The /v4/events endpoint provides a convenient way to search for past events based on specific parameters. Typical use cases and queries include:
visitor_id within a time range to get historical behavior of a visitor.linked_id within a time range to get all events associated with your internal account identifier.good and bad bots)If you don’t provide start or end parameters, the default search range is the last 7 days.
suspect flagThe /v4/events endpoint unlocks a powerful method for fraud protection analytics. The suspect flag is exposed in all events where it was previously set by the update API.
You can also apply the suspect query parameter as a filter to find all potentially fraudulent activity that you previously marked as suspect. This helps identify patterns of fraudulent behavior.
If you use a secret key that is scoped to an environment, you will only get events associated with the same environment. With a workspace-scoped environment, you will get events from all environments.
Smart Signals not activated for your workspace or are not included in the response.
Add your Secret API Key to the Authorization header using the standard Bearer format: Authorization: Bearer <secret_api_key>
Limit the number of events returned.
1 <= x <= 10010
Use pagination_key to get the next page of results.
When more results are available (e.g., you requested up to 100 results for your query using limit, but there are more than 100 events total matching your request), the pagination_key field is added to the response. The key corresponds to the timestamp of the last returned event. In the following request, use that value in the pagination_key parameter to get the next page of results:
GET api-base-url/events?limit=100response.pagination_key to get the next page of results: GET api-base-url/events?limit=100&pagination_key=1740815825085Unique visitor identifier issued by Fingerprint Identification and all active Smart Signals.
Filter for events matching this visitor_id.
Filter events by the Bot Detection result, specifically:
all - events where any kind of bot was detected.
good - events where a good bot was detected.
bad - events where a bad bot was detected.
none - events where no bot was detected.
Note: When using this parameter, only events with the
botd.botproperty set to a valid value are returned. Events without abotdSmart Signal result are left out of the response.
all, good, bad, none Filter events by IP address or IP range (if CIDR notation is used). If CIDR notation is not used, a /32 for IPv4 or /128 for IPv6 is assumed. Examples of range based queries: 10.0.0.0/24, 192.168.0.1/32
Filter events by the ASN associated with the event's IP address.
This corresponds to the ip_info.(v4|v6).asn property in the response.
Filter events by your custom identifier.
You can use linked Ids to associate identification requests with your own identifier, for example, session Id, purchase Id, or transaction Id. You can then use this linked_id parameter to retrieve all events associated with your custom identifier.
Filter events by the URL (url property) associated with the event.
Filter events by the origin field of the event. Origin could be the website domain or mobile app bundle ID (eg: com.foo.bar)
Filter events with a timestamp greater than the start time, in Unix time (milliseconds).
Filter events with a timestamp smaller than the end time, in Unix time (milliseconds).
Sort events in reverse timestamp order.
Filter events previously tagged as suspicious via the Update API.
Note: When using this parameter, only events with the
suspectproperty explicitly set totrueorfalseare returned. Events with undefinedsuspectproperty are left out of the response.
Filter events by VPN Detection result.
Note: When using this parameter, only events with the
vpnproperty set totrueorfalseare returned. Events without avpnSmart Signal result are left out of the response.
Filter events by Virtual Machine Detection result.
Note: When using this parameter, only events with the
virtual_machineproperty set totrueorfalseare returned. Events without avirtual_machineSmart Signal result are left out of the response.
Filter events by Browser Tampering Detection result.
Note: When using this parameter, only events with the
tampering.resultproperty set totrueorfalseare returned. Events without atamperingSmart Signal result are left out of the response.
Filter events by Anti-detect Browser Detection result.
Note: When using this parameter, only events with the
tampering.anti_detect_browserproperty set totrueorfalseare returned. Events without atamperingSmart Signal result are left out of the response.
Filter events by Browser Incognito Detection result.
Note: When using this parameter, only events with the
incognitoproperty set totrueorfalseare returned. Events without anincognitoSmart Signal result are left out of the response.
Filter events by Privacy Settings Detection result.
Note: When using this parameter, only events with the
privacy_settingsproperty set totrueorfalseare returned. Events without aprivacy_settingsSmart Signal result are left out of the response.
Filter events by Jailbroken Device Detection result.
Note: When using this parameter, only events with the
jailbrokenproperty set totrueorfalseare returned. Events without ajailbrokenSmart Signal result are left out of the response.
Filter events by Frida Detection result.
Note: When using this parameter, only events with the
fridaproperty set totrueorfalseare returned. Events without afridaSmart Signal result are left out of the response.
Filter events by Factory Reset Detection result.
Note: When using this parameter, only events with a
factory_resettime. Events without afactory_resetSmart Signal result are left out of the response.
Filter events by Cloned App Detection result.
Note: When using this parameter, only events with the
cloned_appproperty set totrueorfalseare returned. Events without acloned_appSmart Signal result are left out of the response.
Filter events by Android Emulator Detection result.
Note: When using this parameter, only events with the
emulatorproperty set totrueorfalseare returned. Events without anemulatorSmart Signal result are left out of the response.
Filter events by Rooted Device Detection result.
Note: When using this parameter, only events with the
root_appsproperty set totrueorfalseare returned. Events without aroot_appsSmart Signal result are left out of the response.
Filter events by VPN Detection result confidence level.
high - events with high VPN Detection confidence.
medium - events with medium VPN Detection confidence.
low - events with low VPN Detection confidence.
Note: When using this parameter, only events with the
vpn.confidenceproperty set to a valid value are returned. Events without avpnSmart Signal result are left out of the response.
high,, medium, low Filter events with Suspect Score result above a provided minimum threshold.
Note: When using this parameter, only events where the
suspect_scoreproperty set to a value exceeding your threshold are returned. Events without asuspect_scoreSmart Signal result are left out of the response.
Filter events by Developer Tools detection result.
Note: When using this parameter, only events with the
developer_toolsproperty set totrueorfalseare returned. Events without adeveloper_toolsSmart Signal result are left out of the response.
Filter events by Location Spoofing detection result.
Note: When using this parameter, only events with the
location_spoofingproperty set totrueorfalseare returned. Events without alocation_spoofingSmart Signal result are left out of the response.
Filter events by MITM (Man-in-the-Middle) Attack detection result.
Note: When using this parameter, only events with the
mitm_attackproperty set totrueorfalseare returned. Events without amitm_attackSmart Signal result are left out of the response.
Filter events by Proxy detection result.
Note: When using this parameter, only events with the
proxyproperty set totrueorfalseare returned. Events without aproxySmart Signal result are left out of the response.
Filter events by a specific SDK version associated with the identification event (sdk.version property). Example: 3.11.14
Filter events by the SDK Platform associated with the identification event (sdk.platform property) .
js - Javascript agent (Web).
ios - Apple iOS based devices.
android - Android based devices.
js, android, ios Filter for events by providing one or more environment IDs (environment_id property).
Filter events by the most precise Proximity ID provided by default.
Note: When using this parameter, only events with the
proximity.idproperty matching the provided ID are returned. Events without aproximityresult are left out of the response.
When set, the response will include a total_hits property with a count of total query matches across all pages, up to the specified limit.
1 <= x <= 1000Events matching the filter(s).
Contains a list of all identification events matching the specified search criteria.
Use this value in the pagination_key parameter to request the next page of search results.
This value represents the total number of events matching the search query, up to the limit provided in the total_hits query parameter. Only present if the total_hits query parameter was provided.