S3 export

The Device Intelligence S3 export writes every completed evaluation to an S3 bucket you own, so you can load fingerprint and risk data into your own warehouse, fraud tooling, or analytics pipeline. Each record contains the full device fingerprint plus the network, IP, geo, VPN, and bot signals cside computed for that visit.

How delivery works

• Format: JSONL (JSON Lines). Each line is one complete evaluation record, encoded as application/x-ndjson.
• Cadence: cside uploads one batch per hour.
• Object name: fingerprints-team-<team_id>-<from>-<to>.jsonl, where <from> and <to> are the hour boundaries of the batch.
• Destination: your bucket. cside writes objects but never reads or lists them.

Record structure

Every line is a JSON object with a set of top-level identity fields plus nested objects for each signal group:

Object	Description
fingerprint	The device fingerprint (browser, hardware, rendering, and environment signals).
network_client_metrics	TCP and TLS characteristics of the connection.
ip_enrichment	ASN, geo, and privacy data derived from the visitor IP.
geo_lite_city_data	City-level geolocation for the visitor IP.
vpn_evaluation	VPN likelihood and supporting signals.
bot_evaluation	Bot likelihood, verdict, and supporting signals.
fingerprint_enrichment	Signals derived from the fingerprint, such as disposable email detection.
rule_evaluations	Named rule outcomes evaluated for this visit.

Top-level fields

Field	Type	Description
evaluation_id	string	Unique ID for this evaluation. Also present as id.
customer_id	string	Your domain’s cside ID. Also present as domain_id.
customer_domain	string	The domain being evaluated.
team_id	string	Your cside team ID.
timestamp	string	Evaluation time, ISO 8601. Also present as created_at.
page_url	string	The page where the evaluation was triggered.
session_id	string	Browser session ID.
request_id	string	Upstream request correlation ID.
client_ip	string	Visitor IP address.
user_agent	string	Visitor browser user agent.
evaluation_status	string	Evaluation status. Completed records only.
error_message	string	Error details for a failed evaluation. Empty for completed records, so normally absent.
device_fingerprint	string	Compact device fingerprint token (base64).
threat_fingerprint	string	Compact threat fingerprint token (base64).

fingerprint object

The device fingerprint is the largest object. The tables below group its fields by category.

Identity

Field	Type	Description
device_id	string	Stable device identifier derived from the collected signals.

Browser and system

Field	Type	Description
product	string	Browser navigator.product value.
product_sub	string	Browser navigator.productSub value.
browser_name	string	Browser name.
browser_version	string	Browser version.
mobile	boolean	Whether the browser reports as mobile.
apple_pay_version	number	Apple Pay API version, when available.
user_agent	string	Browser user agent string.
plugins	string[]	Installed browser plugins.
platform	string	Operating system platform.
cpu_architecture	string	Reported CPU architecture.
hardware_architecture	number	Hardware architecture indicator.
connection	string	Network connection type (for example 4g).

Rendering (Canvas, WebGL, WebGPU)

Field	Type	Description
canvas_signal	string	Canvas rendering signal.
webgl_signal	string	WebGL rendering signal.
webgl_vendor	string	WebGL vendor string.
webgl_renderer	string	WebGL renderer string.
video_card_vendor	string	GPU vendor.
video_card_renderer	string	GPU renderer.
video_card_vendor_unmasked	string	Unmasked GPU vendor, when available.
video_card_renderer_unmasked	string	Unmasked GPU renderer, when available.
video_card_version	string	GPU driver version string.
video_card_shading_language_version	string	Shading language version.
webgpu_supported	boolean	Whether WebGPU is supported.
webgpu_adapter	string	WebGPU adapter description.
webgpu_signal	string	WebGPU rendering signal.

Locale and time

Field	Type	Description
timezone	string	Reported time zone.
locale	string	Reported locale.
languages	string[]	Accepted languages.

Audio

Field	Type	Description
audio_signal	string	Audio fingerprint signal.
audio_max_channels	number	Maximum audio output channels.
audio_channel_count_mode	string	Audio channel count mode.

Hardware

Field	Type	Description
device_memory	number	Reported device memory in GB.
hardware_concurrency	number	Number of logical CPU cores.
js_heap_size_limit	number	JavaScript heap size limit in bytes.
math_values	object	Results of math precision probes, keyed by operation.

Screen

Field	Type	Description
screen_width	number	Screen width in pixels.
screen_height	number	Screen height in pixels.
screen_resolution	string	Screen resolution string.
color_depth	number	Screen color depth.
device_pixel_ratio	number	Device pixel ratio.
touch_support	boolean	Whether touch input is supported.
max_touch_points	number	Maximum simultaneous touch points.
media_matches	string[]	Matched CSS media queries.

Browser APIs

Field	Type	Description
online_status	boolean	Whether the browser reports as online.
do_not_track	string	Do Not Track setting.
cookies_enabled	boolean	Whether cookies are enabled.
media_devices	string[]	Available media device kinds.
indexeddb_support	boolean	IndexedDB support.
localstorage_support	boolean	localStorage support.
sessionstorage_support	boolean	sessionStorage support.
bluetooth_support	boolean	Web Bluetooth support.
geolocation_support	boolean	Geolocation API support.
device_motion_support	boolean	Device motion support.
device_orientation_support	boolean	Device orientation support.
speech_recognition_support	boolean	Speech recognition support.
vibration_support	boolean	Vibration API support.
gamepad_support	boolean	Gamepad API support.
fullscreen_support	boolean	Fullscreen API support.
clipboard_support	boolean	Clipboard API support.
service_worker_support	boolean	Service Worker support.
webassembly_support	boolean	WebAssembly support.

Preferences

Field	Type	Description
prefers_dark_mode	boolean	Prefers dark color scheme.
prefers_reduced_motion	boolean	Prefers reduced motion.

Fonts

Field	Type	Description
detected_fonts	string[]	Fonts detected on the device.
font_metrics	object	Font rendering metrics, keyed by measurement.

Network signals

Field	Type	Description
stun_ips	string[]	Local IP addresses discovered via STUN.
permission_states	object	Permission states, keyed by permission name.

WebRTC, speech, and MathML

Field	Type	Description
webrtc_supported	boolean	WebRTC support.
webrtc_hash	string	Hash of the WebRTC feature set.
webrtc_details	object	Detailed WebRTC capabilities.
webrtc_error	string	WebRTC probe error, when one occurred.
speech_synthesis_supported	boolean	Speech synthesis support.
speech_hash	string	Hash of the speech synthesis voice set.
speech_details	object	Detailed speech synthesis data.
speech_error	string	Speech probe error, when one occurred.
mathml_supported	boolean	MathML support.
mathml_hash	string	Hash of MathML rendering.
mathml_details	object	Detailed MathML rendering data.
mathml_error	string	MathML probe error, when one occurred.

Performance and battery

Field	Type	Description
fps	number	Measured frames per second.
battery_info	object	Battery state: charging, level, charging_time, discharging_time.

Incognito detection

Field	Type	Description
incognito_detected	boolean	Whether a private browsing mode was detected.
incognito_support	string	Detection method support level.
incognito_method	string	Detection method used.
incognito_quota_bytes	number	Storage quota observed during detection.

Developer tools detection

Field	Type	Description
developer_tools_detected	boolean	Whether developer tools appear to be open.
developer_tools_support	string	Detection support level.
developer_tools_method	string	Detection method used.
developer_tools_gap_px	number	Window gap in pixels used for detection.

Virtual machine detection

Field	Type	Description
virtual_machine_detected	boolean	Whether the device appears to be a virtual machine.
virtual_machine_support	string	Detection support level.
virtual_machine_reason	string	Reason the device was flagged.

Automation and tampering

Field	Type	Description
web_driver	boolean	Whether navigator.webdriver is set.
web_driver_tampered	boolean	Whether the webdriver flag appears tampered.
cdp	boolean	Chrome DevTools Protocol usage detected.
cdp_tampered	boolean	Whether CDP signals appear tampered.
tamper_injected_globals	string[]	Suspicious injected global variables.
tamper_expose_binding_leak	boolean	Binding leak associated with automation.
tamper_desc_instance_own	string[]	Anomalous own property descriptors.
tamper_desc_proto_nonnative	string[]	Non-native prototype descriptors.
tamper_xrealm_webdriver_mismatch	boolean	Cross-realm webdriver mismatch.
tamper_xrealm_renderer_delta	boolean	Cross-realm renderer difference.
tamper_probe_blocked	boolean	Whether tamper probes were blocked.

Device attestation

Field	Type	Description
device_uvpaa	boolean	User-verifying platform authenticator available.
device_client_caps_count	number	Count of reported client capabilities.
device_caps_uvpa	boolean	Platform authenticator capability.
device_apple_pay_active_card	boolean	Apple Pay has an active card.
device_payment_enrolled	boolean	Device is enrolled in a payment method.
device_serial_present	boolean	Serial capability present.
device_hid_present	boolean	HID capability present.
device_notif_static	string	Static notification capability signal.
device_notif_queried	string	Queried notification capability signal.
device_realness_probe_error	boolean	Whether a realness probe errored.

DRM

Field	Type	Description
drm_probed	boolean	Whether DRM support was probed.
drm_clearkey	boolean	Clear Key support.
drm_widevine	boolean	Widevine support.
drm_widevine_robustness	string	Widevine robustness level.
drm_externalclearkey	boolean	External Clear Key support.
drm_fairplay	boolean	FairPlay support.
drm_playready	boolean	PlayReady support.
drm_hw_secure_all	boolean	Hardware-secure decoding support.
drm_ua_brand_is_google_chrome	boolean	UA brand claims Google Chrome.
drm_error	string	DRM probe error, when one occurred.
drm_elapsed_ms	number	DRM probe duration in milliseconds.

Client-provided tags

Field	Type	Description
external_ids	object	Identifiers you attached to the fingerprint, such as accountId, orderId, or email.
extension_presence_results	object	Detected browser extensions, keyed by extension.

network_client_metrics object

Connection-level TCP and TLS characteristics.

Field	Type	Description
client_ip	string	Visitor IP address.
client_port	number	Visitor source port.
user_agent	string	User agent seen at the network layer.
js_timezone	string	Time zone reported by JavaScript.
timestamp	string	Time the network sample was taken, ISO 8601.
request_id	string	Request ID at the network layer.
protocol	string	HTTP protocol used.
quic_version	number	QUIC version, when the connection used QUIC.
syn_ip_ttl	number	IP TTL from the initial SYN packet.
syn_window_size	number	TCP window size from the initial SYN.
syn_window_scale	number	TCP window scale from the initial SYN.
tcp_rtt_usec	number	Estimated TCP round-trip time in microseconds.
tcp_rttvar_usec	number	TCP round-trip time variance.
tcp_rtt_min_usec	number	Minimum observed TCP round-trip time.
tcp_timestamp	number	TCP timestamp option value.
tcp_mss_syn	number	Advertised TCP MSS.
tcp_mss_rcv	number	Observed TCP MSS from the peer.
tls_handshake_usec	number	TLS handshake duration in microseconds.
tls_clienthello_size	number	ClientHello size in bytes.
tls_sni_format	string	SNI extension format.
tls_alpn_protocols	string[]	ALPN protocols offered in the TLS handshake.
tls_clienthello_ciphers	number[]	Offered cipher suites.
tls_clienthello_extensions	number[]	Offered TLS extensions.
tls_clienthello_signature_algs	number[]	Offered signature algorithms.
tls_clienthello_legacy_version	number	ClientHello legacy version.
tls_clienthello_supported_versions	number[]	Offered TLS versions.
tls_ja4	string	JA4 TLS client fingerprint.
matched_against	string	Domain the connection was matched against.
team_id	string	Your cside team ID.

ip_enrichment object

Data derived from the visitor IP address.

Field	Type	Description
asn	number	Autonomous System Number.
asn_name	string	ASN organization name.
asn_network	string	ASN network range.
asn_type	string	ASN type, such as hosting or isp.
city_name	string	City name.
country_code	string	Country code.
country_name	string	Country name.
latitude	number	Latitude.
longitude	number	Longitude.
postal_code	string	Postal code.
region_code	string	Region code.
region_name	string	Region name.
timezone	string	Time zone.
hosting	boolean	IP belongs to a hosting provider.
proxy	boolean	IP is a known proxy.
relay	boolean	IP is a private relay.
tor	boolean	IP is a Tor exit node.
vpn	boolean	IP is a known VPN.
service	string	Named privacy service, when identified.
maxmind_asn	number	ASN from MaxMind.
is_datacenter_ip	boolean	IP is in a datacenter range.
is_likely_datacenter	number	Datacenter likelihood score.

geo_lite_city_data object

City-level geolocation.

Field	Type	Description
city_name	string	City name.
country_code	string	Country code.
country_name	string	Country name.
latitude	number	Latitude.
longitude	number	Longitude.
postal_code	string	Postal code.
region_code	string	Region code.
region_name	string	Region name.
timezone	string	Time zone.

vpn_evaluation object

VPN likelihood and supporting signals.

Field	Type	Description
is_vpn	boolean	Whether the visitor is classified as using a VPN.
vpn_probability	number	VPN likelihood from 0 to 1.
vpn_confidence	number	Confidence in the classification from 0 to 1.
reasons	string[]	Human-readable reasons for the classification.
features	object	Numeric signals used for the classification.
context	object	Enrichment context such as reverse DNS hostname, ASN, and geo.

bot_evaluation object

Bot likelihood and verdict.

Field	Type	Description
is_bot	boolean	Whether the visitor is classified as a bot.
bot_probability	number	Bot likelihood from 0 to 1.
bot_confidence	number	Confidence in the classification from 0 to 1.
bot_agent_id	string	Identified bot, when known (for example google-googleother).
reasons	string[]	Human-readable reasons for the classification.
session_event_count	number	Number of behavioral events processed for the session.
model_1_score	number	Score from the first bot model (fingerprint and network signals).
model_1_threshold	number	Decision threshold applied to the first model score.
model_2_score	number	Score from the second bot model (behavioral signals).
model_2_threshold	number	Decision threshold applied to the second model score.
features	object	Numeric signals used for the classification.

fingerprint_enrichment object

Field	Type	Description
throwaway_email_detected	boolean	Whether an attached email uses a disposable domain.

rule_evaluations object

Field	Type	Description
rules	object[]	Named rule outcomes. Each entry has slot, rule_id, result, metadata, and computed_at.

Example record

A single record, formatted here for readability. In the file, each record is one line.

{
  "evaluation_id": "289076244130249728",
  "customer_id": "7371466449724252160",
  "customer_domain": "shop.example.com",
  "team_id": "7196353823991660544",
  "timestamp": "2026-04-21T17:53:19.378Z",
  "page_url": "https://shop.example.com/checkout",
  "client_ip": "203.0.113.42",
  "user_agent": "Mozilla/5.0 ... Chrome/124.0 Safari/537.36",
  "evaluation_status": "EVALUATION_STATUS_COMPLETED",
  "fingerprint": {
    "device_id": "fp_dev_5c8e21",
    "browser_name": "Chrome",
    "browser_version": "124.0.0.0",
    "platform": "MacIntel",
    "timezone": "America/Los_Angeles",
    "languages": ["en-US", "en"],
    "screen_width": 1512,
    "screen_height": 982,
    "device_memory": 8,
    "external_ids": { "orderId": "txn_9931" }
  },
  "network_client_metrics": {
    "client_ip": "203.0.113.42",
    "tls_ja4": "t13d1516h2_8daaf6152771_b186095e22b6"
  },
  "geo_lite_city_data": {
    "country_code": "US",
    "city_name": "San Francisco",
    "latitude": 37.7749,
    "longitude": -122.4194
  },
  "ip_enrichment": { "asn": 13335, "asn_name": "CLOUDFLARENET", "hosting": false },
  "vpn_evaluation": { "is_vpn": false, "vpn_probability": 0.04 },
  "bot_evaluation": { "is_bot": false, "bot_probability": 0.07 }
}