---
title: "Search events"
method: GET
path: "/events"
tags: ["Events"]
---

# Search events

`GET /events`

## Search

The `/v4/events` endpoint provides a convenient way to search for past events based on specific parameters. Typical use cases and queries include:

- Searching for events associated with a single `visitor_id` within a time range to get historical behavior of a visitor.
- Searching for events associated with a single `linked_id` within a time range to get all events associated with your internal account identifier.
- Excluding all bot traffic from the query (`good` and `bad` bots)

By default, the API searches events from the last 7 days, sorts them by newest first and returns the last 10 events.

- Use `start` and `end` to specify the time range of the search.
- Use `reverse=true` to sort the results oldest first.
- Use `limit` to specify the number of events to return.
- Use `pagination_key` to get the next page of results if there are more than `limit` events.

### Filtering events with the `suspect` flag

The `/v4/events` endpoint unlocks a powerful method for fraud protection analytics. The `suspect` flag is exposed in all events where it was previously set by the update API.

You can also apply the `suspect` query parameter as a filter to find all potentially fraudulent activity that you previously marked as `suspect`. This helps identify patterns of fraudulent behavior.

### Environment scoping

If you use a secret key that is scoped to an environment, you will only get events associated with the same environment. With a workspace-scoped environment, you will get events from all environments.

Smart Signals not activated for your workspace or are not included in the response.

## Query parameters

- `limit` integer
- `pagination_key` string
- `visitor_id` string
- `high_recall_id` string
- `bot` 'all' | 'good' | 'bad' | 'none'
- `bot_info` 'all' | 'none'
- `bot_info_category` BotInfoCategory[]
- `bot_info_identity` BotInfoIdentity[]
- `bot_info_confidence` BotInfoConfidence[]
- `bot_info_provider` string[]
- `bot_info_name` string[]
- `ip_address` string
- `asn` string
- `linked_id` string
- `url` string
- `bundle_id` string
- `package_name` string
- `origin` string
- `start` union
  - integer
  - string, date-time
- `end` union
  - integer
  - string, date-time
- `reverse` boolean
- `suspect` boolean
- `vpn` boolean
- `virtual_machine` boolean
- `tampering` boolean
- `anti_detect_browser` boolean
- `incognito` boolean
- `privacy_settings` boolean
- `jailbroken` boolean
- `frida` boolean
- `factory_reset` boolean
- `cloned_app` boolean
- `emulator` boolean
- `root_apps` boolean
- `vpn_confidence` 'high' | 'medium' | 'low'
- `min_suspect_score` number, float
- `developer_tools` boolean
- `location_spoofing` boolean
- `mitm_attack` boolean
- `rare_device` boolean
- `rare_device_percentile_bucket` '<p95' | 'p95-p99' | 'p99-p99.5' | 'p99.5-p99.9' | 'p99.9+' | 'not_seen'
- `proxy` boolean
- `sdk_version` string
- `sdk_platform` 'js' | 'android' | 'ios'
- `environment` string[]
- `proximity_id` string
- `total_hits` integer
- `tor_node` boolean
- `incremental_identification_status` 'partially_completed' | 'completed'
- `simulator` boolean
- `source` string[]

## Response `200`

Events matching the filter(s).

- EventSearch — Contains a list of all identification events matching the specified search criteria.
  - `events` Event[], required
    - `event_id` string, required — Unique identifier of the user's request. The first portion of the event_id is a unix epoch milliseconds timestamp.
    - `timestamp` integer, required — Timestamp of the event with millisecond precision in Unix time.
    - `incremental_identification_status` 'partially_completed' | 'completed' — Only included for requests using incremental identification. - `partially_completed` - Indicates this event corresponds to a 'minimal' request. Smart Signals, even if included in your plan, are not computed; hence, their values must be ignored. - `completed` - Indicates this event corresponds to a 'complete' request. Smart Signals, if included in your plan, are computed; hence, their values are valid and relevant.
    - `linked_id` string — A customer-provided id that was sent with the request.
    - `environment_id` string — Environment Id of the event.
    - `suspect` boolean — Field is `true` if you have previously set the `suspect` flag for this event using the [Server API Update event endpoint](https://docs.fingerprint.com/reference/server-api-v4-update-event).
    - `sdk` SDK — Contains information about the SDK used to perform the request.
      - `platform` 'js' | 'android' | 'ios' | 'unknown', required — Platform of the SDK used for the identification request.
      - `version` string, required — Version string of the SDK used for the identification request.
      - `integrations` Integration[]
        - `name` string — The name of the specific integration.
        - `version` string — The version of the specific integration.
        - `subintegration` object
          - `name` string — The name of the specific subintegration.
          - `version` string — The version of the specific subintegration.
    - `replayed` boolean — `true` if we determined that this payload was replayed, `false` otherwise.
    - `identification` Identification
      - `visitor_id` string, required — String of 20 characters that uniquely identifies the visitor's browser or mobile device.
      - `confidence` IdentificationConfidence — The confidence score represents the probability of a false-positive identification. To learn more, visit [Confidence Score](https://docs.fingerprint.com/docs/identification-accuracy-and-confidence#confidence-score). Please note that the confidence score is not yet supported for [High Recall ID](https://docs.fingerprint.com/docs/supplementary-identifiers-highrecall).
        - `score` number, double, required — A floating-point number between 0 and 1 that represents the probability of a false-positive identification. For High Recall ID, this value is 0.
        - `version` string — The version name of the method used to calculate the confidence score. For High Recall ID, this value is "Not Supported".
        - `comment` string
      - `visitor_found` boolean, required — Attribute represents if a visitor had been identified before.
      - `first_seen_at` integer — Unix epoch time milliseconds timestamp indicating the time at which this visitor ID was first seen. example: `1758069706642` - Corresponding to Wed Sep 17 2025 00:41:46 GMT+0000
      - `last_seen_at` integer — Unix epoch time milliseconds timestamp indicating the time at which this visitor ID was last seen. example: `1758069706642` - Corresponding to Wed Sep 17 2025 00:41:46 GMT+0000
    - `supplementary_id_high_recall` SupplementaryIDHighRecall — The High Recall ID is a supplementary browser identifier designed for use cases that require wider coverage over precision. Compared to the standard visitor ID, the High Recall ID strives to match incoming browsers more generously (rather than precisely) with existing browsers and thus identifies fewer browsers as new. The High Recall ID is best suited for use cases that are sensitive to browsers being identified as new and where mismatched browsers are not detrimental.
      - `visitor_id` string, required — The High Recall identifier for the visitor's browser. It is an alphanumeric string with a maximum length of 25 characters.
      - `visitor_found` boolean, required — True if this is a returning browser and has been previously identified. Otherwise, false.
      - `confidence` IdentificationConfidence — The confidence score represents the probability of a false-positive identification. To learn more, visit [Confidence Score](https://docs.fingerprint.com/docs/identification-accuracy-and-confidence#confidence-score). Please note that the confidence score is not yet supported for [High Recall ID](https://docs.fingerprint.com/docs/supplementary-identifiers-highrecall).
        - `score` number, double, required — A floating-point number between 0 and 1 that represents the probability of a false-positive identification. For High Recall ID, this value is 0.
        - `version` string — The version name of the method used to calculate the confidence score. For High Recall ID, this value is "Not Supported".
        - `comment` string
      - `first_seen_at` integer — Unix epoch timestamp (in milliseconds) indicating when the browser was first identified. example: `1758069706642` - Corresponding to Wed Sep 17 2025 00:41:46 GMT+0000
      - `last_seen_at` integer — Unix epoch timestamp (in milliseconds) corresponding to the most recent visit by this browser. example: `1758069706642` - Corresponding to Wed Sep 17 2025 00:41:46 GMT+0000
    - `tags` Tags — A customer-provided value or an object that was sent with the identification request or updated later.
    - `url` string — Page URL from which the request was sent.
    - `bundle_id` string — Bundle Id of the iOS application integrated with the Fingerprint SDK for the event.
    - `package_name` string — Package name of the Android application integrated with the Fingerprint SDK for the event.
    - `ip_address` string — IP address of the requesting browser or bot.
    - `user_agent` string — User Agent of the client.
    - `device` string — Device model or family extracted from the user agent string. On web, this field is also present inside `browser_details`.
    - `os` string — Operating system family extracted from the user agent string. On web, this field is also present inside `browser_details`.
    - `os_version` string — Operating system version string extracted from the user agent string. On web, this field is also present inside `browser_details`.
    - `client_referrer` string — Client Referrer field corresponds to the `document.referrer` field gathered during an identification request. The value is an empty string if the user navigated to the page directly (not through a link, but, for example, by using a bookmark).
    - `browser_details` BrowserDetails
      - `browser_name` string, required
      - `browser_major_version` string, required
      - `browser_full_version` string, required
      - `os` string, required
      - `os_version` string, required
      - `device` string, required
    - `proximity` Proximity — Proximity ID represents a fixed geographical zone in a discrete global grid within which the device is observed.
      - `id` string, required — A stable privacy-preserving identifier for a given proximity zone.
      - `precision_radius` 10 | 25 | 65 | 175 | 450 | 1200 | 3300 | 8500 | 22500, required — The radius of the proximity zone’s precision level, in meters.
      - `confidence` number, float, required — A value between `0` and `1` representing the likelihood that the true device location lies within the mapped proximity zone. * Scores closer to `1` indicate high confidence that the location is inside the mapped proximity zone. * Scores closer to `0` indicate lower confidence, suggesting the true location may fall in an adjacent zone.
    - `bot` 'bad' | 'good' | 'not_detected' — Bot detection result: * `bad` - bad bot detected, such as Selenium, Puppeteer, Playwright, headless browsers, and so on * `good` - good bot detected, such as Google bot, Baidu Spider, AlexaBot and so on * `not_detected` - the visitor is not a bot
    - `bot_type` string — Additional classification of the bot type if detected.
    - `bot_info` BotInfo — Extended bot information.
      - `category` 'advertising_and_marketing' | 'aggregator' | 'ai_agent' | 'ai_assistant' | 'ai_browser' | 'ai_crawler' | 'ai_search' | 'browser_automation' | 'ecommerce' | 'monitoring_and_analytics' | 'other' | 'scraping' | 'security' | 'search_engine_crawler' | 'search_engine_optimization' | 'unknown', required — The type and purpose of the bot.
      - `provider` string, required — The organization or company operating the bot.
      - `provider_url` string — The URL of the bot provider's website.
      - `name` string, required — The specific name or identifier of the bot.
      - `identity` 'verified' | 'signed' | 'spoofed' | 'unknown', required — The verification status of the bot's identity: * `verified` - well-known bot with publicly verifiable identity, directed by the bot provider. * `signed` - bot that signs its platform via Web Bot Auth, directed by the bot provider's customers. * `spoofed` - bot that claims a public identity but fails verification. * `unknown` - bot that does not publish a verifiable identity.
      - `confidence` 'low' | 'medium' | 'high', required — Confidence level of the bot identification.
    - `cloned_app` boolean — Android specific cloned application detection. There are 2 values: * `true` - Presence of app cloners work detected (e.g. fully cloned application found or launch of it inside of a not main working profile detected). * `false` - No signs of cloned application detected or the client is not Android.
    - `developer_tools` boolean — `true` if the browser has DevTools open (Chrome, Firefox) or the Android/iOS device has Developer Tools enabled, `false` otherwise.
    - `emulator` boolean — Android specific emulator detection. There are 2 values: * `true` - Emulated environment detected (e.g. launch inside of AVD). * `false` - No signs of emulated environment detected or the client is not Android.
    - `factory_reset_timestamp` integer — The time of the most recent factory reset that happened on the **mobile device** is expressed as Unix epoch time. When a factory reset cannot be detected on the mobile device or when the request is initiated from a browser, this field will correspond to the *epoch* time (i.e 1 Jan 1970 UTC) as a value of 0. See [Factory Reset Detection](https://docs.fingerprint.com/docs/smart-signals-reference#factory-reset-detection) to learn more about this Smart Signal.
    - `frida` boolean — [Frida](https://frida.re/docs/) detection for Android and iOS devices. There are 2 values: * `true` - Frida detected * `false` - No signs of Frida or the client is not a mobile device.
    - `ip_blocklist` IPBlockList
      - `email_spam` boolean — IP address was part of a known email spam attack (SMTP).
      - `attack_source` boolean — IP address was part of a known network attack (SSH/HTTPS).
      - `tor_node` boolean — IP address was part of known TOR network activity.
    - `ip_info` IPInfo — Details about the request IP address. Has separate fields for v4 and v6 IP address versions.
      - `v4` IPInfoV4
        - `address` string, ipv4, required
        - `geolocation` Geolocation
          - `accuracy_radius` integer — The IP address is likely to be within this radius (in km) of the specified location.
          - `latitude` number, double
          - `longitude` number, double
          - `postal_code` string
          - `timezone` string, timezone
          - `city_name` string
          - `country_code` string
          - `country_name` string
          - `continent_code` string
          - `continent_name` string
          - `subdivisions` object[]
            - `iso_code` string, required
            - `name` string, required
        - `asn` string
        - `asn_name` string
        - `asn_network` string
        - `asn_type` string
        - `datacenter_result` boolean — When true, the request originated from a datacenter.
        - `datacenter_name` string
      - `v6` IPInfoV6
        - `address` string, ipv6, required
        - `geolocation` Geolocation
          - `accuracy_radius` integer — The IP address is likely to be within this radius (in km) of the specified location.
          - `latitude` number, double
          - `longitude` number, double
          - `postal_code` string
          - `timezone` string, timezone
          - `city_name` string
          - `country_code` string
          - `country_name` string
          - `continent_code` string
          - `continent_name` string
          - `subdivisions` object[]
            - `iso_code` string, required
            - `name` string, required
        - `asn` string
        - `asn_name` string
        - `asn_network` string
        - `asn_type` string
        - `datacenter_result` boolean — When true, the request originated from a datacenter.
        - `datacenter_name` string
    - `proxy` boolean — IP address was used by a public proxy provider or belonged to a known recent residential proxy
    - `proxy_confidence` 'low' | 'medium' | 'high' — Confidence level of the proxy detection. If a proxy is not detected, confidence is "high". If it's detected, can be "low", "medium", or "high".
    - `proxy_details` ProxyDetails — Proxy detection details (present if `proxy` is `true`)
      - `proxy_type` 'residential' | 'data_center' | 'unknown', required — Proxy type: * `residential` - proxies that route through residential and telecom IP addresses to appear as legitimate traffic * `data_center` - proxies which route through data centers * `unknown` - reported when a proxy is detected solely by the ML model and the IP sources did not determine a specific type
      - `last_seen_at` integer — Unix millisecond timestamp with hourly resolution of when this IP was last seen as a proxy
      - `provider` string — String representing the last proxy service provider detected when this IP was synced. An IP can be shared by multiple service providers.
    - `proxy_ml_score` number, double — Machine learning–based proxy score, represented as a floating-point value between 0 and 1 (inclusive), with up to three decimal places of precision. A higher score means a higher confidence in the positive `proxy` detection result. This Smart Signal is currently in beta and only available to select customers. If you are interested, please [contact our support team](https://fingerprint.com/support/).
    - `incognito` boolean — `true` if we detected incognito mode used in the browser, `false` otherwise.
    - `jailbroken` boolean — iOS specific jailbreak detection. There are 2 values: * `true` - Jailbreak detected. * `false` - No signs of jailbreak or the client is not iOS.
    - `location_spoofing` boolean — Flag indicating whether the request came from a mobile device with location spoofing enabled.
    - `mitm_attack` boolean — * `true` - When requests made from your users' mobile devices to Fingerprint servers have been intercepted and potentially modified. * `false` - Otherwise or when the request originated from a browser. See [MitM Attack Detection](https://docs.fingerprint.com/docs/smart-signals-reference#mitm-attack-detection) to learn more about this Smart Signal.
    - `privacy_settings` boolean — `true` if the request is from a privacy aware browser (e.g. Tor) or from a browser in which fingerprinting is blocked. Otherwise `false`.
    - `root_apps` boolean — Android specific root management apps detection. There are 2 values: * `true` - Root Management Apps detected (e.g. Magisk). * `false` - No Root Management Apps detected or the client isn't Android.
    - `rule_action` union — Describes the action the client should take, according to the rule in the ruleset that matched the event. When getting an event by event ID, the rule_action will only be included when the ruleset_id query parameter is specified.
      - object — Informs the client that the request should be forwarded to the origin with optional request header modifications.
        - `ruleset_id` string, required — The ID of the evaluated ruleset.
        - `rule_id` string — The ID of the rule that matched the identification event.
        - `rule_expression` string — The expression of the rule that matched the identification event.
        - `type` 'allow' | 'block', required — Describes the action to take with the request.
        - `request_header_modifications` RequestHeaderModifications — The set of header modifications to apply, in the following order: remove, set, append.
          - `remove` string[] — The list of headers to remove.
          - `set` RuleActionHeaderField[] — The list of headers to set, overwriting any existing headers with the same name.
            - `name` string, required — The header field name.
            - `value` string, required — The value of the header field.
          - `append` RuleActionHeaderField[] — The list of headers to append.
            - `name` string, required — The header field name.
            - `value` string, required — The value of the header field.
      - object — Informs the client the request should be blocked using the response described by this rule action.
        - `ruleset_id` string, required — The ID of the evaluated ruleset.
        - `rule_id` string — The ID of the rule that matched the identification event.
        - `rule_expression` string — The expression of the rule that matched the identification event.
        - `type` 'allow' | 'block', required — Describes the action to take with the request.
        - `status_code` integer — A valid HTTP status code.
        - `headers` RuleActionHeaderField[] — A list of headers to send.
          - `name` string, required — The header field name.
          - `value` string, required — The value of the header field.
        - `body` string — The response body to send to the client.
    - `simulator` boolean — iOS specific simulator detection. There are 2 values: * `true` - Simulator environment detected. * `false` - No signs of simulator or the client is not iOS.
    - `suspect_score` integer — Suspect Score is an easy way to integrate Smart Signals into your fraud protection work flow. It is a weighted representation of all Smart Signals present in the payload that helps identify suspicious activity. The value range is [0; S] where S is sum of all Smart Signals weights. See more details here: https://docs.fingerprint.com/docs/suspect-score
    - `tampering` boolean — The field can be used as a standalone flag for tampering detection. Alternatively, the more granular fields documented below can be used for workflows that require more context. * `true` if tampering is detected through an anomalous browser signature, anti-detect browser detection, or other tampering-related methods * `false` if none of the tampering checks return a positive result
    - `tampering_confidence` 'low' | 'medium' | 'high' — The confidence level indicates how certain Fingerprint is that the current request involves browser tampering. This confidence level is determined by evaluating multiple factors, such as heuristic rules, probabilistic anomaly detection, an anti detect browser ml model, and other relevant methods. It is conveyed as a string with possible values such as high, medium, or low In case of tampering: `true` * **High confidence**: heuristic anti detect browser signals and the ml model are triggered, or all of the methods are triggered. * **Medium confidence**: either the ml model triggers alone, the anomaly score triggers alone with or without the heuristic anti detect browser methods trigger. * **Low confidence**: only the heuristic anti detect methods are triggered. In case of tampering: `false` * **High confidence:** Strong signals suggest the user is not tampering with their request.
    - `tampering_ml_score` number, double — The output of this model is captured as tampering_ml_score, a number indicating how likely an event is coming from an anti detect browser. Values close to 1 signify higher confidence and we consider anything above the threshold of 0.8 to be actionable (the result and anti_detect_browser fields conveniently captures that fact)
    - `tampering_details` TamperingDetails
      - `anomaly_score` number, double — The output of this model is captured as anomaly_score, a statistical score indicating how rare the visitor's browser signature is compared to the overall population. Values close to 1 signify highly anomalous browsers and we consider anything above the threshold of 0.5 to be actionable (the result field conveniently captures that fact).
      - `anti_detect_browser` boolean — Detects whether the request shows evidence of anti-detect browser usage. This field may be triggered by: * heuristic detection of known anti-detect browser behavior * machine learning detection of anti-detect browser patterns Examples of anti-detect browsers include tools such as AdsPower, DolphinAnty, OctoBrowser, and GoLogin.
    - `velocity` Velocity — Sums key data points for a specific `visitor_id`, `ip_address` and `linked_id` at three distinct time intervals: 5 minutes, 1 hour, and 24 hours as follows: - Number of distinct IP addresses associated to the visitor Id. - Number of distinct linked Ids associated with the visitor Id. - Number of distinct countries associated with the visitor Id. - Number of identification events associated with the visitor Id. - Number of identification events associated with the detected IP address. - Number of distinct IP addresses associated with the provided linked Id. - Number of distinct visitor Ids associated with the provided linked Id. The `24h` interval of `distinct_ip`, `distinct_linked_id`, `distinct_country`, `distinct_ip_by_linked_id` and `distinct_visitor_id_by_linked_id` will be omitted if the number of `events` for the visitor Id in the last 24 hours (`events.['24h']`) is higher than 20.000. All will not necessarily be returned in a response, some may be omitted if the associated event does not have the required data, such as a linked_id.
      - `distinct_ip` VelocityData — Is absent if the velocity data could not be generated for the visitor Id.
        - `5_minutes` integer, required — Count for the last 5 minutes of velocity data, from the time of the event.
        - `1_hour` integer, required — Count for the last 1 hour of velocity data, from the time of the event.
        - `24_hours` integer — The `24_hours` interval of `distinct_ip`, `distinct_linked_id`, `distinct_country`, `distinct_ip_by_linked_id` and `distinct_visitor_id_by_linked_id` will be omitted if the number of `events` for the visitor Id in the last 24 hours (`events.['24_hours']`) is higher than 20.000.
      - `distinct_linked_id` VelocityData — Is absent if the velocity data could not be generated for the visitor Id.
        - `5_minutes` integer, required — Count for the last 5 minutes of velocity data, from the time of the event.
        - `1_hour` integer, required — Count for the last 1 hour of velocity data, from the time of the event.
        - `24_hours` integer — The `24_hours` interval of `distinct_ip`, `distinct_linked_id`, `distinct_country`, `distinct_ip_by_linked_id` and `distinct_visitor_id_by_linked_id` will be omitted if the number of `events` for the visitor Id in the last 24 hours (`events.['24_hours']`) is higher than 20.000.
      - `distinct_country` VelocityData — Is absent if the velocity data could not be generated for the visitor Id.
        - `5_minutes` integer, required — Count for the last 5 minutes of velocity data, from the time of the event.
        - `1_hour` integer, required — Count for the last 1 hour of velocity data, from the time of the event.
        - `24_hours` integer — The `24_hours` interval of `distinct_ip`, `distinct_linked_id`, `distinct_country`, `distinct_ip_by_linked_id` and `distinct_visitor_id_by_linked_id` will be omitted if the number of `events` for the visitor Id in the last 24 hours (`events.['24_hours']`) is higher than 20.000.
      - `events` VelocityData — Is absent if the velocity data could not be generated for the visitor Id.
        - `5_minutes` integer, required — Count for the last 5 minutes of velocity data, from the time of the event.
        - `1_hour` integer, required — Count for the last 1 hour of velocity data, from the time of the event.
        - `24_hours` integer — The `24_hours` interval of `distinct_ip`, `distinct_linked_id`, `distinct_country`, `distinct_ip_by_linked_id` and `distinct_visitor_id_by_linked_id` will be omitted if the number of `events` for the visitor Id in the last 24 hours (`events.['24_hours']`) is higher than 20.000.
      - `ip_events` VelocityData — Is absent if the velocity data could not be generated for the visitor Id.
        - `5_minutes` integer, required — Count for the last 5 minutes of velocity data, from the time of the event.
        - `1_hour` integer, required — Count for the last 1 hour of velocity data, from the time of the event.
        - `24_hours` integer — The `24_hours` interval of `distinct_ip`, `distinct_linked_id`, `distinct_country`, `distinct_ip_by_linked_id` and `distinct_visitor_id_by_linked_id` will be omitted if the number of `events` for the visitor Id in the last 24 hours (`events.['24_hours']`) is higher than 20.000.
      - `distinct_ip_by_linked_id` VelocityData — Is absent if the velocity data could not be generated for the visitor Id.
        - `5_minutes` integer, required — Count for the last 5 minutes of velocity data, from the time of the event.
        - `1_hour` integer, required — Count for the last 1 hour of velocity data, from the time of the event.
        - `24_hours` integer — The `24_hours` interval of `distinct_ip`, `distinct_linked_id`, `distinct_country`, `distinct_ip_by_linked_id` and `distinct_visitor_id_by_linked_id` will be omitted if the number of `events` for the visitor Id in the last 24 hours (`events.['24_hours']`) is higher than 20.000.
      - `distinct_visitor_id_by_linked_id` VelocityData — Is absent if the velocity data could not be generated for the visitor Id.
        - `5_minutes` integer, required — Count for the last 5 minutes of velocity data, from the time of the event.
        - `1_hour` integer, required — Count for the last 1 hour of velocity data, from the time of the event.
        - `24_hours` integer — The `24_hours` interval of `distinct_ip`, `distinct_linked_id`, `distinct_country`, `distinct_ip_by_linked_id` and `distinct_visitor_id_by_linked_id` will be omitted if the number of `events` for the visitor Id in the last 24 hours (`events.['24_hours']`) is higher than 20.000.
    - `virtual_machine` boolean — `true` if the request came from a browser running inside a virtual machine (e.g. VMWare), `false` otherwise.
    - `virtual_machine_ml_score` number, double — Machine learning–based virtual machine score, represented as a floating-point value between 0 and 1 (inclusive), with up to three decimal places of precision. A higher score means a higher confidence in the positive `virtual_machine` detection result. This Smart Signal is currently in beta and only available to select customers. If you are interested, please [contact our support team](https://fingerprint.com/support/).
    - `vpn` boolean — VPN or other anonymizing service has been used when sending the request.
    - `vpn_confidence` 'low' | 'medium' | 'high' — A confidence rating for the VPN detection result — "low", "medium", or "high". Depends on the combination of results returned from all VPN detection methods.
    - `vpn_ml_score` number, double — Machine learning–based VPN score, represented as a floating-point value between 0 and 1 (inclusive), with up to three decimal places of precision. A higher score means a higher confidence in the positive `vpn` detection result. This Smart Signal is currently in beta and only available to select customers. If you are interested, please [contact our support team](https://fingerprint.com/support/).
    - `vpn_origin_timezone` string — Local timezone which is used in timezone_mismatch method.
    - `vpn_origin_country` string — Country of the request (only for Android SDK version >= 2.4.0, ISO 3166 format or unknown).
    - `vpn_methods` VpnMethods
      - `timezone_mismatch` boolean — The browser timezone doesn't match the timezone inferred from the request IP address.
      - `public_vpn` boolean — Request IP address is owned and used by a public VPN service provider.
      - `auxiliary_mobile` boolean — This method applies to mobile devices only. Indicates the result of additional methods used to detect a VPN in mobile devices.
      - `os_mismatch` boolean — The browser runs on a different operating system than the operating system inferred from the request network signature.
      - `relay` boolean — Request IP address belongs to a relay service provider, indicating the use of relay services like [Apple Private relay](https://support.apple.com/en-us/102602) or [Cloudflare Warp](https://developers.cloudflare.com/warp-client/). * Like VPNs, relay services anonymize the visitor's true IP address. * Unlike traditional VPNs, relay services don't let visitors spoof their location by choosing an exit node in a different country. This field allows you to differentiate VPN users and relay service users in your fraud prevention logic.
      - `ml_prediction` boolean — `true` if the request came from a device running a VPN, `false` otherwise.
    - `high_activity_device` boolean — Flag indicating if the request came from a high-activity visitor.
    - `rare_device` boolean — `true` if the device is considered rare based on its combination of hardware and software attributes. A device is classified as rare if it falls within the top 99.9 percentile (lowest-frequency segment) of observed traffic, or if its configuration has not been previously seen (`not_seen`). > This Smart Signal is currently in beta and only available to select customers. If you are interested, please [contact our support team](https://fingerprint.com/support/).
    - `rare_device_percentile_bucket` '<p95' | 'p95-p99' | 'p99-p99.5' | 'p99.5-p99.9' | 'p99.9+' | 'not_seen' — The rarity percentile bucket of the device, indicating how uncommon the device configuration is compared to all observed devices. > This Smart Signal is currently in beta and only available to select customers. If you are interested, please [contact our support team](https://fingerprint.com/support/).
    - `raw_device_attributes` RawDeviceAttributes — A curated subset of raw browser/device attributes that the API surface exposes. Each property contains a value or object with the data for the collected signal.
      - `font_preferences` FontPreferences — Baseline measurement of canonical fonts rendered on the device. Numeric width metrics, in CSS pixels, for the canonical fonts collected by the agent.
        - `default` number, double
        - `serif` number, double
        - `sans` number, double
        - `mono` number, double
        - `apple` number, double
        - `min` number, double
        - `system` number, double
      - `emoji` Emoji — Bounding box metrics describing how the emoji glyph renders.
        - `font` string — Font family reported by the browser when drawing the emoji.
        - `width` number, double
        - `height` number, double
        - `top` number, double
        - `bottom` number, double
        - `left` number, double
        - `right` number, double
        - `x` number, double
        - `y` number, double
      - `fonts` string[] — List of fonts detected on the device.
      - `device_memory` integer — Rounded amount of RAM in gigabytes.
      - `timezone` string — Timezone identifier detected on the client.
      - `canvas` Canvas — Canvas fingerprint containing winding flag plus geometry/text hashes.
        - `winding` boolean
        - `geometry` string — Hash of geometry rendering output or `unsupported` markers.
        - `text` string — Hash of text rendering output or `unsupported` markers.
      - `languages` array[] — Navigator languages reported by the agent including fallbacks. Each inner array represents ordered language preferences reported by different APIs. Available for browsers, iOS, and Android devices.
        - string[]
      - `webgl_extensions` WebGlExtensions — Hashes of WebGL context attributes and extension support.
        - `context_attributes` string
        - `parameters` string
        - `shader_precisions` string
        - `extensions` string
        - `extension_parameters` string
        - `unsupported_extensions` string[]
      - `webgl_basics` WebGlBasics — Render and vendor strings reported by the WebGL context.
        - `version` string
        - `vendor` string
        - `vendor_unmasked` string
        - `renderer` string
        - `renderer_unmasked` string
        - `shading_language_version` string
      - `screen_resolution` integer[] — Current screen resolution. Available for both browsers and iOS devices
      - `touch_support` TouchSupport — Browser-reported touch capabilities.
        - `touch_event` boolean
        - `touch_start` boolean
        - `max_touch_points` integer
      - `oscpu` string — Navigator `oscpu` string.
      - `architecture` integer — Integer representing the CPU architecture exposed by the browser.
      - `cookies_enabled` boolean — Whether the cookies are enabled in the browser.
      - `hardware_concurrency` integer — Number of logical CPU cores reported by the browser.
      - `date_time_locale` string — Locale derived from the Intl.DateTimeFormat API. Negative values indicate known error states. The negative statuses can be: - "-1": A permanent status for browsers that don't support Intl API. - "-2": A permanent status for browsers that don't supportDateTimeFormat constructor. - "-3": A permanent status for browsers in which DateTimeFormat locale is undefined or null.
      - `vendor` string — Navigator vendor string.
      - `color_depth` integer — Screen color depth in bits.
      - `platform` string — Navigator platform string.
      - `session_storage` boolean — Whether sessionStorage is available.
      - `local_storage` boolean — Whether localStorage is available.
      - `audio` number, double — AudioContext fingerprint or negative status when unavailable. The negative statuses can be: - -1: A permanent status for those browsers which are known to always suspend audio context - -2: A permanent status for browsers that don't support the signal - -3: A temporary status that means that an unexpected timeout has happened
      - `plugins` object[] — Browser plugins reported by `navigator.plugins`.
        - `name` string, required
        - `description` string
        - `mimeTypes` object[]
          - `type` string
          - `suffixes` string
          - `description` string
      - `indexed_db` boolean — Whether IndexedDB is available.
      - `math` string — Hash of Math APIs used for entropy collection.
      - `device_model` string — Device model string. Available only for Android and iOS devices.
      - `device_manufacturer` string — Device manufacturer string. Available only for Android and iOS devices.
      - `font_hash` string — Unique identifier for the user’s installed fonts.
      - `timezone_offset` string — UTC offset in "±HH:MM" format derived from the detected IANA timezone.
      - `battery_level` integer — Battery charge level as a percentage (0-100). Available only for Android and iOS devices.
      - `battery_low_power_mode` boolean — Whether the device's low power mode is enabled. Available only for Android and iOS devices.
    - `labels` object[] — Each label returns a prediction (true or false) for a specific use case (label field) based on a machine learning score. The machine learning score is determined by a model trained on customer data for that use case. This field is in the beta phase and only available to select customers. If you are interested, please [contact our support team](https://fingerprint.com/support/).
      - `label` string, required
      - `prediction` boolean
      - `ml_score` number, double
  - `pagination_key` string — Use this value in the `pagination_key` parameter to request the next page of search results.
  - `total_hits` integer — This value represents the total number of events matching the search query, up to the limit provided in the `total_hits` query parameter. Only present if the `total_hits` query parameter was provided.

## Other responses

- `400` — Bad request. One or more supplied search parameters are invalid, or a required parameter is missing.
- `403` — Forbidden. Access to this API is denied.
- `404` — Not found. The requested visitor does not exist in this workspace's data.
- `500` — Workspace error.

---

[API](https://skmtc.dev/fingerprint/apis/management-api.md) · [All operations](https://skmtc.dev/fingerprint/apis/management-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/fingerprint/management-api/revisions/b17eccec9d47/schema)