--- title: "Get transaction device detail" method: GET path: "/transactions/{transactionId}/devices" tags: ["Device Intelligence"] --- # Get transaction device detail `GET /transactions/{transactionId}/devices` ## Request - Base URL: `https://verification.trulioo.com` - URL: `https://verification.trulioo.com/transactions/{transactionId}/devices` - Auth: HTTP bearer Returns the current transaction-scoped device result for the authenticated organization. The response includes normalized device data, observed signals, and evaluation context. Poll this endpoint while it returns `202 Accepted`. When processing is complete, it returns `200 OK`. Source risk fields are normalized into the Trulioo `evaluation` returned by this API. Use `evaluation.riskBand` for programmatic categorization, `evaluation.riskLevel` for display text, and `evaluation.riskScore` for numeric ordering or comparison. Do not treat the normalized score as an unmodified source score. For compatibility, when an evaluation is present, `device.risk.riskScore` and `device.risk.riskLevel` repeat the corresponding public `evaluation` values; they are not separate raw source values. ## Path parameters - `transactionId` string, uuid, required ## Response `200` The latest device event has reached a terminal state. The response contains the current transaction-scoped device result. - TransactionDeviceResult: Transaction-scoped device detail for the authenticated organization. A `202 Accepted` response can contain an incomplete result: optional objects can be null and evaluation data can be incomplete. A `200 OK` response contains the latest terminal result, but optional device attributes can still be unavailable. - `transactionId` string, uuid, required: Transaction identifier. - `schemaFamily` 'DEVICE_INTELLIGENCE' | 'BEHAVIOR_BIOMETRICS', nullable: Normalized schema family for the selected device result. It is null when no device result has been classified. - `platform` 'ANDROID' | 'IOS' | 'WEB' | 'UNKNOWN', nullable: Normalized device platform. It is null when the platform is unknown or processing is incomplete. - `device` Device: Normalized device details. The available properties depend on the device platform and available result data. - `identity` object: Identity attributes for the normalized device. Individual attributes can be absent when unavailable. - `deviceId` string: Stable readable device identifier derived from the normalized fingerprint. - `packageName` string: Application package or bundle identifier reported by the device, when available. - `model` string: Device model, when available. - `classification` object: Source classification values retained for diagnostic detail. Keys and values can vary by device platform and available result data. - `risk` object: Source risk and confidence values retained for diagnostic detail. Do not use these fields for Trulioo risk decisions; use the normalized top-level `evaluation` instead. - `network` object: Source network and geolocation details for the device event. Keys and availability vary by device platform and available result data. - `history` object - `createdAt` integer, nullable: Creation time in epoch milliseconds. - `timestamp` integer, nullable: Event time in epoch milliseconds. - `factoryResetRisk` string: Factory-reset risk classification, when available. This is an individual history signal, not the aggregate Trulioo risk band. - `factoryResetTime` integer, nullable: Factory-reset time as Unix epoch milliseconds, when available. - `firstSeenDays` integer, nullable: Number of days since the device was first observed, when available. - `totalUniqueUserId` integer, nullable: Number of distinct user identifiers associated with the device, when available. It is context only and does not alter the aggregate Trulioo risk evaluation by itself. - `environmentSignals` object: Source environment-related signals. Keys and values vary by device platform and available result data. - `mobileSignals` object, nullable: Source mobile-device signals. Null when the result is not mobile or no mobile signals are available. - `webSignals` object, nullable: Source web-device signals. Null when the result is not web or no web signals are available. - `behaviouralSignals` object: Source behavioural signals. They can support insights but do not independently replace the aggregate evaluation. - `signals` object[]: Source signal objects retained for diagnostic detail. Prefer top-level `signals` and `insights` for client rendering. - `signals` Signal[], required: Observed and derived signal values for the selected result. The array can be empty while processing is incomplete or when no signals were produced. - `name` string, required: Stable signal name that identifies the observation. - `category` string, required: Analyst-facing grouping for the signal. - `label` string, required: Short client-facing label for the signal. - `valueType` 'BOOLEAN' | 'STRING' | 'NUMBER' | 'INTEGER' | 'TIMESTAMP' | 'STRING_LIST' | 'BOOLEAN_LIST' | 'OBJECT', required: Expected JSON shape of the signal value. - `value` union: Raw normalized signal value. Its JSON shape corresponds to `valueType`: boolean, string, number, integer, epoch-millisecond timestamp, string array, boolean array, object, or null. - string, nullable - number, nullable - integer, nullable - boolean, nullable - string[], nullable - boolean[], nullable - object, nullable - `signalKey` string, required: Stable machine-readable signal identifier. - `result` string, required: Rendered outcome for this individual signal. Possible values depend on `signalKey`; do not infer it from aggregate risk. - `insight` string, required: Short explanatory text for this individual signal. - `state` 'RISK' | 'NO_RISK' | 'NOT_RUN', required: Normalized tri-state outcome for this individual signal. It is independent of the aggregate risk band. - `insights` Insight[], required: Client-ready explanations of individual signals. Render each insight using its own `state` and `result`, not the aggregate risk evaluation. - `signal` string, required: Stable machine-readable signal identifier that produced this insight. - `category` string, required: Analyst-facing grouping for the insight. - `label` string, required: Short client-facing label for the insight. - `result` string, required: Rendered outcome for this insight. Possible values depend on `signal`. - `insight` string, required: Short explanation of why this insight was produced. - `state` 'RISK' | 'NO_RISK' | 'NOT_RUN', required: Normalized tri-state outcome for this insight. It is independent of aggregate risk. - `evaluation` Evaluation: Canonical Trulioo aggregate device-risk evaluation, derived from source risk fields. Overall `riskScore` and `riskLevel` are selected first; `deviceRiskScore` and `deviceRiskLevel` are used only when the overall pair is absent. `riskBand` is the authoritative machine classification, `riskLevel` is the associated display label, and `riskScore` is the normalized numeric value. For completed evaluations, scores 5 through 59 map to `LOW`, 60 through 84 map to `MEDIUM`, and 85 through 95 map to `HIGH_RISK`. `NOT_RUN` and `RUN` are processing-state categories and must not be inferred from the numeric score alone. - `riskScore` number, double, required: Canonical client-facing Trulioo risk score. It is normalized from the selected source input, clamped to 5 through 95, and increases with risk. Use it for numeric ordering, comparison, and score thresholds; use `riskBand` for categorical logic. - `riskLevel` 'Not Run' | 'Run' | 'Low Risk' | 'Medium Risk' | 'High Risk', required: Human-readable label for `riskBand`, intended for display. Do not use it as the primary programmatic category. - `decision` string, nullable: Optional decision derived from device intelligence. It is separate from the risk category and can be absent when no device decision was produced. - `riskBand` 'NOT_RUN' | 'RUN' | 'LOW' | 'MEDIUM' | 'HIGH_RISK', required: Authoritative normalized machine-readable risk category. Read this before `riskLevel` or `riskScore` for categorical behavior. - `riskReasons` string[], required: Human-readable reasons that contributed to the aggregate evaluation. The array is empty when no reasons were recorded; reason text is not a stable enum. - `complete` boolean, required: Whether the selected risk evaluation completed. If false, treat the evaluation as pending or unavailable rather than interpreting an absent or default score as low risk. - `association` Association: Association summary for the normalized device identity across the authenticated organization's transaction history. - `deviceId` string, required: Stable readable device identifier for the association. - `transactionIds` string[], required: Transaction identifiers associated with this device. The selected transaction is included when an association is available. - `eventCount` integer, required: Number of device-intelligence events observed for this device association. - `deviceCount` integer, required: Number of distinct normalized device identities in this association. A non-blank fingerprint normally produces one device identity. - `reference` ReferenceData, required: Reference fields captured alongside the device event. Field names and values depend on the submission; clients must tolerate empty arrays and unknown object properties. - `subject` object[], required: Subject reference fields captured with the device event. - `basicInformation` object[], required: Device and basic-information reference fields captured with the device event. ## Other responses - `202`: The latest device event is queued or running. The body can contain partial device context, but it must not be treated as a completed risk evaluation. Wait for the number of seconds in `Retry-After`, then call this endpoint again. - `400`: The request is invalid, or Device Intelligence is not enabled for the transaction's organization. - `401`: The bearer token is missing, invalid, or expired. - `404`: The transaction does not exist for the authenticated organization, or it has no device result. --- [API](https://skmtc.dev/trulioo/apis/device-intelligence-reference.md) - [All operations](https://skmtc.dev/trulioo/apis/device-intelligence-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/trulioo/apis/device-intelligence-reference/revisions/95752574f81c?raw)