Event Payload Reference

When events are sent to your integrations, they include comprehensive metadata about the user, device, and context. Below is a complete reference of all available fields:

Core Event Fields

Field	Type	Description
`org_id`	string	Your organization's unique identifier
`honeypot_name`	string	Name of the honeypot that captured this event
`event_id`	string	Unique identifier for this specific event
`events`	array	List of event names in this request
`event_name`	string	Primary event name for this occurrence
`event_properties`	object	Custom properties passed with the event (e.g., form data, transaction details)
`event_time`	string	ISO timestamp when the event occurred

Network & Location Data

Field	Type	Description
`ip_address`	string	User's IP address
`ip_address_connecting`	string	Direct connecting IP (may differ from forwarded IP)
`ip_address_forwarded_for`	string	X-Forwarded-For header value, if present
`asn`	number	Autonomous System Number
`as_organization`	string	Organization that owns the IP range
`city_name`	string	Detected city from IP geolocation
`country_name`	string	Full country name
`country_code`	string	Two-letter country code (ISO 3166-1)
`continent`	string	Two-letter continent code
`region_name`	string	State/province name
`region_code`	string	State/province abbreviation
`latitude`	number	Geographic latitude
`longitude`	number	Geographic longitude
`timezone`	string	Timezone identifier (e.g., "America/New_York")
`connection_type`	number	A bit mask where non-0 values are some combination of vpn, hosting provider, proxy, tor, etc. If you want to detect privacy behavior, look for connection_types >= 1. If you want to understand whether the user is connecting from a VPN, hosting provider, etc, look at the `current_tags` field instead of using this value directly.

Alternative location readings

If you need a stronger location reading that isn't IP-based, use our Geocaptcha feature.

Identity & Session Management

Field	Type	Description
`identity`	string	Primary user identifier (email, username, etc.)
`identity_type`	string	Type of identity ("account", "device", etc.)
`identities`	array	All identities associated with this user
`browser_fingerprint`	string	Unique browser fingerprint hash
`handprint_id`	string	Honeypot's advanced device identifier. See handprints
`device_id`	string	Device identifier (typically same as handprint_id)
`device_id_details`	object	Detailed information about the device identifier including version, creation time, and age
`session_id`	string	Current session identifier
`ref`	string	Reference ID for tracking

Device ID Details

The device_id_details field provides comprehensive information about the device identifier, including version tracking, creation timestamps, and device age calculations.

Field	Type	Description
`device_id`	string	The current device identifier
`version`	string	Version of the device identifier format
`created_at`	string	ISO timestamp when this device ID was first created
`updated_at`	string	ISO timestamp when this device ID was last updated
`updated_from`	object	Information about the previous device ID if this one was updated from another
`age`	object	Age of the device ID broken down into time units

The updated_from object contains:

Field	Type	Description
`device_id`	string	The previous device identifier
`version`	string	Version of the previous device identifier

The age object contains:

Field	Type	Description
`seconds`	number	Age in seconds
`minutes`	number	Age in minutes
`hours`	number	Age in hours
`days`	number	Age in days

Example Device ID Details

json

{
  "device_id_details": {
    "device_id": "834d2f18-853b-4e60-92b3-4e1226306d70",
    "version": "1.0",
    "created_at": "2025-08-07T16:59:35.785Z",
    "updated_at": "2025-08-07T16:59:35.785Z",
    "updated_from": {
      "device_id": "ed29b57f-a37c-441e-8396-d4e769500ed4",
      "version": "0.9"
    },
    "age": {
      "seconds": 2217,
      "minutes": 36,
      "hours": 0,
      "days": 0
    }
  }
}

Device ID Version Changelog

Honeypot's device ID system has evolved to address different challenges in device identification and tracking:

Version Description

0.0 - 0.9 Early versions relied partially on fingerprinting and network indicators. We retired this version and moved similar functionality to handprints. We migrated to version 1.0 on June 10, 2025, and started force-updating all old versions to 1.0 starting on August 7, 2025.

1.0 Pure UUIDv4 Device ID - This version uses a pure UUIDv4 format to ensure maximum uniqueness and eliminate crowdblending that occurs in fingerprinting solutions. This version is more suitable for scenarios where you need to minimize false positives. For scenarios where you need to cast a wider net with some false positive tolerance, the fingerprint + network-informed handprint_id are more suitable.

Version	Description
`0.0 - 0.9`	Early versions relied partially on fingerprinting and network indicators. We retired this version and moved similar functionality to handprints. We migrated to version 1.0 on June 10, 2025, and started force-updating all old versions to `1.0` starting on August 7, 2025.
`1.0`	Pure UUIDv4 Device ID - This version uses a pure UUIDv4 format to ensure maximum uniqueness and eliminate crowdblending that occurs in fingerprinting solutions. This version is more suitable for scenarios where you need to minimize false positives. For scenarios where you need to cast a wider net with some false positive tolerance, the fingerprint + network-informed handprint_id are more suitable.

Device & Browser Information

Field	Type	Description
`referer`	string	HTTP referer header
`ua`	string	Full User-Agent string
`browser_name`	string	Browser name (Chrome, Firefox, Safari, etc.)
`browser_version`	string	Full browser version
`browser_major`	string	Major browser version number
`engine_name`	string	Browser engine (Blink, Gecko, WebKit)
`engine_version`	string	Engine version
`os_name`	string	Operating system name
`os_version`	string	Operating system version
`device_vendor`	string	Device manufacturer
`device_model`	string	Device model name
`device_type`	string	Device category (mobile, tablet, desktop)
`cpu_architecture`	string	CPU architecture

Performance Metrics

Field	Type	Description
`performance_page_load`	number	Page load time in milliseconds
`performance_dom_ready`	number	DOM ready time in milliseconds
`performance_dns`	number	DNS lookup time
`performance_tcp`	number	TCP connection time
`performance_ttfb`	number	Time to first byte

Screen & Display

Field	Type	Description
`screen_width`	number	Screen width in pixels
`screen_height`	number	Screen height in pixels
`screen_color_depth`	number	Color depth
`screen_pixel_depth`	number	Pixel depth
`screen_orientation_angle`	number	Screen orientation angle
`screen_orientation_type`	string	Orientation type (landscape-primary, portrait, etc.)
`screen_inner_width`	number	Browser inner width
`screen_inner_height`	number	Browser inner height
`screen_outer_width`	number	Browser outer width
`screen_outer_height`	number	Browser outer height

Language & Localization

Field	Type	Description
`languages_supported`	array	All languages supported by the browser
`languages_preferred`	string	User's preferred language
`timezone_browser`	string	Browser-reported timezone
`timezone_browser_offset_hours`	number	Timezone offset in hours

Privacy Settings

Field	Type	Description
`browser_privacy_enabled`	boolean	Whether the browser is in incognito/private mode
`cookies_enabled`	boolean	Whether cookies are enabled in the browser
`cookie_test_passed`	boolean	Whether the browser passed Honeypot's cookie functionality test
`gpc_enabled`	boolean	Whether Global Privacy Control (GPC) is enabled in the client

Security & Risk Assessment

Field	Type	Description
`verified_bot_category`	string	Verified bot type (Google, Bing, etc.)
`unverified_bot_category`	string	Suspected bot type
`current_tags`	array	Active risk tags for this event
`session_tags`	array	All tags applied during this session
`tag_metadata`	object	Detailed information about each tag. Each tag entry contains tag-specific metadata (e.g., location information for geo policy violations) plus common properties: `count` (number of times applied), `first_timestamp`, `last_timestamp`, and `currently_applied`

Session Analytics

Field	Type	Description
`last_event_name`	string	Previous event name
`last_event_date`	string	Timestamp of previous event
`seconds_since_last_event`	number	Time elapsed since last event
`session_start_date`	string	When this session began
`seconds_since_session_start`	number	Total session duration
`session_total_event_count`	number	Number of events in this session
`session_ips`	array	All IP addresses used in this session
`session_ip_count`	number	Number of unique IPs in session

Historical Context

Field	Type	Description
`last_identity`	object	Previous identity information
`last_ip_address`	string	Previously used IP address
`last_latitude`	number	Previous geographic latitude
`last_longitude`	number	Previous geographic longitude
`last_connection_type`	number	Previous connection type
`last_asn`	number	Previous ASN
`last_as_organization`	string	Previous AS organization
`last_city_name`	string	Previous city
`last_country_name`	string	Previous country
`last_country_code`	string	Previous country code
`last_region_name`	string	Previous region
`last_timezone_browser`	string	Previous browser timezone
`last_timezone_ip`	string	Previous IP-based timezone
`distance_traveled_miles`	number	Distance between current and previous location

Smart Property Intelligence

When you include smart properties in your event data, Honeypot automatically enriches them with additional intelligence:

Phone Intelligence (`phone_intel`)

Field	Type	Description
`country_code`	number	Country calling code
`area_code`	string	Area/region code
`national_number`	string	Full national number
`is_possible`	boolean	Whether the number format is possible
`is_valid`	boolean	Whether the number is valid
`is_temporary`	boolean	Whether the number is from a temporary/disposable phone service
`is_valid_for_region`	boolean	Whether valid for detected region
`detected_region`	string	Country code for the phone number
`number_type`	string	Type: mobile, fixed_line, etc.
`e164_format`	string	International E.164 format
`national_format`	string	National formatting
`international_format`	string	International formatting
`ip_country_compare`	string	Comparison with IP country
`is_valid_for_ip_region`	boolean	Whether phone matches IP region

Address Intelligence (`address_intel`)

Field	Type	Description
`address`	string	Original address input
`latitude`	string	Geocoded latitude
`longitude`	string	Geocoded longitude
`raw`	object	Full geocoding response with detailed location data
`address_to_ip_distance`	number	Distance between address and IP location in miles

Email Intelligence (`email_intel`)

Field	Type	Description
`email`	string	Full email address
`username`	string	Username portion of email
`domain`	string	Domain portion of email
`suspicion`	number	Calculated risk score (0-1), where 0 is not suspicious and 1 is very suspicious (temporary, disposable, or untrusted emails)

Email Domain Intelligence (`email_domain_intel`)

Field	Type	Description
`domain`	string	Email domain being analyzed
`can_receive_mail`	boolean	Whether domain can receive email
`has_mx`	boolean	Whether domain has MX records
`has_spf`	boolean	Whether domain has SPF records
`has_dnssec`	boolean	Whether domain has DNSSEC enabled
`created_date`	string	Domain creation date (ISO format)
`days_old`	number	Domain age in days
`months_old`	number	Domain age in months
`years_old`	number	Domain age in years
`is_parked`	boolean	Whether domain is parked/for sale
`is_inaccessible`	boolean	Whether domain is inaccessible
`is_temporary_email`	boolean	Whether domain is a temporary email service
`is_protected`	boolean	Whether domain is behind protection services
`is_common_email_domain`	boolean	Whether domain is a common email provider
`redirects_to`	string	URL domain redirects to (if applicable)
`final_domain`	string	Final domain after redirects
`redirect_chain`	array	Chain of redirects from original to final domain
`registrar`	string	Domain registrar name
`nameservers`	array	Domain nameservers
`expiration_date`	string	Domain expiration date
`abuse_email`	string	Registrar abuse contact email
`abuse_phone`	string	Registrar abuse contact phone
`mx_records`	array	MX DNS records
`a_records`	array	A DNS records
`spf_records`	array	SPF DNS records
`tags`	array	Domain risk tags (e.g., "parked_domain", "new_domain", "no_spf")
`cached_at`	string	When intelligence was cached
`processing_time_ms`	number	Time taken to gather intelligence

Geofencing & Compliance

Field	Type	Description
`geofence_vpn_rescreen_frequency_seconds`	number	How often to recheck VPN status
`geofence_triggered`	boolean	Whether geofence rules were triggered
`redirect_url`	string	URL to redirect to if geofenced
`redirect_auto`	boolean	Whether auto-redirect is enabled
`geofence_test_only`	boolean	Whether in test mode
`geo_challenge_status`	number	Status of geo-challenge
`geofence_event_count`	number	Number of geofence events

Behaviors

The behaviors object contains time-windowed behavioral metrics. The key names correspond with the behavior name that you set when configuring the behavior.

The recommend pattern is to name the behaviors in this format: <operation>_<behavior>_<time_window>. e.g.

Feature Type	Description
`count_logins_10m`	Count of specific events within time windows
`unique_accounts_365d`	Unique values within time windows
`sequence_purchase_flow_30d`	Sequential event pattern analysis
`time_between_logins_2w`	Time between events

Default Behaviors

Honeypot automatically tracks two default behaviors:

Behavior Name	Description	Data Structure
`unique_identities_by_device_365d`	Tracks unique identities (emails, usernames, etc.) associated with each device over a 365-day window	See Unique Identity Details
`location_history_by_device_365d`	Tracks location history and travel patterns for each device over a 365-day window	See Location History Details

Unique Identity Details

The unique_identities_by_device_365d behavior tracks all unique identities associated with each device over a 365-day window. This helps detect account sharing, credential stuffing, and other suspicious identity patterns.

Field	Type	Description
`values`	array	Array of all unique identity values (emails, usernames, etc.) associated with this device
`unique`	number	Count of unique identities
`timestamp`	string	ISO timestamp when this behavior data was last updated
`remaining_window_seconds`	number	Seconds remaining in the 365-day tracking window

Example Unique Identity Tracking

json

{
  "behaviors": {
    "unique_identities_by_device_365d": {
      "values": ["user1@example.com", "user2@example.com", "user3@gmail.com"],
      "unique": 3,
      "timestamp": "2025-07-14T13:51:20.066Z",
      "remaining_window_seconds": 30584676
    }
  }
}

Location History Details

The location_history_by_device_365d behavior provides detailed location tracking with the following properties:

Field	Type	Description
`distance_to_normal_miles`	number	Distance from current location to the most common location
`distance_to_original_miles`	number	Distance from current location to the first recorded location
`total_travel_miles`	number	Total distance traveled across all locations
`average_distance`	number	Average distance between location changes
`event_count`	number	Total number of events across all locations
`distance_sum`	number	Sum of all distances between locations
`unique_coordinate_count`	number	Number of unique coordinate pairs visited
`current_location`	object	Current latitude/longitude coordinates
`history`	array	Array of location entries with detailed metadata

Each location entry in the history contains:

Field	Type	Description
`latitude`	number	Geographic latitude
`longitude`	number	Geographic longitude
`first_timestamp`	number	Unix timestamp of first event at this location
`last_timestamp`	number	Unix timestamp of last event at this location
`event_count`	number	Number of events at this location
`unique_events`	array	Array of event types that occurred at this location
`unique_event_count`	number	Number of unique event types
`city_name`	string	City name (may be null)
`region_name`	string	Region/state name (may be null)
`country_code`	string	Two-letter country code
`country_name`	string	Full country name
`is_original`	boolean	Whether this is the first recorded location
`is_most_recent`	boolean	Whether this is the most recent location
`is_normal`	boolean	Whether this is the most commonly visited location

Example Location History

json

{
  "behaviors": {
    "location_history_by_device_365d": {
      "distance_to_normal_miles": 0,
      "distance_to_original_miles": 0,
      "total_travel_miles": 19292.08,
      "average_distance": 277.5,
      "event_count": 303,
      "distance_sum": 84083.02,
      "history": [
        {
          "latitude": 34.207,
          "longitude": -84.14,
          "first_timestamp": 1753384638005,
          "last_timestamp": 1753452404070,
          "event_count": 280,
          "unique_events": ["Page View", "Sign Up", "Login"],
          "unique_event_count": 3,
          "city_name": "Atlanta",
          "region_name": "Georgia",
          "country_code": "US",
          "country_name": "United States",
          "is_original": true,
          "is_most_recent": true,
          "is_normal": true
        },
        {
          "latitude": 21.584,
          "longitude": 5.625,
          "first_timestamp": 1753385619728,
          "last_timestamp": 1753385659459,
          "event_count": 2,
          "unique_events": ["Login"],
          "unique_event_count": 1,
          "city_name": null,
          "region_name": null,
          "country_code": "DZ",
          "country_name": "Algeria",
          "is_original": false,
          "is_most_recent": false,
          "is_normal": false
        }
      ],
      "unique_coordinate_count": 7,
      "current_location": {
        "latitude": 34.20732,
        "longitude": -84.14019
      },
      "timestamp": "2025-07-24T19:17:17.753Z",
      "remaining_window_seconds": 31468233
    }
  }
}

See behaviors for more information.

Example Event Payload

collapsedexpanded

json

{
  "org_id": "a7932812-e929-5723-ry90-s56140d2212c",
  "honeypot_name": "honeypot-97ytr8",
  "event_id": "b531b741-9fa4-48f7-ac83-f1040d3f6db3",
  "events": [...],
  "event_name": "Sign Up",
  "event_properties": {...},
  "event_time": "2025-06-06T13:53:00.302Z",
  "ip_address": "123.444.555.678",
  "ip_address_connecting": "123.444.555.678",
  "ip_address_forwarded_for": null,
  "asn": 7018,
  "as_organization": "PPPoX Pool - Rback11 IRVNCA.753936",
  "verified_bot_category": null,
  "unverified_bot_category": null,
  "city_name": "Grand Rapids",
  "country_name": "United States",
  "country_code": "US",
  "continent": "NA",
  "region_name": "Michigan",
  "region_code": "MI",
  "latitude": 42.9634,
  "longitude": -85.6681,
  "timezone": "America/Detroit",
  "identity": "xxxxxx@hotmail.com",
  "identity_type": "account",
  "identities": [],
  "browser_fingerprint": "ca689967b84aa1aeb3e09d8967ea02cc",
  "handprint_id": "72b0769e-f08e-4bbe-b4cb-fb1b8de1635e",
  "device_id": "72b0769e-f08e-4bbe-b4cb-fb1b8de1635e",
  "device_id_details": {...},
  "session_id": "ea21830d-6629-46dc-bd00-989aca3f2b77",
  "ref": "51d0cf08-763b-47de-bbd1-b17b1bc7c88f",
  "referer": "http://localhost:5173/",
  "ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
  "browser_name": "Chrome",
  "browser_version": "137.0.0.0",
  "browser_major": "137",
  "engine_name": "Blink",
  "engine_version": "137.0.0.0",
  "os_name": "Mac OS",
  "os_version": "10.15.7",
  "device_vendor": "Apple",
  "device_model": "Macintosh",
  "device_type": null,
  "cpu_architecture": null,
  "languages_supported": [...],
  "languages_preferred": "en-US",
  "performance_page_load": 1495.6000000005588,
  "performance_dom_ready": 1297.9000000003725,
  "performance_dns": 0,
  "performance_tcp": 0.20000000018626451,
  "performance_ttfb": 26,
  "screen_width": 3456,
  "screen_height": 2234,
  "screen_color_depth": 30,
  "screen_pixel_depth": 30,
  "screen_orientation_angle": 0,
  "screen_orientation_type": "landscape-primary",
  "screen_inner_width": 1583,
  "screen_inner_height": 776,
  "screen_outer_width": 1583,
  "screen_outer_height": 897,
  "timezone_browser": "America/Detroit",
  "timezone_browser_offset_hours": 4,
  "current_tags": [...],
  "session_tags": [...],
  "last_event_name": "Sign Up",
  "last_event_date": "2025-06-06T13:52:51.520Z",
  "seconds_since_last_event": 8.782,
  "session_start_date": "2025-06-06T13:51:21.361Z",
  "seconds_since_session_start": 98.941,
  "session_total_event_count": 5,
  "last_identity": {...},
  "session_ips": [...],
  "session_ip_count": 1,
  "last_ip_address": "123.444.555.678",
  "last_latitude": 33.74,
  "last_longitude": -84.38,
  "last_connection_type": null,
  "last_asn": 7018,
  "last_as_organization": "PPPoX Pool - Rback11 IRVNCA.753936",
  "last_city_name": "Atlanta",
  "last_country_name": "United States",
  "last_country_code": "US",
  "last_region_name": "Georgia",
  "last_timezone_browser": "America/New_York",
  "last_timezone_ip": "America/New_York",
  "connection_type": 0,
  "geofence_vpn_rescreen_frequency_seconds": 2,
  "phone_intel": {...},
  "email_domain": "hotmail.com",
  "tag_metadata": {...},
  "address_intel": {...},
  "address_to_ip_distance": 715,
  "distance_traveled_miles": 0,
  "geofence_triggered": false,
  "redirect_url": "",
  "redirect_auto": false,
  "geofence_test_only": false,
  "geo_challenge_status": 0,
  "geofence_event_count": 0,
  "behaviors": {...},
  "geofenced": false
}

json

{
  "org_id": "a7932812-e929-5723-ry90-s56140d2212c",
  "honeypot_name": "honeypot-97ytr8",
  "event_id": "b531b741-9fa4-48f7-ac83-f1040d3f6db3",
  "events": ["Sign Up"],
  "event_name": "Sign Up",
  "event_properties": {
    "address": "'Flatiron Building, 175, 5th Avenue, Flatiron, New York, NYC, New York",
    "email": "xxxxxx@hotmail.com",
    "phone": "5555555555"
  },
  "event_time": "2025-06-06T13:53:00.302Z",
  "ip_address": "123.444.555.678",
  "ip_address_connecting": "123.444.555.678",
  "ip_address_forwarded_for": null,
  "asn": 7018,
  "as_organization": "PPPoX Pool - Rback11 IRVNCA.753936",
  "verified_bot_category": null,
  "unverified_bot_category": null,
  "city_name": "Grand Rapids",
  "country_name": "United States",
  "country_code": "US",
  "continent": "NA",
  "region_name": "Michigan",
  "region_code": "MI",
  "latitude": 42.9634,
  "longitude": -85.6681,
  "timezone": "America/Detroit",
  "identity": "xxxxxx@hotmail.com",
  "identity_type": "account",
  "identities": [],
  "browser_fingerprint": "ca689967b84aa1aeb3e09d8967ea02cc",
  "handprint_id": "72b0769e-f08e-4bbe-b4cb-fb1b8de1635e",
  "device_id": "72b0769e-f08e-4bbe-b4cb-fb1b8de1635e",
  "device_id_details": {
    "device_id": "72b0769e-f08e-4bbe-b4cb-fb1b8de1635e",
    "version": "1.0",
    "created_at": "2025-08-07T16:59:35.785Z",
    "updated_at": "2025-08-07T16:59:35.785Z",
    "updated_from": {
      "device_id": "ed29b57f-a37c-441e-8396-d4e769500ed4",
      "version": "0.9"
    },
    "age": {
      "seconds": 2217,
      "minutes": 36,
      "hours": 0,
      "days": 0
    }
  },
  "session_id": "ea21830d-6629-46dc-bd00-989aca3f2b77",
  "ref": "51d0cf08-763b-47de-bbd1-b17b1bc7c88f",
  "referer": "http://localhost:5173/",
  "ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
  "browser_name": "Chrome",
  "browser_version": "137.0.0.0",
  "browser_major": "137",
  "engine_name": "Blink",
  "engine_version": "137.0.0.0",
  "os_name": "Mac OS",
  "os_version": "10.15.7",
  "device_vendor": "Apple",
  "device_model": "Macintosh",
  "device_type": null,
  "cpu_architecture": null,
  "languages_supported": [
    "en-US",
    "en"
  ],
  "languages_preferred": "en-US",
  "performance_page_load": 1495.6000000005588,
  "performance_dom_ready": 1297.9000000003725,
  "performance_dns": 0,
  "performance_tcp": 0.20000000018626451,
  "performance_ttfb": 26,
  "screen_width": 3456,
  "screen_height": 2234,
  "screen_color_depth": 30,
  "screen_pixel_depth": 30,
  "screen_orientation_angle": 0,
  "screen_orientation_type": "landscape-primary",
  "screen_inner_width": 1583,
  "screen_inner_height": 776,
  "screen_outer_width": 1583,
  "screen_outer_height": 897,
  "timezone_browser": "America/Detroit",
  "timezone_browser_offset_hours": 4,
  "current_tags": [
    "high_risk_location",
  ],
  "session_tags": [
    "high_risk_location",
  ],
  "last_event_name": "Sign Up",
  "last_event_date": "2025-06-06T13:52:51.520Z",
  "seconds_since_last_event": 8.782,
  "session_start_date": "2025-06-06T13:51:21.361Z",
  "seconds_since_session_start": 98.941,
  "session_total_event_count": 5,
  "last_identity": {
    "account": "xxxxxx@hotmail.com"
  },
  "session_ips": [
    "123.444.555.678"
  ],
  "session_ip_count": 1,
  "last_ip_address": "123.444.555.678",
  "last_latitude": 33.7490,
  "last_longitude": -84.3880,
  "last_connection_type": null,
  "last_asn": 7018,
  "last_as_organization": "PPPoX Pool - Rback11 IRVNCA.753936",
  "last_city_name": "Atlanta",
  "last_country_name": "United States",
  "last_country_code": "US",
  "last_region_name": "Georgia",
  "last_timezone_browser": "America/New_York",
  "last_timezone_ip": "America/New_York",
  "connection_type": 0,
  "geofence_vpn_rescreen_frequency_seconds": 2,
  "phone_intel": {
    "country_code": 1,
    "area_code": "555",
    "national_number": "5555555555",
    "extension": null,
    "raw_input": "5555555555",
    "is_possible": true,
    "is_valid": true,
    "is_temporary": false,
    "is_valid_for_region": true,
    "detected_region": "US",
    "number_type_id": 2,
    "number_type": "fixed_line_or_mobile",
    "e164_format": "+5555555555",
    "national_format": "(555) 555-5555",
    "international_format": "+1 555-555-5555",
    "email_domain_compare": null,
    "is_valid_for_email_region": null,
    "ip_country_compare": "US",
    "is_valid_for_ip_region": true,
    "temporary": null
  },
  "email_domain": "hotmail.com",
  "tag_metadata": {
    "email_username_randomized_v001": {
      "email": "xxxxxx@hotmail.com",
      "username": "xxxxxx",
      "domain": "hotmail.com",
      "_schema": "email_v001"
    },
    "high_risk_location": {
      "ip_coordinates": {
        "last_latitude": 33.7490,
        "last_longitude": -84.3880,
      },
      "address_coordinates": {
        "address": "'Flatiron Building, 175, 5th Avenue, Flatiron, New York, NYC, New York",
        "latitude": "40.741059199999995",
        "longitude": "-73.98964162240998",
        "raw": {
          "type": "FeatureCollection",
          "features": [
            {
              "type": "Feature",
              "properties": {
                "datasource": {
                  "sourcename": "openstreetmap",
                  "attribution": "© OpenStreetMap contributors",
                  "license": "Open Database License",
                  "url": "https://www.openstreetmap.org/copyright"
                },
                "name": "Flatiron Building",
                "old_name": "Fuller Building",
                "country": "United States",
                "country_code": "us",
                "state": "New York",
                "county": "New York County",
                "city": "New York",
                "postcode": "10010",
                "district": "Manhattan",
                "neighbourhood": "Flatiron District",
                "street": "5th Avenue",
                "housenumber": "175",
                "iso3166_2": "US-NY",
                "lon": -73.98964162240998,
                "lat": 40.741059199999995,
                "state_code": "NY",
                "result_type": "amenity",
                "formatted": "Flatiron Building, 175 5th Avenue, New York, NY 10010, United States of America",
                "address_line1": "Flatiron Building",
                "address_line2": "175 5th Avenue, New York, NY 10010, United States of America",
                "category": "tourism.attraction",
                "timezone": {
                  "name": "America/New_York",
                  "offset_STD": "-05:00",
                  "offset_STD_seconds": -18000,
                  "offset_DST": "-04:00",
                  "offset_DST_seconds": -14400,
                  "abbreviation_STD": "EST",
                  "abbreviation_DST": "EDT"
                },
                "plus_code": "87G8P2R6+C4",
                "plus_code_short": "P2R6+C4 New York, New York County, United States",
                "rank": {
                  "importance": 0.7405988542685404,
                  "popularity": 8.615793062435909,
                  "confidence": 0.6666666666666667,
                  "confidence_city_level": 0.2857142857142857,
                  "confidence_street_level": 0.2857142857142857,
                  "confidence_building_level": 0.2857142857142857,
                  "match_type": "full_match"
                },
                "place_id": "51b8c0d049567f52c05930332207db5e4440f00102f901800dc80f00000000c00201920311466c617469726f6e204275696c64696e67"
              },
              "geometry": {
                "type": "Point",
                "coordinates": [
                  -73.98964162240998,
                  40.741059199999995
                ]
              },
              "bbox": [
                -73.9898715,
                40.7407596,
                -73.9895014,
                40.7413004
              ]
            }
          ],
          "query": {
            "text": "'Flatiron Building, 175, 5th Avenue, Flatiron, New York, NYC, New York",
            "parsed": {
              "house": "'flatiron building",
              "housenumber": "175",
              "street": "5th avenue",
              "suburb": "flatiron new york",
              "city": "nyc",
              "state": "new york",
              "expected_type": "amenity"
            }
          }
        }
      },
      "distance_in_miles": 715.8078001335288,
      "_schema": "high_risk_location_v001"
    }
  },
  "address_intel": {
    "address": "'Flatiron Building, 175, 5th Avenue, Flatiron, New York, NYC, New York",
    "latitude": "40.741059199999995",
    "longitude": "-73.98964162240998",
    "raw": {
      "type": "FeatureCollection",
      "features": [
        {
          "type": "Feature",
          "properties": {
            "datasource": {
              "sourcename": "openstreetmap",
              "attribution": "© OpenStreetMap contributors",
              "license": "Open Database License",
              "url": "https://www.openstreetmap.org/copyright"
            },
            "name": "Flatiron Building",
            "old_name": "Fuller Building",
            "country": "United States",
            "country_code": "us",
            "state": "New York",
            "county": "New York County",
            "city": "New York",
            "postcode": "10010",
            "district": "Manhattan",
            "neighbourhood": "Flatiron District",
            "street": "5th Avenue",
            "housenumber": "175",
            "iso3166_2": "US-NY",
            "lon": -73.98964162240998,
            "lat": 40.741059199999995,
            "state_code": "NY",
            "result_type": "amenity",
            "formatted": "Flatiron Building, 175 5th Avenue, New York, NY 10010, United States of America",
            "address_line1": "Flatiron Building",
            "address_line2": "175 5th Avenue, New York, NY 10010, United States of America",
            "category": "tourism.attraction",
            "timezone": {
              "name": "America/New_York",
              "offset_STD": "-05:00",
              "offset_STD_seconds": -18000,
              "offset_DST": "-04:00",
              "offset_DST_seconds": -14400,
              "abbreviation_STD": "EST",
              "abbreviation_DST": "EDT"
            },
            "plus_code": "87G8P2R6+C4",
            "plus_code_short": "P2R6+C4 New York, New York County, United States",
            "rank": {
              "importance": 0.7405988542685404,
              "popularity": 8.615793062435909,
              "confidence": 0.6666666666666667,
              "confidence_city_level": 0.2857142857142857,
              "confidence_street_level": 0.2857142857142857,
              "confidence_building_level": 0.2857142857142857,
              "match_type": "full_match"
            },
            "place_id": "51b8c0d049567f52c05930332207db5e4440f00102f901800dc80f00000000c00201920311466c617469726f6e204275696c64696e67"
          },
          "geometry": {
            "type": "Point",
            "coordinates": [
              -73.98964162240998,
              40.741059199999995
            ]
          },
          "bbox": [
            -73.9898715,
            40.7407596,
            -73.9895014,
            40.7413004
          ]
        }
      ],
      "query": {
        "text": "'Flatiron Building, 175, 5th Avenue, Flatiron, New York, NYC, New York",
        "parsed": {
          "house": "'flatiron building",
          "housenumber": "175",
          "street": "5th avenue",
          "suburb": "flatiron new york",
          "city": "nyc",
          "state": "new york",
          "expected_type": "amenity"
        }
      }
    }
  },
  "address_to_ip_distance": 715.8078001335288,
  "distance_traveled_miles": 0,
  "geofence_triggered": false,
  "redirect_url": "",
  "redirect_auto": false,
  "geofence_test_only": false,
  "geo_challenge_status": 0,
  "geofence_event_count": 0,
  "behaviors": {
    "count_listings_5m": {
      "count": 4,
      "timestamp": "2025-06-06T13:51:22.407Z",
      "remaining_window_seconds": 202
    },
    "unique_emails_1d": {
      "values": [
        "jkhsjkhskskjhd@hotmail.com"
      ],
      "unique": 1,
      "timestamp": "2025-06-05T14:32:51.442Z",
      "remaining_window_seconds": 2391
    },
    "count_logins_by_email_domain_10s": null
  },
  "geofenced": false
}

Highlighted fields:

current_tags contains an array of labels for the user. See tags for more information.

Event Payload Reference ​

Core Event Fields ​

Network & Location Data ​

Identity & Session Management ​

Device ID Details ​

Example Device ID Details ​

Device ID Version Changelog ​

Device & Browser Information ​

Performance Metrics ​

Screen & Display ​

Language & Localization ​

Privacy Settings ​

Security & Risk Assessment ​

Session Analytics ​

Historical Context ​

Smart Property Intelligence ​

Phone Intelligence (phone_intel) ​

Address Intelligence (address_intel) ​

Email Intelligence (email_intel) ​

Email Domain Intelligence (email_domain_intel) ​

Geofencing & Compliance ​

Behaviors ​

Default Behaviors ​

Unique Identity Details ​

Example Unique Identity Tracking ​

Location History Details ​

Example Location History ​

Example Event Payload ​

Event Payload Reference

Core Event Fields

Network & Location Data

Identity & Session Management

Device ID Details

Example Device ID Details

Device ID Version Changelog

Device & Browser Information

Performance Metrics

Screen & Display

Language & Localization

Privacy Settings

Security & Risk Assessment

Session Analytics

Historical Context

Smart Property Intelligence

Phone Intelligence (`phone_intel`)

Address Intelligence (`address_intel`)

Email Intelligence (`email_intel`)

Email Domain Intelligence (`email_domain_intel`)

Geofencing & Compliance

Behaviors

Default Behaviors

Unique Identity Details

Example Unique Identity Tracking

Location History Details

Example Location History

Example Event Payload