--- title: "Lookup" method: POST path: "/v1/fingerprint/lookup" tags: ["Fraud"] --- # Lookup `POST /v1/fingerprint/lookup` ## Request - Base URL: `https://telemetry.stytch.com` - URL: `https://telemetry.stytch.com/v1/fingerprint/lookup` - Auth: HTTP basic Lookup the associated fingerprint for the `telemetry_id` returned from the `GetTelemetryID()` function. Learn more about the different fingerprint types and verdicts in our [DFP guide](https://stytch.com/docs/fraud/guides/device-fingerprinting/overview). You can make a decision based on the recommended `verdict` in the response: * `ALLOW` - This is a known valid device grouping or device profile that is part of the default `ALLOW` listed set of known devices by Stytch. This grouping is made up of verified device profiles that match the characteristics of known/authentic traffic origins. * `BLOCK` - This is a known bad or malicious device profile that is undesirable and should be blocked from completing the privileged action in question. * `CHALLENGE` - This is an unknown or potentially malicious device that should be put through increased friction such as 2FA or other forms of extended user verification before allowing the privileged action to proceed. If the `telemetry_id` is expired or not found, this endpoint returns a 404 `telemetry_id_not_found` [error](https://stytch.com/docs/fraud/api/errors/404#telemetry_id_not_found). We recommend treating 404 errors as a `BLOCK`, since it could be a sign of an attacker trying to bypass DFP protections. See [Attacker-controlled telemetry IDs](https://stytch.com/docs/fraud/guides/device-fingerprinting/integration-steps/test-your-integration#attacker-controlled-telemetry-ids) for more information. ## Request body - ApiFraudV1FraudFingerprintLookupRequest: Request type - `telemetry_id` string, required: The telemetry ID associated with the fingerprint getting looked up. - `external_metadata` ApiFraudV1Metadata - `external_id` string: An external ID, such as a user ID, that you wish to associate with the telemetry ID. - `organization_id` string: The organization ID you wish to associate with the telemetry ID. - `user_action` string: The user action, such as 'login', that you wish to associate with the telemetry ID. ## Response `200` Successful response - ApiFraudV1FraudFingerprintLookupResponse - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue. - `telemetry_id` string, required: The telemetry ID associated with the fingerprint getting looked up. - `fingerprints` ApiFraudV1Fingerprints, required - `network_fingerprint` string, required: Combination of signals associated with a specific network commonly known as TLS fingerprinting. - `hardware_fingerprint` string, required: Combinations of signals to identify an operating system and architecture. - `browser_fingerprint` string, required: Combination of signals to identify a browser and its specific version. - `visitor_fingerprint` string, required: Cookie-less way of identifying a unique user. - `visitor_id` string: The cookie stored on the user's device that uniquely identifies them. - `browser_id` string: Combination of VisitorID and NetworkFingerprint to create a clear identifier of a browser. - `verdict` ApiFraudV1Verdict, required - `action` 'ALLOW' | 'CHALLENGE' | 'BLOCK', required - `reasons` string[], required: A set of contextual clues to inform why a `CHALLENGE` or `BLOCK` action was suggested. For a list of possible Reasons, see [Warning Flags (Verdict Reasons)](https://stytch.com/docs/docs/fraud/guides/device-fingerprinting/reference/warning-flags-verdict-reasons). - `detected_device_type` string, required: The operating system and architecture that took the fingerprint. - `is_authentic_device` boolean, required: The assessment of whether this is an authentic device. It will be false if hardware or browser deception is detected. - `verdict_reason_overrides` ApiFraudV1VerdictReasonOverride[], required: A list of verdict reason overrides that were applied, if any. - `verdict_reason` string, required: The verdict reason that was overridden. - `override_action` 'ALLOW' | 'CHALLENGE' | 'BLOCK', required - `rule_match_type` 'VISITOR_ID' | 'BROWSER_ID' | 'VISITOR_FINGERPRINT' | 'BROWSER_FINGERPRINT' | 'HARDWARE_FINGERPRINT' | 'NETWORK_FINGERPRINT' | 'CIDR_BLOCK' | 'ASN' | 'COUNTRY_CODE' - `rule_match_identifier` string: The rule that was applied (e.g. a specific visitor ID value), if any. This field will only be present if there is a `RULE_MATCH` reason in the list of verdict reasons. - `external_metadata` ApiFraudV1Metadata, required - `external_id` string: An external ID, such as a user ID, that you wish to associate with the telemetry ID. - `organization_id` string: The organization ID you wish to associate with the telemetry ID. - `user_action` string: The user action, such as 'login', that you wish to associate with the telemetry ID. - `created_at` string, required: The time when the fingerprint was taken. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`. - `expires_at` string, required: The timestamp when the fingerprint expires. Values conform to the RFC 3339 standard and are expressed in UTC, e.g. `2021-12-29T12:33:09Z`. - `status_code` integer, required: The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors. - `properties` ApiFraudV1Properties - `network_properties` ApiFraudV1NetworkProperties, required - `ip_address` string, required: The IP address of the client. - `asn` ApiFraudV1ASNProperties, required - `asn` string, required: The Autonomous System Number of the user's network. - `name` string, required: Public name associated with the ASN. - `network` string, required: The CIDR block associated with the ASN. - `ip_geolocation` ApiFraudV1IPGeoProperties, required - `city` string, required: The city where the IP is located. - `region` string, required: The region where the IP is located. - `country` string, required: The country where the IP is located. - `is_proxy` boolean, required: Whether the user is using a proxy. - `is_vpn` boolean, required: Whether the user is using a VPN. - `browser_properties` ApiFraudV1BrowserProperties, required - `user_agent` string, required: The user agent of the user's browser. - `raw_signals` object: The raw device attributes, such as screen size, that were collected by the Device Fingerprinting product to generate the fingerprints and verdict. You must be specifically enabled for the raw signals feature to see this field. You can find documentation for the specific fields in the [guides](https://stytch.com/docs/fraud/guides/device-fingerprinting/reference/raw-signals). ## Other responses - `400`: Bad request - `401`: Unauthorized - `429`: Too Many Requests - `500`: Internal server error ## Changes - **2026-03-07** `110f26a94e5b`: 1 info - endpoint added - **2026-03-06** `9cab20b8eca7`: 1 breaking - api path removed without deprecation - **2026-01-09** `7dfcc14e566c`: 1 breaking - the `raw_signals` response's property type changed from `string` to `object` for status `200` - **2025-09-24** `d1a2040cf009`: 1 info - added the optional property `raw_signals` to the response with the `200` status - **2025-09-17** `8270cf3a3d4c`: 3 info - added the media type `application/json` for the response with the status `401` - added the media type `application/json` for the response with the status `500` - added the non-success response with the status `429` [Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/fingerprint/lookup/post.md) --- [API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)