Session Details

This section constitutes the basic session level details such as challenge details, pressure levels, whether the attacker surpassed basic defenses, etc.

Field Name	Description	Example Values	Applicable Product
`solved`	When a session's risk level does not qualify it for transparent mode (no challenge) it is shown an interactive challenge. In that case, this field's value indicates if the challenge was successfully solved or not. If it was in transparent mode, the field value for a valid session is `true`.	`true`, `false`	Arkose Protect
`session`	A unique token for the Arkose Labs session. A session is the whole experience from solution load to verification.	A unique token, e.g. `3595d2c014d3c5f01.1116018803`, or `null`	Arkose Detect Arkose Protect
`session_created`	An ISO 8601 UTC timestamp signifying the time the session was created	e.g. `2019-07-15T02:45:13+00:00`, or `null`	Arkose Detect Arkose Protect
`check_answer`	An ISO 8601 UTC timestamp signifying the time that the Enforcement Challenge user supplied answered were evaluated	e.g. `2019-07-15T02:45:13+00:00`, or `null`	Arkose Protect
`verified`	An ISO 8601 UTC timestamp signifying the time that the request to the verify endpoint was made.	e.g. 2019-07-15T02:45:13+00:00	Arkose Detect Arkose Protect
`attempted`	Whether the user attempted to solve the Enforcement Challenge, or not.	`true`, `false`	Arkose Protect
`security_level`	A number that indicates the security level used for this session. Be aware that `security_level` can have a null value - usually because the session was an audio mode session. Audio mode does not use `security_level`.	A security level, e.g. `20`	Arkose Protect
`session_is_legit`	Indicates if Arkose Labs certifies there are no telltales of non-legitimate activity in the session.	`true`, `false`	Arkose Detect Arkose Protect
`previously_verified`	Indicates if a session has already been verified	`true`, false	Arkose Detect Arkose Protect
`session_timed_out`	Indicates if a session timed out before it was solved	`true`, `false`	Arkose Detect Arkose Protect
`suppress_limited`	Indicates if the session qualified for low security, but failed verification. Low security is when a session has qualified to run in transparent mode, or use a no wrong answer enforcement challenge, such as the pick your favorite color challenge.	`true`, false	Arkose Protect
`theme_arg_invalid`	Whether the theme arg setting at verification matched the original theme arg passed in at session setup. A theme arg is a parameter passed by a customer to Arkose Labs. It requests a security tier or UX test mode.	`true`, `false`	Arkose Protect
`suppressed`	Suppressed is the old name for transparent mode. This field shows if the the user was offered transparent mode.	`true`, `false`	Arkose Protect
`punishable_actioned`	Punishable is an attack mitigation tactic, which randomly fails verification attempts, even if the response was correct. This field indicates if punishable was activated.	`true`, `false`	Arkose Protect
`telltale_user`	UID for a combination of telltales that identify a particular bad user or organization.	A string such as `999b-fwh`, or `null`	Arkose Detect Arkose Protect
`failed_low_sec_validation`	Indicates that the intention was to offer the user a low security session, but they failed to qualify for it when the verification was attempted.	`true`, `false`	Arkose Protect
`lowsec_error`	An identifier showing why a user was denied a low security session.	`"user_credits"`, `"rate_limit_local"`, `"validation_checks"`, `"rate_limit_global"`, or `null`	Arkose Detect Arkose Protect
`lowsec_level_denied`	The low security level that was denied to the user.	A security level, e.g. `5`	Arkose Detect Arkose Protect
`ua`	The User Agent string for the user that interacted with the EC.	`"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36“`	Arkose Detect Arkose Protect
`ip_rep_list`	An identifier which specifies which IP reputation database this IP address has been seen at.	`"tor"`, `"sfs_tor"`, `"sfs"`, or `null`	Arkose Detect Arkose Protect
`optional`	An object containing optional return values such as `client_encrypted_mode_key` or `get_pass values`. Also, relevant data being sent to Arkose Labs via our accepted methods (see: Data Exchange (Requires Support login)) appears in this object. The specific keys and values inside this object vary based on implementation	`{"blob": "lHpwagBqx3JOI7t9Ka0KUdIeHZbIjAYPPB72k Du2Zb5BwNiC6qJx5gS0f5c3EzcZ9d"}`, or null	Arkose Detect Arkose Protect
`game_number_limit_reached`	Game number limit is an optional setting that restricts the number of attempts a user can have at solving the EC. This field can show if the user reached the number of attempts allowed.	`true`, `false`	Arkose Protect
`user_language_shown`	Shows the language code of the language in which the challenge was presented to the user.	A string such as `“en“` or `null`	Arkose Protect
`telltale_list`	The list of telltales that were identified as possible candidates during a session.	A string e.g. `"999b-fwh"`, or `null`	Arkose Detect Arkose Protect
`device_id` [Early Access]	Note: You must request that Arkose turn on `device_id` for your account. Otherwise, its value will always be `null` `device_id` can identify changes a user's device if those two devices are distinguishable based on collected fingerprints. `device_id` isn't comprised of uniquely identifiable attributes and so can't be used for situations when, for example, a user switched from one iPhone 14 to another while keeping all the settings the same.	A `string` containing a hash value or `null`
`challenge_type`	The type of challenge that the end-user solved.	A string e.g. `"audio"`, `"transparent"`, `"visual"` or `null`	Arkose Detect Arkose Protect

User Preference Field

This field contains information about the session set by its user.

Field Name	Description	Example Values	Applicable Product
`timezone_offset`	The timezone offset from UTC.	e.g. `1000` or `null`	Arkose Detect Arkose Protect

Session Risk

This section provides the Arkose Risk Score and the associated telltales (or reason codes) that led to the risk score.

Field Name	Description	Values	Applicable Product
`session_risk`	An object containing all risk score information and conclusions.	Made up of the following subfields.

session_risk Subfields

Subfield Name	Description	Values
`risk_category`	Name of the risk category determined by the session's risk score.	One of `"BOT-STD"` (standard botnet), `"BOT-ADV"` (advanced botnet), `"FRD-FRM"` (fraud farm) or `"CUSTOM"` (custom category based on customer-defined telltales). If both the Global and Custom Risk Scores are `0`, `session_risk`'s value will not have a `risk_category` field.
`risk_band`	Risk band category indicating risk severity as determined by risk scores.	One of `"High"`, `"Medium",` or "Low"
`global`	Object containing the Global Risk Score value and the global telltales used to calculate it.	An array of objects consisting of `score` and `telltales` fields.
`custom`	Object containing the Custom Risk Score value and the global telltales used to calculate it.	An array of objects consisting of `score` and `telltales` fields.

global and custom Subfields

Subfield Name	Description	Values	Applicable Product
`score`	Risk Score value. If under `global`, the Global Risk Score. If under `custom`, the Custom Risk Score.	A string of an integer between `0` and `100`, such as `"87"`. If under `custom`, it will be either `"0"` or `"100"`.
`telltales`	Telltales that contributed to calculating a Risk Score. If under `global`, the Global Risk Score. If under `custom`, the Custom Risk Score.	An array of objects consisting of `name` and`weight` fields.

telltales Subfields

Subfield Name	Description	Values	Applicable Product
`name`	Name of a triggered telltale that contributed to calculating a Risk Score.	A string starting with `g-` to signify global, such as `"g-h-cfp-1000000000"` or a string that does not start with `g-` meaning it is a custom telltale like `"outdated-os-yandex"`
`weight`	The weight given this triggered telltale when calculating a Risk Score. Note that a telltale’s weight is not necessarily the same as the eventual total score.	A string of an integer between `"1"` and `"100"`. Not `"0"` since a triggered telltale must have some weight.

Fingerprint

This section constitutes of detailed information regarding the following:

Browser Characteristics - The browser attribute details that we use to analyze the session.
Device Characteristics - The device characteristics we used to create our session fingerprint.
User Preferences - The user preferences set on the local user device.

This information can be used by customers to craft their own Device IDs should they choose not to use Arkose’s version. These details can also be used in linkage analysis workflows.

Browser Characteristics

These fields contain information about the device the session ran on.

Field Name	Description	Example Values	Applicable Product
`browser_name`	The name of the browser the user was using.	A string, e.g. `Chrome` or `null`	Arkose Detect Arkose Protect
`browser_version`	The version of the browser the user was using.	A version number, e.g. `92.0.4515.159` or `null`	Arkose Detect Arkose Protect
`color_depth`	The color depth of the device used for the session.	A number, e.g. `24` or `null`	Arkose Detect Arkose Protect
`session_storage`	Whether session storage was available or not.	`true`, `false`	Arkose Detect Arkose Protect
`indexed_database`	Whether the browser uses any indexed database API.	`true`, `false`	Arkose Detect Arkose Protect
`canvas_fingerprint`	The canvas fingerprint value of the browser.	e.g. `1652956012` or `null`	Arkose Detect Arkose Protect

Device Characteristics

These fields contain information about the device the session ran on.

Field Name	Description	Example Values	Applicable Product
`operating_system`	The operating system used on the device.	e.g. `Windows` or `null`	Arkose Detect Arkose Protect
`operating_system_version`	The version of the operating system used on the device.	e.g. `XP` or `null`	Arkose Detect Arkose Protect
`screen_resolution`	The current screen resolution of the device.	e.g. `[1920,1080]` or `null`	Arkose Detect Arkose Protect
`max_resolution_supported`	The maximum supported screen resolution of the device.	e.g. `[1920,1080]` or `null`	Arkose Detect Arkose Protect
`behavior`	Whether the device / browser supports the `addBehavior` method. Note that `addBehavior` is considered obsolete with Windows 10.	`true`, `false`	Arkose Detect Arkose Protect
`cpu_class`	The CPU class identifier of the device.	e.g. `X86` or `null`	Arkose Detect Arkose Protect
`platform`	The platform the device belongs to.	e.g. `MacIntel` or `null`	Arkose Detect Arkose Protect
`touch_support`	Whether the device has touch support or not.	`true`, `false`	Arkose Detect Arkose Protect
`hardware_concurrency`	The hardware concurrency support of the device.	e.g. `8` or `null`	Arkose Detect Arkose Protect

IP Intelligence Fields

This section constitutes of detailed insights on the IP address of the end user. Information in this section can be used to create or enrich workflows such as manual review, auto-rejection, etc.

Field Name	Description	Example Values	Applicable Product
`timezone`	The timezone the session was originated from.	A string, e.g. `America/Los_Angeles` or `null`	Arkose Detect Arkose Protect
`user_ip`	The IP address of the device used for the session.	An IP address, e.g. `199.220.42.206`, or `null`	Arkose Detect Arkose Protect
`is_tor`	Indicates if the IP is suspected of being a TOR connection (either active or previously hosted TOR nodes and exist).	`true`, `false`	Arkose Detect Arkose Protect
`is_vpn`	Indicates if the IP is suspected of being a VPN connection. For example, it has been on a VPN and can include data center ranges.	`true`, `false`	Arkose Detect Arkose Protect
`is_proxy`	Indicates if this IP address suspected to be a proxy.	`true`, `false`	Arkose Detect Arkose Protect
`is_bot`	Whether the session is bot-originated or not.	`true`, `false`	Arkose Detect Arkose Protect
`country`	Country the User IP belongs to.	A string, e.g. `US` or `null`.	Arkose Detect Arkose Protect
`region`	State/Region that the IP belongs to.	A string, e.g. `California` or `null`.	Arkose Detect Arkose Protect
`city`	The city the IP belongs to.	A string, e.g. `Fremont` or `null`	Arkose Detect Arkose Protect
`isp`	The Internet Service Provider name.	A string, e.g. `AT&T U-verse` or `null`	Arkose Detect Arkose Protect
`public_access_point`	Whether the IP address belongs to education and research institutions, corporates, or public WiFi such as hotel lobby, coffee shop, etc.	`true`, `false`	Arkose Detect Arkose Protect
`connection_type`	Whether the connection type belongs to one of the following categories: Residential, Corporate, Education, Mobile, Data Center	A string, e.g. `Residential` or `null`	Arkose Detect Arkose Protect
`latitude`	The latitude coordinates of the device used for the session.	e.g. `37.52809906` or `null`	Arkose Detect Arkose Protect
`longitude`	The longitude coordinates of the device used for the session.	e.g. `-121.97319794` or `null`	Arkose Detect Arkose Protect

Data Exchange

📘
Data Exchange Response Structure
To view the full Email Intelligence Response Structure please visit **Data Exchange: Enhanced Detection and API Source Validation **(needs Zendesk authentication).

Email Intelligence

📘
Email Intelligence Response Structure
To view the full Email Intelligence Response Structure please visit **Email Intelligence API Reference **(needs Zendesk authentication).