Signal Score for Device Reference Guide

July 14, 2026 20:19

This guide outlines the key data points returned by the Signal Score for Device API, and categorizes the data into logical segments to help you understand how email addresses are evaluated for risk, trustworthiness, and identity verification.

Risk and Fraud Scoring

Real-time analysis of device risk, Card-Not-Present (CNP) fraud risks, and legitimacy scores.

Field Path	Type	Description
deviceSessionId	String (UUID)	A unique session event identifier generated by the data collector.
riskProfile	Object	Container summarizing the security posture of the session evaluated on a 0–100 scale.
riskProfile.riskScore	Float	Overall device/location risk evaluation score (0–100). Prioritizes Device Risk, falling back to Location Risk. Returns -1 if the session remains unevaluated.
riskProfile.cnpFraudScore	Float	Risk score (0–100) specifically tracking Card-Not-Present transaction fraud levels.
riskProfile.legitimacyScore	Float	Probability score (0–100) indicating the likelihood that the active session is safe and legitimate.
riskProfile.riskFactorCodes	Array [String]	Dynamic risk evaluation reason codes explaining what inputs influenced the final generation scores. See reference table below.

Risk Factor Codes

These dynamic indicators populate the riskFactorCodes array to provide clear business context for the transaction assessment.

sidebar. Risk Factor Codes table

Code	Evaluation Type	Definition
E001	Safe (Identity)	The identity element is verified as safe overall.
E002	Risk (Identity)	The identity element is identified as risky overall.
SF001	Trust Network	The identity element exists securely in the Global Identity Trust Network.
SF005	Validation	The identity element cleanly passes core syntax and registry validation checks.
SF010	Chargeback	The identity elements reflect a historically low risk for online transaction chargebacks.
SF011	Refund	The identity elements match patterns indicating low risk for malicious refund requests.
SF012	Review	Low operational risk profile; historically unlikely to require physical manual fraud agent review.
SF013	Policy	The session configuration safely aligns with default system business compliance policies.
SF014	Bank	Low-risk history; transaction is highly unlikely to face immediate issuer bank declines.
RF001	Trust Network	The current identity anchor is unrecognized and does not exist in the Global Identity Trust Network.
RF002	Trust Network	A mixed component or structural pairing of the identity elements is missing from the Global Trust Network.
RF003	Validation	A critical part of the supplied identity element profile is blank, malformed, or mislabeled.
RF004	Syntax/Pattern	The string payload components contain highly unrealistic or synthetic structural patterns.
RF005	Validation	The identity profile elements fail foundational validation compliance flags.
RF006	Syntax/Pattern	The metadata length metrics fall noticeably outside historical and standard system norms.
RF010	Chargeback	The associated identity profiles showcase a highly elevated risk trend for online transaction chargebacks.
RF011	Refund	Profile history indicates a high statistical probability of generating abusive online refunds.
RF012	Review	Elevated indicators signal a strong need for direct manual fraud analyst intervention.
RF013	Policy	Transaction attributes explicitly conflict with standard operating business policies.
RF014	Bank	Data signals match historically documented risk factors commonly triggering immediate issuer bank declines.

Identity Linkage

Uses email-based association to find related devices, helping you recognize users across different platforms or sessions.

Field Path	Type	Description
emailAddress	String	The primary customer identity anchor utilized for advanced cross-platform fuzzy matching algorithms.
deviceProfile.deviceStatus	Enum	Identifies system recognition tracking for the incoming hardware footprint. • NEW • EXISTING
deviceProfile.topMatchIdentityLinkage	Object	Fuzzy Logic Rule: This block returns null if the deviceStatus is EXISTING. If the status is NEW, it automatically populates only if a fuzzy match identity link is confirmed via email/PII logs.
deviceProfile.topMatchIdentityLinkage.linkageMethod	String	The descriptive data vector method utilized to map the devices together (for example, "Email-Based Association").
deviceProfile.topMatchIdentityLinkage.confidenceScore	Float	The relative matching integrity confidence percentage level (0–100).
deviceProfile.topMatchIdentityLinkage.deviceId	String	Unique identification string representing the historic matched hardware footprint destination.
deviceProfile.topMatchIdentityLinkage.dateFirstSeen	String	The precise timestamp when the historical matching device record was initially captured.
deviceProfile.topMatchIdentityLinkage.dateLastSeen	String	The precise timestamp when the historical matching device record was most recently active.

Bot versus Human Detection

Instantly identifies if the interaction is human-driven or an automated script.

Field Path	Type	Requirement	Description
deviceProfile.interactionSource	Enum	Optional	Behavioral heuristic category determining the operational driver of the application session. HUMAN (Standard organic human gestures/behavior) MACHINE (Automated script, emulation framework, or headless bot) UNKNOWN (Inconclusive data context)

Network and Geolocation

Precise IP intelligence, including VPN/Tor detection and city-level location accuracy.

Field Path	Type	Description
geolocation	Object	Structural metadata container tracking geographical coordinates and source resolution precision.
geolocation.sourceAnalysis	Object	Digital forensics layer tracking the origin extraction vector of the positional data.
geolocation.sourceAnalysis.locationDerivedFrom	Enum	Primary element utilized to establish current positioning context. DEVICE_IP_ADDRESS CLIENT_PROVIDED_IP_ADDRESS LOCATION_SERVICE
geolocation.sourceAnalysis.collectionService	Enum	The physical system framework engine capturing user location metrics. MOBILE_GPS \| MOBILE_CELL_TOWER MOBILE_LOCATION_SERVICE \| BROWSER_SERVICE
geolocation.accuracy	Object	Accuracy validation scoring metadata.
geolocation.accuracy.score	Float	Positional data integrity score spanning 0.0 (UNVERIFIABLE) to 100.0 (PINPOINT).
geolocation.accuracy.precisionLevel	Enum	Mapping resolution depth limit indicators. PINPOINT \| CITY \| COUNTRY GEO_REGION \| UNVERIFIABLE
geolocation.address	Object	Structured physical regional standard positioning values (city, stateProvince, stateCode, postalCode, country, countryCodeIso2, countryCodeIso3). Includes areaCode (US Phone regional codes).
geolocation.coordinates	Object	Mapping coordinates system object tracking exact latitude (-90 to 90) and longitude (-180 to 180).
networkIntelligence	Object	Infrastructure connection analysis reporting ISP properties and active proxy networks.
networkIntelligence.connection	Object	Context tracking carrier routing, ASN routing tags, and domain ownership. Includes ipAddress, provider, organization, and asn (Autonomous System Number).
networkIntelligence.connection.connectionType	String	The transport medium tier format verified (for example, "DSL", "Cable", "Cellular").
networkIntelligence.connection.topLevelDomain	String	The terminal domain segment extension (for example, "net", "com").
networkIntelligence.connection.secondLevelDomain	String	The parent organizational brand domain label (for example, "equifax").
networkIntelligence.infrastructure	Object	Classifications identifying the security environment state of the connecting node.
networkIntelligence.infrastructure.isProxy	Boolean	Returns true if network checks identify a proxy server, commercial VPN, or explicit internet relay point.
networkIntelligence.infrastructure.isHostingFacility	Boolean	Returns true if transaction packets originate from data center servers or commercial web host environments.
networkIntelligence.infrastructure.cpeNetworkType	Enum	Identifies restricted or special facility network infrastructure roots. None \| Prison \| Satellite Schools \| Libraries \| Anonymous
networkIntelligence.securityFlags	Object	Active tracking masks checking for masking environments, including isTorRelay (The Onion Router network) and isAppleRelay (iCloud Private Relay routing).

Device Fingerprinting

Detailed hardware and software profiling.

Field Path	Type	Description
deviceProfile	Object	The base profile container contains telemetry tracking hardware, browser properties, and collection states.
deviceProfile.deviceId	String	An authoritative hardware fingerprint platform token identifying the specific device (up to 32 characters).
deviceProfile.dateFirstSeen	String (ISO 8601)	Timestamp indicating when this exact system fingerprint profile was recorded in the database for the first time.
deviceProfile.dateLastSeen	String (ISO 8601)	Timestamp documenting the modern historical interaction update window for this device profile.
deviceProfile.deviceIntegrity	Enum	Telemetry validation checks inspecting the validity of the operational engine environment. REAL (Validated physical bare-metal hardware) FAKE (Virtual environment orchestration or system emulation) UNDETERMINED (Insufficient data validation metrics)
deviceProfile.isMobileDevice	Boolean	Returns true if data attributes confirm application generation occurred on a mobile platform (tablet/smartphone).
deviceProfile.mobileDeviceType	String	Detail string pinpointing the tracking implementation source framework (for example, "iOS App SDK").
deviceProfile.hardwareModel	String	The identifiable physical device model configuration string or active core engine version context.
deviceProfile.operatingSystem	String	Standard platform name identifier running on the host system hardware layer (e.g., "Mac OS X 10.15.7").
deviceProfile.browserLanguage	String	Standard localized UI internationalization code configuration setup (for example, "en-US").
deviceProfile.screenResolution	String	Hard-coded pixel layout configuration representation tracking width by height (for example, "1440x2560").
deviceProfile.systemTimezoneOffsets	Object	Timezone validation matrix tracing current, february, and august offsets relative to UTC to capture seasonal daylight savings variances.
deviceProfile.browserDetails	Object	Granular structural parsing values tracking the web application environment (userAgentString, applicationName, platform, osVersion).
deviceProfile.dataCollectionStatus	Object	Quality assurance layer verifying the performance of the remote client data capture components.
deviceProfile.dataCollectionStatus.sdkType	Enum	Native application target type utilized to pull execution metrics. WEB \| NATIVE_MOBILE_IOS NATIVE_MOBILE_ANDROID \| NON_SDK_BASED_COLLECTION
deviceProfile.dataCollectionStatus.sdkVersion	String	Detailed source compilation release version tag matching the tracking component.
deviceProfile.dataCollectionStatus.isCompleteCollection	Boolean	Returns true if all baseline client environment data blocks passed payload integrity transmission checks without dropouts.
deviceProfile.dataCollectionStatus.htmlCookieCollection	Boolean	Validates if the local transaction framework successfully achieved secure cookie generation and retrieval.
deviceProfile.dataCollectionStatus.javascriptCollection	Boolean	Validates if browser engine JavaScript scripts executed cleanly to fetch environmental telemetry parameters.

Was this article helpful?

0 out of 0 found this helpful