Fingerprint

Get an event by event ID

Get a detailed analysis of an individual identification event, including Smart Signals.

Use event_id as the URL path parameter. This API method is scoped to a request, i.e. all returned information is by event_id.

get/events/{event_id}

Request

  • Base URL: https://api.fpjs.io/v4
  • URL: https://api.fpjs.io/v4/events/{event_id}
  • Auth: HTTP bearer

Path parameters

event_idstring required
Example:1708102555327.NLOjmg

The unique identifier of each identification request (requestId can be used in its place).

Query parameters

ruleset_idstring
Example:D6N9Kbk9HRWrIWGz

The ID of the ruleset to evaluate against the event, producing the action to take for this event. The resulting action is returned in the rule_action attribute of the response.

Response

OK.

event_idstring required

Unique identifier of the user's request. The first portion of the event_id is a unix epoch milliseconds timestamp.

timestampinteger required

Timestamp of the event with millisecond precision in Unix time.

source'device' | 'edge'

Identifies how the event was generated.

  • device - the event was generated by the JS agent or a mobile SDK running on an end-user device.
  • edge - the event was generated by the Automation Intelligence API (/edge endpoint), analyzing a request intercepted at the edge.
incremental_identification_status'partially_completed' | 'completed'

Only included for requests using incremental identification.

  • partially_completed - Indicates this event corresponds to a 'minimal' request. Smart Signals, even if included in your plan, are not computed; hence, their values must be ignored.
  • completed - Indicates this event corresponds to a 'complete' request. Smart Signals, if included in your plan, are computed; hence, their values are valid and relevant.
linked_idstring

A customer-provided ID that was sent with the request.

environment_idstring

Environment ID of the event.

suspectboolean

Field is true if you have previously set the suspect flag for this event using the Server API Update event endpoint.

replayedboolean

true if we determined that this payload was replayed, false otherwise.

tagsTags

A customer-provided value or an object that was sent with the identification request or updated later.

urlstring

Page URL from which the request was sent.

bundle_idstring

Bundle ID of the iOS application integrated with the Fingerprint SDK for the event.

package_namestring

Package name of the Android application integrated with the Fingerprint SDK for the event.

ip_addressstring

IP address of the requesting browser or bot.

user_agentstring

User Agent of the client.

devicestring

Device model or family extracted from the user agent string. On web, this field is also present inside browser_details.

osstring

Operating system family extracted from the user agent string. On web, this field is also present inside browser_details.

os_versionstring

Operating system version string extracted from the user agent string. On web, this field is also present inside browser_details.

client_referrerstring

Client Referrer field corresponds to the document.referrer field gathered during an identification request. The value is an empty string if the user navigated to the page directly (not through a link, but, for example, by using a bookmark).

active_callboolean

Indicates whether the mobile device had an active call (cellular or VoIP) at the time of the request. Available from SDK 2.16.0+ on iOS and Android.

bot'bad' | 'good' | 'not_detected'

Bot detection result:

  • bad - bad bot detected, such as Selenium, Puppeteer, Playwright, headless browsers, and so on
  • good - good bot detected, such as Google bot, Baidu Spider, AlexaBot and so on
  • not_detected - the visitor is not a bot
bot_typestring

Additional classification of the bot type if detected.

cloned_appboolean

Android specific cloned application detection. There are 2 values:

  • true - Presence of app cloners work detected (e.g. fully cloned application found or launch of it inside of a not main working profile detected).
  • false - No signs of cloned application detected or the client is not Android.
developer_toolsboolean

true if the browser has DevTools open (Chrome, Firefox) or the Android/iOS device has Developer Tools enabled, false otherwise.

emulatorboolean

Android specific emulator detection. There are 2 values:

  • true - Emulated environment detected (e.g. launch inside of AVD).
  • false - No signs of emulated environment detected or the client is not Android.
factory_reset_timestampinteger

The time of the most recent factory reset that happened on the mobile device is expressed as Unix epoch time. When a factory reset cannot be detected on the mobile device or when the request is initiated from a browser, this field will correspond to the epoch time (i.e 1 Jan 1970 UTC) as a value of 0. See Factory Reset Detection to learn more about this Smart Signal.

fridaboolean

Frida detection for Android and iOS devices. There are 2 values:

  • true - Frida detected
  • false - No signs of Frida or the client is not a mobile device.
proxyboolean

IP address was used by a public proxy provider or belonged to a known recent residential proxy

proxy_confidence'low' | 'medium' | 'high'

Confidence level of the proxy detection. If a proxy is not detected, confidence is "high". If it's detected, can be "low", "medium", or "high".

proxy_ml_scorenumber double

Machine learning–based proxy score, represented as a floating-point value between 0 and 1 (inclusive), with up to three decimal places of precision. A higher score means a higher confidence in the positive proxy detection result. This Smart Signal is currently in beta and only available to select customers. If you are interested, please contact our support team.

incognitoboolean

true if we detected incognito mode used in the browser, false otherwise.

jailbrokenboolean

iOS specific jailbreak detection. There are 2 values:

  • true - Jailbreak detected.
  • false - No signs of jailbreak or the client is not iOS.
location_spoofingboolean

Flag indicating whether the request came from a mobile device with location spoofing enabled.

mitm_attackboolean
  • true - When requests made from your users' mobile devices to Fingerprint servers have been intercepted and potentially modified.
  • false - Otherwise or when the request originated from a browser. See MitM Attack Detection to learn more about this Smart Signal.
privacy_settingsboolean

true if the request is from a privacy aware browser (e.g. Tor) or from a browser in which fingerprinting is blocked. Otherwise false.

root_appsboolean

Android specific root management apps detection. There are 2 values:

  • true - Root Management Apps detected (e.g. Magisk).
  • false - No Root Management Apps detected or the client isn't Android.
simulatorboolean

iOS specific simulator detection. There are 2 values:

  • true - Simulator environment detected.
  • false - No signs of simulator or the client is not iOS.
suspect_scoreinteger

Suspect Score is an easy way to integrate Smart Signals into your fraud protection work flow. It is a weighted representation of all Smart Signals present in the payload that helps identify suspicious activity. The value range is [0; S] where S is sum of all Smart Signals weights. See more details here: https://docs.fingerprint.com/docs/suspect-score

tamperingboolean

The field can be used as a standalone flag for tampering detection. Alternatively, the more granular fields documented below can be used for workflows that require more context.

  • true if tampering is detected through an anomalous browser signature, anti-detect browser detection, or other tampering-related methods
  • false if none of the tampering checks return a positive result
tampering_confidence'low' | 'medium' | 'high'

The confidence level indicates how certain Fingerprint is that the current request involves browser tampering. This confidence level is determined by evaluating multiple factors, such as heuristic rules, probabilistic anomaly detection, an anti detect browser ml model, and other relevant methods. It is conveyed as a string with possible values such as high, medium, or low In case of tampering: true

  • High confidence: heuristic anti detect browser signals and the ml model are triggered, or all of the methods are triggered.
  • Medium confidence: either the ml model triggers alone, the anomaly score triggers alone with or without the heuristic anti detect browser methods trigger.
  • Low confidence: only the heuristic anti detect methods are triggered.

In case of tampering: false

  • High confidence: Strong signals suggest the user is not tampering with their request.
tampering_ml_scorenumber double

The output of this model is captured as tampering_ml_score, a number indicating how likely an event is coming from an anti detect browser. Values close to 1 signify higher confidence and we consider anything above the threshold of 0.8 to be actionable (the result and anti_detect_browser fields conveniently captures that fact)

virtual_machineboolean

true if the request came from a browser running inside a virtual machine (e.g. VMWare), false otherwise.

virtual_machine_ml_scorenumber double

Machine learning–based virtual machine score, represented as a floating-point value between 0 and 1 (inclusive), with up to three decimal places of precision. A higher score means a higher confidence in the positive virtual_machine detection result. This Smart Signal is currently in beta and only available to select customers. If you are interested, please contact our support team.

vpnboolean

VPN or other anonymizing service has been used when sending the request.

vpn_confidence'low' | 'medium' | 'high'

A confidence rating for the VPN detection result — "low", "medium", or "high". Depends on the combination of results returned from all VPN detection methods.

vpn_ml_scorenumber double

Machine learning–based VPN score, represented as a floating-point value between 0 and 1 (inclusive), with up to three decimal places of precision. A higher score means a higher confidence in the positive vpn detection result. This Smart Signal is currently in beta and only available to select customers. If you are interested, please contact our support team.

vpn_origin_timezonestring

Local timezone which is used in timezone_mismatch method.

vpn_origin_countrystring

Country of the request (Android SDK version >= 2.4.0, iOS SDK version >= 2.9.0, JS agent >= 3.12.9 / 4.0.2), ISO 3166 format or unknown.

high_activity_deviceboolean

Flag indicating if the request came from a high-activity visitor.

rare_deviceboolean

true if the device is considered rare based on its combination of hardware and software attributes. A device is classified as rare if it falls within the top 99.9 percentile (lowest-frequency segment) of observed traffic, or if its configuration has not been previously seen (not_seen).

This Smart Signal is currently in beta and only available to select customers. If you are interested, please contact our support team.

rare_device_percentile_bucket'<p95' | 'p95-p99' | 'p99-p99.5' | 'p99.5-p99.9' | 'p99.9+' | 'not_seen'

The rarity percentile bucket of the device, indicating how uncommon the device configuration is compared to all observed devices.

This Smart Signal is currently in beta and only available to select customers. If you are interested, please contact our support team.

Example response

{
  "event_id": "1708102555327.NLOjmg",
  "timestamp": 1708102555327,
  "linked_id": "somelinkedId",
  "environment_id": "ae_47abaca3db2c7c43",
  "sdk": {
    "version": "3.11.10",
    "integrations": [
      {
        "name": "fingerprint-pro-react",
        "version": "3.11.10",
        "subintegration": {
          "name": "preact",
          "version": "10.21.0"
        }
      }
    ]
  },
  "identification": {
    "visitor_id": "Ibk1527CUFmcnjLwIs4A9",
    "confidence": {
      "score": 0.97,
      "version": "1.1",
      "comment": "Low confidence due to bot signals"
    },
    "first_seen_at": 1708102555327,
    "last_seen_at": 1708102555327
  },
  "supplementary_id_high_recall": {
    "visitor_id": "0jnGMkPYXX37DqVa4ZIO3f_hr",
    "confidence": {
      "score": 0.97,
      "version": "1.1",
      "comment": "Low confidence due to bot signals"
    },
    "first_seen_at": 1778086556130,
    "last_seen_at": 1778604975494
  },
  "url": "https://www.example.com/login",
  "bundle_id": "com.foo.app",
  "package_name": "com.foo.app",
  "ip_address": "61.127.217.15",
  "user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) ....",
  "device": "Generic Smartphone",
  "os": "Windows",
  "os_version": "17.4",
  "client_referrer": "https://example.com/blog/my-article",
  "browser_details": {
    "browser_name": "Chrome",
    "browser_major_version": "74",
    "browser_full_version": "74.0.3729",
    "os": "Windows",
    "os_version": "7",
    "device": "Other"
  },
  "proximity": {
    "id": "w1aTfd4MCvl",
    "confidence": 0.95
  },
  "bot_type": "chatgpt_agent",
  "bot_info": {
    "provider": "Anthropic",
    "provider_url": "https://chatgpt.com",
    "name": "ClaudeBot"
  },
  "device_details": {
    "device_manufacturer": "samsung",
    "device_model": "SM-G991U",
    "os_version": "9"
  },
  "factory_reset_timestamp": 1708102555327,
  "ip_info": {
    "v4": {
      "address": "94.142.239.124",
      "geolocation": {
        "accuracy_radius": 20,
        "latitude": 50.05,
        "longitude": 14.4,
        "postal_code": "150 00",
        "timezone": "Europe/Prague",
        "city_name": "Prague",
        "country_code": "CZ",
        "country_name": "Czechia",
        "continent_code": "EU",
        "continent_name": "Europe",
        "subdivisions": [
          {
            "iso_code": "10",
            "name": "Hlavni mesto Praha"
          }
        ]
      },
      "asn": "396982",
      "asn_name": "Google LLC",
      "asn_network": "34.160.0.0/12",
      "asn_type": "hosting",
      "datacenter_name": "Google Cloud"
    },
    "v6": {
      "address": "2001:db8:3333:4444:5555:6666:7777:8888",
      "geolocation": {
        "accuracy_radius": 20,
        "latitude": 50.05,
        "longitude": 14.4,
        "postal_code": "150 00",
        "timezone": "Europe/Prague",
        "city_name": "Prague",
        "country_code": "CZ",
        "country_name": "Czechia",
        "continent_code": "EU",
        "continent_name": "Europe",
        "subdivisions": [
          {
            "iso_code": "10",
            "name": "Hlavni mesto Praha"
          }
        ]
      },
      "asn": "396982",
      "asn_name": "Google LLC",
      "asn_network": "2001:4860:4801:10::/64",
      "asn_type": "hosting",
      "datacenter_name": "Google Cloud"
    }
  },
  "proxy_details": {
    "last_seen_at": 1708102555327,
    "provider": "Massive"
  },
  "proxy_ml_score": 0.2,
  "rule_action": {
    "ruleset_id": "rs_b1k1blhqpOX3kU",
    "rule_id": "r_uE0af8497PFAOD",
    "rule_expression": "bot in [\"bad\"] || incognito",
    "request_header_modifications": {
      "remove": [
        "X-Forwarded-For"
      ],
      "set": [
        {
          "name": "Content-Type",
          "value": "application/json"
        }
      ],
      "append": [
        {
          "name": "Content-Type",
          "value": "application/json"
        }
      ]
    }
  },
  "suspect_score": 8,
  "tampering_ml_score": 0.5,
  "tampering_details": {
    "anomaly_score": 0.5
  },
  "velocity": {
    "distinct_ip": {
      "5_minutes": 1,
      "1_hour": 5,
      "24_hours": 5
    },
    "distinct_linked_id": {
      "5_minutes": 1,
      "1_hour": 5,
      "24_hours": 5
    },
    "distinct_country": {
      "5_minutes": 1,
      "1_hour": 5,
      "24_hours": 5
    },
    "events": {
      "5_minutes": 1,
      "1_hour": 5,
      "24_hours": 5
    },
    "ip_events": {
      "5_minutes": 1,
      "1_hour": 5,
      "24_hours": 5
    },
    "distinct_ip_by_linked_id": {
      "5_minutes": 1,
      "1_hour": 5,
      "24_hours": 5
    },
    "distinct_visitor_id_by_linked_id": {
      "5_minutes": 1,
      "1_hour": 5,
      "24_hours": 5
    }
  },
  "virtual_machine_ml_score": 0.5,
  "vpn_ml_score": 0.2,
  "vpn_origin_timezone": "Europe/Berlin",
  "vpn_origin_country": "DE",
  "raw_device_attributes": {
    "font_preferences": {
      "default": 147.5625,
      "serif": 147.5625,
      "sans": 144.015625,
      "mono": 133.0625,
      "apple": 147.5625,
      "min": 9.234375,
      "system": 146.09375
    },
    "emoji": {
      "font": "Times",
      "width": 1600,
      "height": 18,
      "top": 14,
      "bottom": 32,
      "left": 8,
      "right": 1608,
      "x": 8,
      "y": 14
    },
    "fonts": [
      "Arial Unicode MS",
      "Gill Sans",
      "Helvetica Neue",
      "Menlo"
    ],
    "device_memory": 8,
    "timezone": "America/Sao_Paulo",
    "canvas": {
      "geometry": "db3c1462576a399a03ae93d0ab9eb5c4",
      "text": "70c3d3f7eb4408dc37a6bf8af1c51029"
    },
    "languages": [
      [
        "en-US"
      ]
    ],
    "webgl_extensions": {
      "context_attributes": "6b1ed336830d2bc96442a9d76373252a",
      "parameters": "ea118c48e308bc4b0677118bbb3019ec",
      "shader_precisions": "f223dfbcd580cf142da156d93790eb83",
      "extensions": "57233d7b10f89fcd1ff95e3837ccd72d",
      "extension_parameters": "86a8abb36f0cb30b5946dec0c761d042",
      "unsupported_extensions": [
        "WEBGL_compressed_texture_s3tc_srgb"
      ]
    },
    "webgl_basics": {
      "version": "WebGL 1.0 (OpenGL ES 2.0 Chromium)",
      "vendor": "WebKit",
      "vendor_unmasked": "Google Inc. (Apple)",
      "renderer": "WebKit WebGL",
      "renderer_unmasked": "ANGLE (Apple, ANGLE Metal Renderer: Apple M4, Unspecified Version)",
      "shading_language_version": "WebGL GLSL ES 1.0 (OpenGL ES GLSL ES 1.0 Chromium)"
    },
    "screen_resolution": [
      1920
    ],
    "oscpu": "Windows NT 6.1; Win64; x64",
    "architecture": 127,
    "hardware_concurrency": 10,
    "date_time_locale": "en-US",
    "vendor": "Google Inc.",
    "color_depth": 24,
    "platform": "MacIntel",
    "audio": 124.04347745512496,
    "plugins": [
      {
        "name": "PDF Viewer",
        "description": "Portable Document Format",
        "mimeTypes": [
          {
            "type": "application/pdf",
            "suffixes": "pdf",
            "description": "Portable Document Format"
          }
        ]
      }
    ],
    "math": "5f030fa7d2e5f9f757bfaf81642eb1a6",
    "device_model": "iPhone 15 Pro",
    "device_manufacturer": "Apple",
    "font_hash": "e9f96f6c0e2c0b3a7a8b1d2c3e4f5a6b",
    "timezone_offset": "+02:00",
    "battery_level": 75,
    "keyboard_layout_hash": "3f33b68235d36b8821147349f1161379",
    "keyboard_layout_name": "en-US"
  },
  "labels": [
    {
      "label": "automation_tool",
      "ml_score": 0.95
    }
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.