Verisoul Field Glossary

Last updated: June 10, 2025

This guide explains every field returned by the /authenticate endpoint and the Verisoul dashboard, grouped by logical categories. Share it with engineers, analysts, or support teams who need to interpret Verisoul data quickly.

🚦 Reading Risk Scores vs. Dashboard Percentages

All numeric risk fields (for example account_score, bot, multiple_accounts, every element inside risk_signal_scores, and the averages under account.risk_signal_average) are returned as decimals in the range 0 ≤ _ x_ ≤ 1. The Verisoul Dashboard multiplies these by 100 and appends a % sign. If you see 0.87 in the API, the UI will display 87 %.

1 · Account‑Organizational Data

Value	Field Type	Description
`project_id`	string	Public key for your Verisoul project (set in the JS SDK).
`account_id`	string	Customer‑supplied unique user identifier; should map to your DB.
`request_id`	string	Unique ID for this API request — include in support tickets.
`lists[]`	string[]	List memberships (e.g., `allow_list`, `block_list`). Managed manually or by Verisoul rules.
`account.metadata`	object	Arbitrary key/value pairs you pass (traffic source, plan tier, etc.).
`account.group`	string	Optional scope bucket (survey ID, offer ID, ad ID). Multi‑account logic is restricted within a group.

2 · Account Decision & Composite Scores

Value	Field Options	Description
`decision`	— (`real` \| `suspicious` \| `fake`)	High‑level verdict.
`account_score`	0–1	Overall risk of the account. Higher = riskier.
`bot`	0–1	Probability of automation.
`multiple_accounts`	0–1	Likelihood user exceeds your allowed account count.
`risk_signals`	0–1	Aggregated risk across device, network, email, and location.
`accounts_linked`	integer	Number of other accounts linked to this one.

3 · Account Activity Snapshot

Field	Type	Description
`account.num_sessions`	integer	Total sessions seen.
`account.first_seen`	ISO 8601	Timestamp of first session.
`account.last_seen`	ISO 8601	Timestamp of most recent session.
`account.last_session`	string	`session_id` of most recent visit.
`account.country`	string	Country (ISO alpha‑2) of most recent IP.
`account.countries[]`	string[]	All distinct countries ever seen.
`account.unique_devices.1_day` / `7_day`	integer	Distinct devices in last 1 / 7 days.
`account.unique_networks.1_day` / `7_day`	integer	Distinct IPs in last 1 / 7 days.

4 · Email Intelligence

Field	Type	Description
`account.email.email`	string	Stored email address.
`account.email.disposable`	boolean	`true` if disposable provider.
`account.email.personal`	boolean	`true` if likely personal (not role‑based/work).
`account.email.valid`	boolean	Syntax‑level validity flag.

5 · Account‑Level Risk‑Signal Averages

These are time‑decayed averages of per‑session scores (range 0–1):

account.risk_signal_average.device_risk
account.risk_signal_average.proxy
account.risk_signal_average.vpn
account.risk_signal_average.tor
account.risk_signal_average.spoofed_ip
account.risk_signal_average.datacenter
account.risk_signal_average.recent_fraud_ip
account.risk_signal_average.impossible_travel
account.risk_signal_average.device_network_mismatch

6 · Linked Accounts (optional; returned when **`accounts_linked=true`)

Field	Type	Description
`linked_accounts[].account_id`	string	The other account ID.
`linked_accounts[].score`	0–1	Match strength (1 = strongest).
`linked_accounts[].email`	string	Email tied to that account.
`linked_accounts[].match_type[]`	string[]	Evidence categories (`browser`, `device`, `network`, etc.).
`linked_accounts[].lists[]`	string[]	List memberships of the linked account.
`linked_accounts[].metadata`	object	Customer‑supplied metadata for the linked account.

7 · Session Metadata

Field	Type	Description
`session_id`	string	Unique session identifier.
`session.start_time`	ISO 8601	UTC session start timestamp.
`session.true_country_code`	string	Geolocation after proxy/VPN de‑spoofing. Falls back to IP country.

8 · Network & Location Details

Field	Type	Description
`session.network.ip_address`	string	Client IP seen by Verisoul edge.
`session.network.service_provider`	string	ISP / hosting provider.
`session.network.connection_type`	string	`mobile`, `broadband`, `datacenter`, etc.
`session.location.*`	—	Standard GeoIP attributes (`continent`, `country_code`, `state`, `city`, `zip_code`, `timezone`, `latitude`, `longitude`).

9 · Browser & Device Characteristics

Field	Type	Description
`session.browser.type`	string	Browser family (Chrome, Safari, etc.).
`session.browser.version`	string	Version string.
`session.browser.language`	string	Preferred language (IETF tag).
`session.browser.user_agent`	string	Raw UA header.
`session.browser.timezone`	string	Browser‑reported TZ offset.
`session.device.category`	string	`desktop`, `mobile`, `tablet`, etc.
`session.device.type`	string	Device model / class when detectable.
`session.device.os`	string	Operating‑system label.
`session.device.cpu_cores`	integer	Reported logical cores.
`session.device.memory`	integer (MiB)	Reported RAM.
`session.device.gpu`	string	GPU renderer string (WebGL).
`session.device.screen_width` / `screen_height`	integer	Reported resolution.

10 · Bot Interaction Metrics

Counts of front‑end events captured during the session.

Field	Type
`session.bot.mouse_num_events`	integer
`session.bot.click_num_events`	integer
`session.bot.keyboard_num_events`	integer
`session.bot.touch_num_events`	integer
`session.bot.clipboard_num_events`	integer

Tip Patterns (timing, distribution) matter more than raw counts when classifying bots.

11 · Session‑Level Risk Flags & Scores

Boolean flags (true / false) reside in session.risk_signals; matching confidence scores (0–1) are in session.risk_signal_scores.

Signal	Meaning
`device_risk`	VM, emulator, device spoofing, or mismatch.
`proxy`	Mobile, Residential, or Datacenter Proxy
`vpn`	Consumer or corporate VPN exit node.
`tor`	TOR exit node.
`spoofed_ip`	IP geolocation inconsistent with device hints.
`datacenter`	IP belongs to hosting provider / DC.
`recent_fraud_ip`	IP appears on recent abuse lists.
`impossible_travel`	Geo hop impossible vs. previous session.
`device_network_mismatch`	Device fingerprint inconsistent with network path.