---
title: "Enrich DataDome engine"
method: POST
path: "/v1/collect/custom"
tags: ["collect"]
---

# Enrich DataDome engine

`POST /v1/collect/custom`

## Request

- Base URL: `https://account-api.datadome.co`
- URL: `https://account-api.datadome.co/v1/collect/custom`
- Auth: API key in header `x-api-key`

Use this endpoint to send a custom event to DataDome without expecting an action recommendation.

## Request body

- union: Custom event payload sent from Customer endpoint to Account Protect server
  - object: Base properties for custom event payload sent from Customer endpoint to Account Protect server
    - `module` Module, required: Information about module sending this Payload
      - `requestTimeMicros` integer, required: Timestamp of the request, in microseconds
      - `name` string, required: Module name
      - `version` string, required: Module version
    - `header` Header, required: Header sent by the User to the Customer endpoint
      - `addr` string, required: IP address of the originating host making the request (final client's IP address), HTTP_CLIENT_IP
      - `contentType` string, required: Request content-type, CONTENT_TYPE
      - `host` string, required: Request host, HTTP_HOST
      - `port` integer, required: Request port, REMOTE_PORT
      - `xRealIp` string, required: HTTP_X_REAL_IP
      - `xForwardedForIp` string, required: List of client and intermediate proxies/load-balancers IPs, HTTP_X_FORWARDED_FOR
      - `acceptEncoding` string, required: HTTP_ACCEPT_ENCODING
      - `acceptLanguage` string, required: HTTP_ACCEPT_LANGUAGE
      - `accept` string, required: Contents of the Accept: header from the current request, if there is one, HTTP_ACCEPT
      - `method` string, required: HTTP method (GET/POST/OPTION), REQUEST_METHOD
      - `protocol` string, required: Scheme part of the Request-URI (HTTP or HTTPS), SERVER_PROTOCOL
      - `serverHostname` string, required: Virtual host, SERVER_NAME
      - `referer` string, required: HTTP_REFERER
      - `userAgent` string, required: HTTP_USER_AGENT
      - `from` string, required: HTTP_FROM
      - `request` string, required: Path and query part of the Request-URI, REQUEST_URI
      - `origin` string, required: ORIG_PATH_INFO
      - `acceptCharset` string, required: HTTP_ACCEPT_CHARSET
      - `connection` string, required: Check Keep-Alive, from request Header if present, HTTP_CONNECTION
      - `clientID` string, required: The value of the datadome cookie attached to the client request
      - `secCHUA` string: Client hint providing the user-agent's branding and significant version information
      - `secCHUAMobile` string: Client hint for indicating whether the browser is on a mobile device
      - `secCHUAPlatform` string: Client hint for indicating the platform or operating system on which the user agent is running
      - `secCHUAArch` string: Client hint for indicating the user-agent's underlying CPU architecture, such as ARM or x86
      - `secCHUAFullVersionList` string: Client hint for indicating the user-agent's branding and full version information
      - `secCHUAModel` string: Client hint for indicating the device model on which the browser is running
      - `secCHDeviceMemory` string: Client hint for indicating the approximate amount of available RAM on the client device
    - `partnerId` string: For customers who sell their product as white label app, identify the partner using the solution to adapt detection models.
    - `eventDate` string, date-time: Date when the event occurred on your side, if you send it later than it happened (for example from a queue). Format ISO 8601 YYYY-MM-DDThh:mm:ss.sssTZD. DataDome uses it to order the events. If eventDate is absent or has an invalid format, DataDome uses module.requestTimeMicros instead, and the event is still processed.
    - `customFields` CustomField[]: Custom business data fields for additional customer-specific information
      - `name` string, required: The name of the custom data field. Cannot be null or empty.
      - `value` string, required: The value of the custom data field. Can be empty but not null.
      - `type` 'string' | 'phone' | 'email' | 'userId' | 'number' | 'ip': Data type for the custom field. Default is String.
      - `isPii` boolean: Indicates whether this field contains PII (Personally Identifiable Information). Default is false.
    - `eventName` string, required: Name of the custom event in camelCase.
    - `eventStatus` 'attempted' | 'succeeded' | 'failed' | 'expired': Status of the custom event.
    - `isEventCritical` boolean: `true`: the action is linked to a sensitive behavior. `false` (default): the action is NOT linked to a sensitive behavior.
    - `content` string: Any raw text provided by the user. It can be a message content, a post, a ticket or any other relevant data to be checked by Account Protect. Content longer than 24544 bytes (UTF-8) is trimmed before storage. (PII)
    - `accountTarget` string: The account related to the action. For example, if user A sends a message to user B, the value will be B. (PII)
    - `session` Session: Information about the user session
      - `id` string: A unique session identifier from your system
      - `createdAt` string, date-time: Creation date of the session, Format ISO 8601 YYYY-MM-DDThh:mm:ssTZD
    - `accountType` 'guest' | 'staff' | 'external' | 'partner' | 'customer' | 'merchant' | 'vip' | 'test' | 'other': Type of the account to adapt detection model on the user type
    - `accountCreationDate` string, date-time: Date when account was created. Help improve detection for account created before Account Protect setup. Format ISO 8601 YYYY-MM-DDThh:mm:ssTZD
    - `authentication` Authentication: Information about how the user authenticated
      - `socialProvider` 'other' | 'amazon' | 'apple' | 'facebook' | 'github' | 'google' | 'linkedin' | 'microsoft' | 'twitter' | 'yahoo': Authentication social provider
      - `type` 'local' | 'other' | 'social': Authentication type
      - `mode` 'other' | 'biometric' | 'mail' | 'mfa' | 'otp' | 'password': Authentication mode
    - `account` string, required: User account (mail address, username, alias, login, ...). Required if user.id is not provided. (PII)
  - object: Base properties for custom event payload sent from Customer endpoint to Account Protect server
    - `module` Module, required: Information about module sending this Payload
      - `requestTimeMicros` integer, required: Timestamp of the request, in microseconds
      - `name` string, required: Module name
      - `version` string, required: Module version
    - `header` Header, required: Header sent by the User to the Customer endpoint
      - `addr` string, required: IP address of the originating host making the request (final client's IP address), HTTP_CLIENT_IP
      - `contentType` string, required: Request content-type, CONTENT_TYPE
      - `host` string, required: Request host, HTTP_HOST
      - `port` integer, required: Request port, REMOTE_PORT
      - `xRealIp` string, required: HTTP_X_REAL_IP
      - `xForwardedForIp` string, required: List of client and intermediate proxies/load-balancers IPs, HTTP_X_FORWARDED_FOR
      - `acceptEncoding` string, required: HTTP_ACCEPT_ENCODING
      - `acceptLanguage` string, required: HTTP_ACCEPT_LANGUAGE
      - `accept` string, required: Contents of the Accept: header from the current request, if there is one, HTTP_ACCEPT
      - `method` string, required: HTTP method (GET/POST/OPTION), REQUEST_METHOD
      - `protocol` string, required: Scheme part of the Request-URI (HTTP or HTTPS), SERVER_PROTOCOL
      - `serverHostname` string, required: Virtual host, SERVER_NAME
      - `referer` string, required: HTTP_REFERER
      - `userAgent` string, required: HTTP_USER_AGENT
      - `from` string, required: HTTP_FROM
      - `request` string, required: Path and query part of the Request-URI, REQUEST_URI
      - `origin` string, required: ORIG_PATH_INFO
      - `acceptCharset` string, required: HTTP_ACCEPT_CHARSET
      - `connection` string, required: Check Keep-Alive, from request Header if present, HTTP_CONNECTION
      - `clientID` string, required: The value of the datadome cookie attached to the client request
      - `secCHUA` string: Client hint providing the user-agent's branding and significant version information
      - `secCHUAMobile` string: Client hint for indicating whether the browser is on a mobile device
      - `secCHUAPlatform` string: Client hint for indicating the platform or operating system on which the user agent is running
      - `secCHUAArch` string: Client hint for indicating the user-agent's underlying CPU architecture, such as ARM or x86
      - `secCHUAFullVersionList` string: Client hint for indicating the user-agent's branding and full version information
      - `secCHUAModel` string: Client hint for indicating the device model on which the browser is running
      - `secCHDeviceMemory` string: Client hint for indicating the approximate amount of available RAM on the client device
    - `partnerId` string: For customers who sell their product as white label app, identify the partner using the solution to adapt detection models.
    - `eventDate` string, date-time: Date when the event occurred on your side, if you send it later than it happened (for example from a queue). Format ISO 8601 YYYY-MM-DDThh:mm:ss.sssTZD. DataDome uses it to order the events. If eventDate is absent or has an invalid format, DataDome uses module.requestTimeMicros instead, and the event is still processed.
    - `customFields` CustomField[]: Custom business data fields for additional customer-specific information
      - `name` string, required: The name of the custom data field. Cannot be null or empty.
      - `value` string, required: The value of the custom data field. Can be empty but not null.
      - `type` 'string' | 'phone' | 'email' | 'userId' | 'number' | 'ip': Data type for the custom field. Default is String.
      - `isPii` boolean: Indicates whether this field contains PII (Personally Identifiable Information). Default is false.
    - `eventName` string, required: Name of the custom event in camelCase.
    - `eventStatus` 'attempted' | 'succeeded' | 'failed' | 'expired': Status of the custom event.
    - `isEventCritical` boolean: `true`: the action is linked to a sensitive behavior. `false` (default): the action is NOT linked to a sensitive behavior.
    - `content` string: Any raw text provided by the user. It can be a message content, a post, a ticket or any other relevant data to be checked by Account Protect. Content longer than 24544 bytes (UTF-8) is trimmed before storage. (PII)
    - `accountTarget` string: The account related to the action. For example, if user A sends a message to user B, the value will be B. (PII)
    - `session` Session: Information about the user session
      - `id` string: A unique session identifier from your system
      - `createdAt` string, date-time: Creation date of the session, Format ISO 8601 YYYY-MM-DDThh:mm:ssTZD
    - `accountType` 'guest' | 'staff' | 'external' | 'partner' | 'customer' | 'merchant' | 'vip' | 'test' | 'other': Type of the account to adapt detection model on the user type
    - `accountCreationDate` string, date-time: Date when account was created. Help improve detection for account created before Account Protect setup. Format ISO 8601 YYYY-MM-DDThh:mm:ssTZD
    - `authentication` Authentication: Information about how the user authenticated
      - `socialProvider` 'other' | 'amazon' | 'apple' | 'facebook' | 'github' | 'google' | 'linkedin' | 'microsoft' | 'twitter' | 'yahoo': Authentication social provider
      - `type` 'local' | 'other' | 'social': Authentication type
      - `mode` 'other' | 'biometric' | 'mail' | 'mfa' | 'otp' | 'password': Authentication mode
    - `user` object, required: Required if account is not provided.
      - `id` string: A unique customer identifier from your system. It has to be the same for all other event sent
      - `title` 'mr' | 'mrs' | 'mx': Title of the user
      - `firstName` string: First name of the user
      - `lastName` string: Last name of the user
      - `createdAt` string, date-time: Creation date of the user, Format ISO 8601 YYYY-MM-DDThh:mm:ssTZD
      - `phone` string, phone: Phone of the user, E.164 format including + and a region code, for example +33978787878
      - `email` string, email: Email of the user
      - `displayName` string: Display name of the user
      - `description` string: Description or biography of the user
      - `pictureUrls` string[]: Pictures of the user
      - `externalUrls` string[]: External URLs of the user
      - `address` object: Address of the user
        - `name` string: Name of the address
        - `line1` string: line 1
        - `line2` string: line 2
        - `city` string: City
        - `countryCode` string: Country code, Format ISO-3166-1-alpha-2
        - `regionCode` string: Region code
        - `zipCode` string: Zip code
      - `dateOfBirth` string, date-time: Date of birth of the user used to estimate its age and adapt detection models. Format ISO 8601 YYYY-MM-DDThh:mm:ssTZD (PII)
      - `isAuthenticated` boolean: `true`: the action is done by an authenticated user. `false`: the action is triggered by a guest user.

## Response `201`

Custom event has been collected

## Other responses

- `400`: Error response when the request is malformed
- `401`: Error response when the apiKey is missing or blank
- `403`: Error response when the apiKey is not valid
- `500`: Internal server error

---

[API](https://skmtc.dev/datadome/apis/account-protect-api.md) - [All operations](https://skmtc.dev/datadome/apis/account-protect-api/llms.txt) - [OpenAPI document](https://skmtc.dev/datadome/apis/account-protect-api/revisions/c25df7aef1f2?raw)