IpAddress: type: string examples: - 61.127.217.15 description: IP address of the requesting browser or bot. UserAgent: type: string examples: - Mozilla/5.0 (Windows NT 6.1; Win64; x64) .... description: User Agent of the client. Device: type: string examples: - Generic Smartphone - Desktop - iPhone description: > Device model or family extracted from the user agent string. On web, this field is also present inside `browser_details`. Os: type: string examples: - Windows - iOS - Android description: > Operating system family extracted from the user agent string. On web, this field is also present inside `browser_details`. OsVersion: type: string examples: - '17.4' - '14' - '10' description: > Operating system version string extracted from the user agent string. On web, this field is also present inside `browser_details`. ClientReferrer: type: string examples: - https://example.com/blog/my-article description: > Client Referrer field corresponds to the `document.referrer` field gathered during an identification request. The value is an empty string if the user navigated to the page directly (not through a link, but, for example, by using a bookmark). BrowserDetails: type: object additionalProperties: false required: - browser_name - browser_full_version - browser_major_version - os - os_version - device properties: browser_name: type: string examples: - Chrome browser_major_version: type: string examples: - '74' browser_full_version: type: string examples: - 74.0.3729 os: type: string examples: - Windows os_version: type: string examples: - '7' device: type: string examples: - Other Proximity: type: object description: > Proximity ID represents a fixed geographical zone in a discrete global grid within which the device is observed. additionalProperties: false required: - id - precision_radius - confidence properties: id: type: string examples: - w1aTfd4MCvl description: | A stable privacy-preserving identifier for a given proximity zone. precision_radius: type: integer format: int32 enum: - 10 - 25 - 65 - 175 - 450 - 1200 - 3300 - 8500 - 22500 description: | The radius of the proximity zone’s precision level, in meters. confidence: type: number format: float examples: - 0.95 minimum: 0 maximum: 1 description: > A value between `0` and `1` representing the likelihood that the true device location lies within the mapped proximity zone. * Scores closer to `1` indicate high confidence that the location is inside the mapped proximity zone. * Scores closer to `0` indicate lower confidence, suggesting the true location may fall in an adjacent zone. BotResult: type: string enum: - bad - good - not_detected description: | Bot detection result: * `bad` - bad bot detected, such as Selenium, Puppeteer, Playwright, headless browsers, and so on * `good` - good bot detected, such as Google bot, Baidu Spider, AlexaBot and so on * `not_detected` - the visitor is not a bot BotType: type: string examples: - fingerprint_agent description: | Additional classification of the bot type if detected. BotInfo: type: object description: Extended bot information. additionalProperties: false required: - category - provider - name - identity - confidence properties: category: $ref: '#/components/schemas/BotInfoCategory' provider: type: string description: The organization or company operating the bot. examples: - Anthropic - Browserbase - Google - OpenAI provider_url: type: string examples: - https://fingerprint.com description: The URL of the bot provider's website. name: type: string description: The specific name or identifier of the bot. examples: - ClaudeBot - Browserbase Agent - Googlebot - GPTBot - ChatGPT-User identity: $ref: '#/components/schemas/BotInfoIdentity' confidence: $ref: '#/components/schemas/BotInfoConfidence' ClonedApp: type: boolean description: > Android specific cloned application detection. There are 2 values: * `true` - Presence of app cloners work detected (e.g. fully cloned application found or launch of it inside of a not main working profile detected). * `false` - No signs of cloned application detected or the client is not Android. DeveloperTools: type: boolean description: > `true` if the browser has DevTools open (Chrome, Firefox) or the Android/iOS device has Developer Tools enabled, `false` otherwise. Emulator: type: boolean description: > Android specific emulator detection. There are 2 values: * `true` - Emulated environment detected (e.g. launch inside of AVD). * `false` - No signs of emulated environment detected or the client is not Android. FactoryReset: type: integer format: int64 examples: - 1708102555327 description: > The time of the most recent factory reset that happened on the **mobile device** is expressed as Unix epoch time. When a factory reset cannot be detected on the mobile device or when the request is initiated from a browser, this field will correspond to the *epoch* time (i.e 1 Jan 1970 UTC) as a value of 0. See [Factory Reset Detection](https://docs.fingerprint.com/docs/smart-signals-reference#factory-reset-detection) to learn more about this Smart Signal. Frida: type: boolean description: > [Frida](https://frida.re/docs/) detection for Android and iOS devices. There are 2 values: * `true` - Frida detected * `false` - No signs of Frida or the client is not a mobile device. IPBlockList: type: object additionalProperties: false required: [] properties: email_spam: type: boolean description: IP address was part of a known email spam attack (SMTP). attack_source: type: boolean description: IP address was part of a known network attack (SSH/HTTPS). tor_node: type: boolean description: IP address was part of known TOR network activity. IPInfo: type: object description: >- Details about the request IP address. Has separate fields for v4 and v6 IP address versions. additionalProperties: false required: [] properties: v4: $ref: '#/components/schemas/IPInfoV4' v6: $ref: '#/components/schemas/IPInfoV6' Proxy: type: boolean description: > IP address was used by a public proxy provider or belonged to a known recent residential proxy ProxyConfidence: type: string enum: - low - medium - high description: > Confidence level of the proxy detection. If a proxy is not detected, confidence is "high". If it's detected, can be "low", "medium", or "high". ProxyDetails: type: object additionalProperties: false description: Proxy detection details (present if `proxy` is `true`) required: - proxy_type properties: proxy_type: type: string enum: - residential - data_center - unknown description: | Proxy type: * `residential` - proxies that route through residential and telecom IP addresses to appear as legitimate traffic * `data_center` - proxies which route through data centers * `unknown` - reported when a proxy is detected solely by the ML model and the IP sources did not determine a specific type last_seen_at: type: integer format: int64 examples: - 1708102555327 description: > Unix millisecond timestamp with hourly resolution of when this IP was last seen as a proxy provider: type: string examples: - Massive description: > String representing the last proxy service provider detected when this IP was synced. An IP can be shared by multiple service providers. ProxyMLScore: type: number format: double examples: - 0.2 minimum: 0 maximum: 1 description: > Machine learning–based proxy score, represented as a floating-point value between 0 and 1 (inclusive), with up to three decimal places of precision. A higher score means a higher confidence in the positive `proxy` detection result. This Smart Signal is currently in beta and only available to select customers. If you are interested, please [contact our support team](https://fingerprint.com/support/). Incognito: type: boolean description: > `true` if we detected incognito mode used in the browser, `false` otherwise. Jailbroken: type: boolean description: | iOS specific jailbreak detection. There are 2 values: * `true` - Jailbreak detected. * `false` - No signs of jailbreak or the client is not iOS. LocationSpoofing: type: boolean description: >- Flag indicating whether the request came from a mobile device with location spoofing enabled. MitMAttack: type: boolean description: > * `true` - When requests made from your users' mobile devices to Fingerprint servers have been intercepted and potentially modified. * `false` - Otherwise or when the request originated from a browser. See [MitM Attack Detection](https://docs.fingerprint.com/docs/smart-signals-reference#mitm-attack-detection) to learn more about this Smart Signal. PrivacySettings: type: boolean description: > `true` if the request is from a privacy aware browser (e.g. Tor) or from a browser in which fingerprinting is blocked. Otherwise `false`. RootApps: type: boolean description: > Android specific root management apps detection. There are 2 values: * `true` - Root Management Apps detected (e.g. Magisk). * `false` - No Root Management Apps detected or the client isn't Android. EventRuleAction: type: object description: >- Describes the action the client should take, according to the rule in the ruleset that matched the event. When getting an event by event ID, the rule_action will only be included when the ruleset_id query parameter is specified. oneOf: - $ref: '#/components/schemas/EventRuleActionAllow' - $ref: '#/components/schemas/EventRuleActionBlock' discriminator: propertyName: type mapping: allow: $ref: '#/components/schemas/EventRuleActionAllow' block: $ref: '#/components/schemas/EventRuleActionBlock' Simulator: type: boolean description: | iOS specific simulator detection. There are 2 values: * `true` - Simulator environment detected. * `false` - No signs of simulator or the client is not iOS. SuspectScore: type: integer examples: - 8 description: > Suspect Score is an easy way to integrate Smart Signals into your fraud protection work flow. It is a weighted representation of all Smart Signals present in the payload that helps identify suspicious activity. The value range is [0; S] where S is sum of all Smart Signals weights. See more details here: https://docs.fingerprint.com/docs/suspect-score Tampering: type: boolean description: > The field can be used as a standalone flag for tampering detection. Alternatively, the more granular fields documented below can be used for workflows that require more context. * `true` if tampering is detected through an anomalous browser signature, anti-detect browser detection, or other tampering-related methods * `false` if none of the tampering checks return a positive result TamperingConfidence: type: string enum: - low - medium - high description: > The confidence level indicates how certain Fingerprint is that the current request involves browser tampering. This confidence level is determined by evaluating multiple factors, such as heuristic rules, probabilistic anomaly detection, an anti detect browser ml model, and other relevant methods. It is conveyed as a string with possible values such as high, medium, or low In case of tampering: `true` * **High confidence**: heuristic anti detect browser signals and the ml model are triggered, or all of the methods are triggered. * **Medium confidence**: either the ml model triggers alone, the anomaly score triggers alone with or without the heuristic anti detect browser methods trigger. * **Low confidence**: only the heuristic anti detect methods are triggered. In case of tampering: `false` * **High confidence:** Strong signals suggest the user is not tampering with their request. TamperingMlScore: type: number format: double examples: - 0.5 minimum: 0 maximum: 1 description: > The output of this model is captured as tampering_ml_score, a number indicating how likely an event is coming from an anti detect browser. Values close to 1 signify higher confidence and we consider anything above the threshold of 0.8 to be actionable (the result and anti_detect_browser fields conveniently captures that fact) TamperingDetails: type: object additionalProperties: false required: [] properties: anomaly_score: type: number format: double examples: - 0.5 minimum: 0 maximum: 1 x-platforms: - android - ios - browser description: > The output of this model is captured as anomaly_score, a statistical score indicating how rare the visitor's browser signature is compared to the overall population. Values close to 1 signify highly anomalous browsers and we consider anything above the threshold of 0.5 to be actionable (the result field conveniently captures that fact). anti_detect_browser: type: boolean x-platforms: - browser description: > Detects whether the request shows evidence of anti-detect browser usage. This field may be triggered by: * heuristic detection of known anti-detect browser behavior * machine learning detection of anti-detect browser patterns Examples of anti-detect browsers include tools such as AdsPower, DolphinAnty, OctoBrowser, and GoLogin. Velocity: type: object description: > Sums key data points for a specific `visitor_id`, `ip_address` and `linked_id` at three distinct time intervals: 5 minutes, 1 hour, and 24 hours as follows: - Number of distinct IP addresses associated to the visitor Id. - Number of distinct linked Ids associated with the visitor Id. - Number of distinct countries associated with the visitor Id. - Number of identification events associated with the visitor Id. - Number of identification events associated with the detected IP address. - Number of distinct IP addresses associated with the provided linked Id. - Number of distinct visitor Ids associated with the provided linked Id. The `24h` interval of `distinct_ip`, `distinct_linked_id`, `distinct_country`, `distinct_ip_by_linked_id` and `distinct_visitor_id_by_linked_id` will be omitted if the number of `events` for the visitor Id in the last 24 hours (`events.['24h']`) is higher than 20.000. All will not necessarily be returned in a response, some may be omitted if the associated event does not have the required data, such as a linked_id. additionalProperties: false required: [] properties: distinct_ip: $ref: '#/components/schemas/VelocityData' distinct_linked_id: $ref: '#/components/schemas/VelocityData' distinct_country: $ref: '#/components/schemas/VelocityData' events: $ref: '#/components/schemas/VelocityData' ip_events: $ref: '#/components/schemas/VelocityData' distinct_ip_by_linked_id: $ref: '#/components/schemas/VelocityData' distinct_visitor_id_by_linked_id: $ref: '#/components/schemas/VelocityData' VirtualMachine: type: boolean description: > `true` if the request came from a browser running inside a virtual machine (e.g. VMWare), `false` otherwise. VirtualMachineMLScore: type: number format: double examples: - 0.5 minimum: 0 maximum: 1 description: > Machine learning–based virtual machine score, represented as a floating-point value between 0 and 1 (inclusive), with up to three decimal places of precision. A higher score means a higher confidence in the positive `virtual_machine` detection result. This Smart Signal is currently in beta and only available to select customers. If you are interested, please [contact our support team](https://fingerprint.com/support/). Vpn: type: boolean description: | VPN or other anonymizing service has been used when sending the request. VpnConfidence: type: string enum: - low - medium - high description: >- A confidence rating for the VPN detection result — "low", "medium", or "high". Depends on the combination of results returned from all VPN detection methods. VpnMLScore: type: number format: double examples: - 0.2 minimum: 0 maximum: 1 description: > Machine learning–based VPN score, represented as a floating-point value between 0 and 1 (inclusive), with up to three decimal places of precision. A higher score means a higher confidence in the positive `vpn` detection result. This Smart Signal is currently in beta and only available to select customers. If you are interested, please [contact our support team](https://fingerprint.com/support/). VpnOriginTimezone: type: string examples: - Europe/Berlin description: | Local timezone which is used in timezone_mismatch method. VpnOriginCountry: type: string examples: - DE description: > Country of the request (only for Android SDK version >= 2.4.0, ISO 3166 format or unknown). VpnMethods: type: object additionalProperties: false required: [] properties: timezone_mismatch: type: boolean x-platforms: - android - ios - browser description: >- The browser timezone doesn't match the timezone inferred from the request IP address. public_vpn: type: boolean x-platforms: - android - ios - browser description: >- Request IP address is owned and used by a public VPN service provider. auxiliary_mobile: type: boolean x-platforms: - android - ios - browser description: >- This method applies to mobile devices only. Indicates the result of additional methods used to detect a VPN in mobile devices. os_mismatch: type: boolean x-platforms: - browser description: >- The browser runs on a different operating system than the operating system inferred from the request network signature. relay: type: boolean x-platforms: - android - ios - browser description: > Request IP address belongs to a relay service provider, indicating the use of relay services like [Apple Private relay](https://support.apple.com/en-us/102602) or [Cloudflare Warp](https://developers.cloudflare.com/warp-client/). * Like VPNs, relay services anonymize the visitor's true IP address. * Unlike traditional VPNs, relay services don't let visitors spoof their location by choosing an exit node in a different country. This field allows you to differentiate VPN users and relay service users in your fraud prevention logic. ml_prediction: type: boolean x-platforms: - browser description: > `true` if the request came from a device running a VPN, `false` otherwise. HighActivity: type: boolean description: Flag indicating if the request came from a high-activity visitor. RareDevice: type: boolean description: > `true` if the device is considered rare based on its combination of hardware and software attributes. A device is classified as rare if it falls within the top 99.9 percentile (lowest-frequency segment) of observed traffic, or if its configuration has not been previously seen (`not_seen`). > This Smart Signal is currently in beta and only available to select customers. If you are interested, please [contact our support team](https://fingerprint.com/support/). RareDevicePercentileBucket: type: string description: > The rarity percentile bucket of the device, indicating how uncommon the device configuration is compared to all observed devices. > This Smart Signal is currently in beta and only available to select customers. If you are interested, please [contact our support team](https://fingerprint.com/support/). enum: - A curated subset of raw browser/device attributes that the API surface exposes. Each property contains a value or object with the data for the collected signal. additionalProperties: false required: [] properties: font_preferences: $ref: '#/components/schemas/FontPreferences' emoji: $ref: '#/components/schemas/Emoji' fonts: $ref: '#/components/schemas/Fonts' device_memory: $ref: '#/components/schemas/DeviceMemory' timezone: $ref: '#/components/schemas/Timezone' canvas: $ref: '#/components/schemas/Canvas' languages: $ref: '#/components/schemas/Languages' webgl_extensions: $ref: '#/components/schemas/WebGlExtensions' webgl_basics: $ref: '#/components/schemas/WebGlBasics' screen_resolution: $ref: '#/components/schemas/ScreenResolution' touch_support: $ref: '#/components/schemas/TouchSupport' oscpu: $ref: '#/components/schemas/Oscpu' architecture: $ref: '#/components/schemas/Architecture' cookies_enabled: $ref: '#/components/schemas/CookiesEnabled' hardware_concurrency: $ref: '#/components/schemas/HardwareConcurrency' date_time_locale: $ref: '#/components/schemas/DateTimeLocale' vendor: $ref: '#/components/schemas/Vendor' color_depth: $ref: '#/components/schemas/ColorDepth' platform: $ref: '#/components/schemas/Platform' session_storage: $ref: '#/components/schemas/SessionStorage' local_storage: $ref: '#/components/schemas/LocalStorage' audio: $ref: '#/components/schemas/Audio' plugins: $ref: '#/components/schemas/Plugins' indexed_db: $ref: '#/components/schemas/IndexedDb' math: $ref: '#/components/schemas/Math' device_model: $ref: '#/components/schemas/DeviceModel' device_manufacturer: $ref: '#/components/schemas/DeviceManufacturer' font_hash: $ref: '#/components/schemas/FontHash' timezone_offset: $ref: '#/components/schemas/TimezoneOffset' battery_level: $ref: '#/components/schemas/BatteryLevel' battery_low_power_mode: $ref: '#/components/schemas/BatteryLowPowerMode' Labels: type: array items: type: object additionalProperties: false required: - label properties: label: type: string examples: - automation_tool prediction: type: boolean ml_score: type: number format: double examples: - 0.95 minimum: 0 maximum: 1 description: > Each label returns a prediction (true or false) for a specific use case (label field) based on a machine learning score. The machine learning score is determined by a model trained on customer data for that use case. This field is in the beta phase and only available to select customers. If you are interested, please [contact our support team](https://fingerprint.com/support/). ErrorCode: type: string enum: - request_cannot_be_parsed - request_read_timeout - secret_api_key_required - secret_api_key_not_found - public_api_key_required - public_api_key_not_found - subscription_not_active - wrong_region - feature_not_enabled - visitor_not_found - too_many_requests - state_not_ready - failed - event_not_found - missing_module - payload_too_large - service_unavailable - ruleset_not_found description: > Error code: * `request_cannot_be_parsed` - The query parameters or JSON payload contains some errors that prevented us from parsing it (wrong type/surpassed limits). * `request_read_timeout` - The request body could not be read before the connection timed out. * `secret_api_key_required` - secret API key in header is missing or empty. * `secret_api_key_not_found` - No Fingerprint workspace found for specified secret API key. * `public_api_key_required` - public API key in header is missing or empty. * `public_api_key_not_found` - No Fingerprint workspace found for specified public API key. * `subscription_not_active` - Fingerprint workspace is not active. * `wrong_region` - Server and workspace region differ. * `feature_not_enabled` - This feature (for example, Delete API) is not enabled for your workspace. * `visitor_not_found` - The specified visitor ID was not found. It never existed or it may have already been deleted. * `too_many_requests` - The limit on secret API key requests per second has been exceeded. * `state_not_ready` - The event specified with event ID is not ready for updates yet. Try again. This error happens in rare cases when update API is called immediately after receiving the event ID on the client. In case you need to send information right away, we recommend using the JS agent API instead. * `failed` - Internal server error. * `event_not_found` - The specified event ID was not found. It never existed, expired, or it has been deleted. * `missing_module` - The request is invalid because it is missing a required module. * `payload_too_large` - The request payload is too large and cannot be processed. * `service_unavailable` - The service was unable to process the request. * `ruleset_not_found` - The specified ruleset was not found. It never existed or it has been deleted. Integration: type: object additionalProperties: false required: [] properties: name: type: string examples: - fingerprint-pro-react description: The name of the specific integration. version: type: string examples: - 3.11.10 description: The version of the specific integration. subintegration: type: object additionalProperties: false required: [] properties: name: type: string examples: - preact description: The name of the specific subintegration. version: type: string examples: - 10.21.0 description: The version of the specific subintegration. IdentificationConfidence: type: object additionalProperties: false description: >- The confidence score represents the probability of a false-positive identification. To learn more, visit [Confidence Score](https://docs.fingerprint.com/docs/identification-accuracy-and-confidence#confidence-score). Please note that the confidence score is not yet supported for [High Recall ID](https://docs.fingerprint.com/docs/supplementary-identifiers-highrecall). required: - score properties: score: type: number format: double examples: - 0.97 minimum: 0 maximum: 1 description: >- A floating-point number between 0 and 1 that represents the probability of a false-positive identification. For High Recall ID, this value is 0. version: type: string examples: - '1.1' description: >- The version name of the method used to calculate the confidence score. For High Recall ID, this value is "Not Supported". comment: type: string examples: - Low confidence due to bot signals IPInfoV4: type: object additionalProperties: false required: - address properties: address: type: string format: ipv4 examples: - 94.142.239.124 geolocation: $ref: '#/components/schemas/Geolocation' asn: type: string examples: - '396982' - '16509' - '701' asn_name: type: string examples: - Google LLC - Amazon.com, Inc. - Verizon Business asn_network: type: string examples: - 34.160.0.0/12 - 3.208.0.0/12 - 173.56.0.0/16 asn_type: type: string examples: - hosting - isp - business - education datacenter_result: type: boolean description: When true, the request originated from a datacenter. datacenter_name: type: string examples: - Google Cloud - Amazon AWS IPInfoV6: type: object additionalProperties: false required: - address properties: address: type: string format: ipv6 examples: - 2001:db8:3333:4444:5555:6666:7777:8888 geolocation: $ref: '#/components/schemas/Geolocation' asn: type: string examples: - '396982' - '16509' - '701' asn_name: type: string examples: - Google LLC - Amazon.com, Inc. - Verizon Business asn_network: type: string examples: - 2001:4860:4801:10::/64 - 2600:1f00::/24 - 2001:4868:800::/40 asn_type: type: string examples: - hosting - isp - business - education datacenter_result: type: boolean description: When true, the request originated from a datacenter. datacenter_name: type: string examples: - Google Cloud - Amazon AWS EventRuleActionAllow: description: >- Informs the client that the request should be forwarded to the origin with optional request header modifications. type: object properties: ruleset_id: $ref: '#/components/schemas/RulesetId' rule_id: $ref: '#/components/schemas/RuleId' rule_expression: $ref: '#/components/schemas/RuleExpression' type: allOf: - $ref: '#/components/schemas/RuleActionType' - const: allow request_header_modifications: $ref: '#/components/schemas/RequestHeaderModifications' additionalProperties: false required: - ruleset_id - type EventRuleActionBlock: description: >- Informs the client the request should be blocked using the response described by this rule action. type: object properties: ruleset_id: $ref: '#/components/schemas/RulesetId' rule_id: $ref: '#/components/schemas/RuleId' rule_expression: $ref: '#/components/schemas/RuleExpression' type: allOf: - $ref: '#/components/schemas/RuleActionType' - const: block status_code: $ref: '#/components/schemas/StatusCode' headers: type: array description: A list of headers to send. items: $ref: '#/components/schemas/RuleActionHeaderField' body: $ref: '#/components/schemas/RuleActionBody' additionalProperties: false required: - ruleset_id - type VelocityData: type: object description: > Is absent if the velocity data could not be generated for the visitor Id. additionalProperties: false required: - 5_minutes - 1_hour properties: 5_minutes: type: integer examples: - 1 description: > Count for the last 5 minutes of velocity data, from the time of the event. 1_hour: type: integer examples: - 5 description: > Count for the last 1 hour of velocity data, from the time of the event. 24_hours: type: integer examples: - 5 description: > The `24_hours` interval of `distinct_ip`, `distinct_linked_id`, `distinct_country`, `distinct_ip_by_linked_id` and `distinct_visitor_id_by_linked_id` will be omitted if the number of `events` for the visitor Id in the last 24 hours (`events.['24_hours']`) is higher than 20.000. FontPreferences: type: object description: > Baseline measurement of canonical fonts rendered on the device. Numeric width metrics, in CSS pixels, for the canonical fonts collected by the agent. additionalProperties: false required: [] properties: default: type: number format: double examples: - 147.5625 serif: type: number format: double examples: - 147.5625 sans: type: number format: double examples: - 144.015625 mono: type: number format: double examples: - 133.0625 apple: type: number format: double examples: - 147.5625 min: type: number format: double examples: - 9.234375 system: type: number format: double examples: - 146.09375 Emoji: type: object description: Bounding box metrics describing how the emoji glyph renders. additionalProperties: false required: [] properties: font: type: string examples: - Times description: Font family reported by the browser when drawing the emoji. width: type: number format: double examples: - 1600 height: type: number format: double examples: - 18 top: type: number format: double examples: - 14 bottom: type: number format: double examples: - 32 left: type: number format: double examples: - 8 right: type: number format: double examples: - 1608 x: type: number format: double examples: - 8 'y': type: number format: double examples: - 14 Fonts: type: array description: List of fonts detected on the device. items: type: string examples: - Arial Unicode MS examples: - - Arial Unicode MS - Gill Sans - Helvetica Neue - Menlo DeviceMemory: type: integer format: int32 minimum: 0 examples: - 8 description: Rounded amount of RAM in gigabytes. Timezone: type: string examples: - America/Sao_Paulo description: Timezone identifier detected on the client. Canvas: type: object description: Canvas fingerprint containing winding flag plus geometry/text hashes. additionalProperties: false required: [] properties: winding: type: boolean geometry: type: string examples: - db3c1462576a399a03ae93d0ab9eb5c4 description: Hash of geometry rendering output or `unsupported` markers. text: type: string examples: - 70c3d3f7eb4408dc37a6bf8af1c51029 description: Hash of text rendering output or `unsupported` markers. Languages: type: array description: > Navigator languages reported by the agent including fallbacks. Each inner array represents ordered language preferences reported by different APIs. Available for browsers, iOS, and Android devices. items: type: array items: type: string examples: - en-US WebGlExtensions: type: object description: Hashes of WebGL context attributes and extension support. additionalProperties: false required: [] properties: context_attributes: type: string examples: - 6b1ed336830d2bc96442a9d76373252a parameters: type: string examples: - ea118c48e308bc4b0677118bbb3019ec shader_precisions: type: string examples: - f223dfbcd580cf142da156d93790eb83 extensions: type: string examples: - 57233d7b10f89fcd1ff95e3837ccd72d extension_parameters: type: string examples: - 86a8abb36f0cb30b5946dec0c761d042 unsupported_extensions: type: array items: type: string examples: - WEBGL_compressed_texture_s3tc_srgb WebGlBasics: type: object description: Render and vendor strings reported by the WebGL context. additionalProperties: false required: [] properties: version: type: string examples: - WebGL 1.0 (OpenGL ES 2.0 Chromium) vendor: type: string examples: - WebKit vendor_unmasked: type: string examples: - Google Inc. (Apple) renderer: type: string examples: - WebKit WebGL renderer_unmasked: type: string examples: - 'ANGLE (Apple, ANGLE Metal Renderer: Apple M4, Unspecified Version)' shading_language_version: type: string examples: - WebGL GLSL ES 1.0 (OpenGL ES GLSL ES 1.0 Chromium) ScreenResolution: type: array description: Current screen resolution. Available for both browsers and iOS devices minItems: 2 maxItems: 2 items: type: integer format: int32 examples: - 1920 TouchSupport: type: object description: Browser-reported touch capabilities. additionalProperties: false required: [] properties: touch_event: type: boolean touch_start: type: boolean max_touch_points: type: integer format: int64 examples: - 0 Oscpu: type: string examples: - Windows NT 6.1; Win64; x64 description: Navigator `oscpu` string. Architecture: type: integer format: int32 examples: - 127 description: Integer representing the CPU architecture exposed by the browser. CookiesEnabled: type: boolean description: Whether the cookies are enabled in the browser. HardwareConcurrency: type: integer format: int32 examples: - 10 description: Number of logical CPU cores reported by the browser. DateTimeLocale: type: string examples: - en-US description: > Locale derived from the Intl.DateTimeFormat API. Negative values indicate known error states. The negative statuses can be: - "-1": A permanent status for browsers that don't support Intl API. - "-2": A permanent status for browsers that don't supportDateTimeFormat constructor. - "-3": A permanent status for browsers in which DateTimeFormat locale is undefined or null. Vendor: type: string examples: - Google Inc. description: Navigator vendor string. ColorDepth: type: integer format: int32 examples: - 24 description: Screen color depth in bits. Platform: type: string examples: - MacIntel description: Navigator platform string. SessionStorage: type: boolean description: Whether sessionStorage is available. LocalStorage: type: boolean description: Whether localStorage is available. Audio: type: number format: double examples: - 124.04347745512496 description: > AudioContext fingerprint or negative status when unavailable. The negative statuses can be: - -1: A permanent status for those browsers which are known to always suspend audio context - -2: A permanent status for browsers that don't support the signal - -3: A temporary status that means that an unexpected timeout has happened Plugins: type: array description: Browser plugins reported by `navigator.plugins`. items: type: object additionalProperties: false properties: name: type: string examples: - PDF Viewer description: type: string examples: - Portable Document Format mimeTypes: type: array items: type: object additionalProperties: false required: [] properties: type: type: string examples: - application/pdf suffixes: type: string examples: - pdf description: type: string examples: - Portable Document Format required: - name IndexedDb: type: boolean description: Whether IndexedDB is available. Math: type: string examples: - 5f030fa7d2e5f9f757bfaf81642eb1a6 description: Hash of Math APIs used for entropy collection. DeviceModel: type: string examples: - iPhone 15 Pro description: Device model string. Available only for Android and iOS devices. DeviceManufacturer: type: string examples: - Apple description: Device manufacturer string. Available only for Android and iOS devices. FontHash: type: string examples: - e9f96f6c0e2c0b3a7a8b1d2c3e4f5a6b description: Unique identifier for the user’s installed fonts. TimezoneOffset: type: string examples: - '+02:00' description: UTC offset in "±HH:MM" format derived from the detected IANA timezone. BatteryLevel: type: integer format: int32 minimum: 0 maximum: 100 examples: - 75 description: >- Battery charge level as a percentage (0-100). Available only for Android and iOS devices. BatteryLowPowerMode: type: boolean description: >- Whether the device's low power mode is enabled. Available only for Android and iOS devices. Geolocation: type: object additionalProperties: false required: [] properties: accuracy_radius: type: integer examples: - 20 minimum: 0 description: >- The IP address is likely to be within this radius (in km) of the specified location. latitude: type: number format: double examples: - 50.05 minimum: -90 maximum: 90 longitude: type: number format: double examples: - 14.4 minimum: -180 maximum: 180 postal_code: type: string examples: - 150 00 timezone: type: string format: timezone examples: - Europe/Prague city_name: type: string examples: - Prague country_code: type: string examples: - CZ minLength: 2 maxLength: 2 country_name: type: string examples: - Czechia continent_code: type: string examples: - EU minLength: 2 maxLength: 2 continent_name: type: string examples: - Europe subdivisions: type: array items: type: object additionalProperties: false required: - iso_code - name properties: iso_code: type: string examples: - '10' name: type: string examples: - Hlavni mesto Praha RulesetId: type: string examples: - rs_b1k1blhqpOX3kU description: The ID of the evaluated ruleset. RuleId: type: string examples: - r_uE0af8497PFAOD description: The ID of the rule that matched the identification event. RuleExpression: type: string examples: - bot in ["bad"] || incognito description: The expression of the rule that matched the identification event. RuleActionType: type: string description: Describes the action to take with the request. enum: - allow - block RequestHeaderModifications: type: object description: >- The set of header modifications to apply, in the following order: remove, set, append. required: [] properties: remove: type: array description: The list of headers to remove. items: type: string examples: - X-Forwarded-For set: type: array description: >- The list of headers to set, overwriting any existing headers with the same name. items: $ref: '#/components/schemas/RuleActionHeaderField' append: type: array description: The list of headers to append. items: $ref: '#/components/schemas/RuleActionHeaderField' StatusCode: type: integer examples: - 200 description: A valid HTTP status code. RuleActionHeaderField: type: object required: - name - value properties: name: type: string examples: - Content-Type description: The header field name. value: type: string examples: - application/json description: The value of the header field. RuleActionBody: type: string examples: - '{"title":"Forbidden"}' description: The response body to send to the client. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: string description: >- Add your Secret API Key to the Authorization header using the standard Bearer format: `Authorization: Bearer ` ````