Fingerprint Lookup Deprecated

GET

https://telemetry.stytch.com/v1/fingerprint/lookup

This API endpoint is deprecated. Please use the POST version of Fingerprint Lookup instead.

The POST endpoint includes support for new features like IPGEO data and avoids potential caching issues. This older GET endpoint is maintained only for compatibility for existing clients.

Lookup the associated fingerprint to the Telemetry ID returned from the GetTelemetryID(). This endpoint is deprecated and clients should use the POST version of Fingerprint Lookup instead.

Learn more about the different fingerprint types and verdicts in our DFP guide.

Make a decision based on the returned verdict:

ALLOW - This is a known valid device grouping or device profile that is part of the default ALLOW listed set of known devices by Stytch. This grouping is made up of verified device profiles that match the characteristics of known/authentic traffic origins.
BLOCK - This is a known bad or malicious device profile that is undesirable and should be blocked from completing the privileged action in question.
CHALLENGE - This is an unknown or potentially malicious device that should be put through increased friction such as 2FA or other forms of extended user verification before allowing the privileged action to proceed.

If the telemetry_id is not found, we will return a 404 telemetry_id_not_found error. We recommend treating 404 errors as a BLOCK, since it could be a sign of an attacker trying to bypass DFP protections by generating fake telemetry IDs.

Query parameters

telemetry_id* string

The telemetry ID associated with the fingerprint getting looked up.

Response fields

request_id string

Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.

status_code int

The HTTP status code of the response. Stytch follows standard HTTP response status code patterns, e.g. 2XX values equate to success, 3XX values are redirects, 4XX are client errors, and 5XX are server errors.

fingerprints object

A Stytch fingerprint consists of the following identifiers:

visitor_id string

The cookie stored on the user's device that uniquely identifies them.

browser_id string

Combination of VisitorID and NetworkFingerprint to create a clear identifier of a browser.

visitor_fingerprint string

Cookie-less way of identifying a unique user.

browser_fingerprint string

Combination of signals to identify a browser and its specific version.

hardware_fingerprint string

Combinations of signals to identify an operating system and architecture.

network_fingerprint string

Combination of signals associated with a specific network commonly known as TLS fingerprinting.

verdict object

The metadata associated with each fingerprint

action string

The suggested action based on the fingerprint review. The available actions are:

ALLOW - This is a known valid device grouping or device profile that is part of the default ALLOW listed set of known devices by Stytch. This grouping is made up of verified device profiles that match the characteristics of known/authentic traffic origins
BLOCK - This is a known bad or malicious device profile that is undesirable and should be blocked from completing the privileged action in question
CHALLENGE - This is an unknown or potentially malicious device that should be put through increased friction such as 2FA or other forms of extended user verification before allowing the privileged action to proceed

is_authentic_device boolean

The assessment of whether this is an authentic device. It will be false if hardware or browser deception is detected.

detected_device_type string

The operating system and architecture that took the fingerprint.

reasons string[]

A set of contextual clues to inform why a CHALLENGE or BLOCK action was suggested. For a list of possible Reasons, see Warning Flags (Verdict Reasons).

rule_match_type string

The type of rule match that was applied (e.g. VISITOR_ID), if any. This field will only be present if there is a RULE_MATCH reason in the list of verdict reasons.

rule_match_identifier string

The rule that was applied (e.g. a specific visitor ID value), if any. This field will only be present if there is a RULE_MATCH reason in the list of verdict reasons.

verdict_reason_overrides object

A list of verdict reason overrides that were applied, if any.

verdict_reason string

The verdict reason that was overridden.

override_action string

The action that was applied for the given verdict reason.

Fingerprint Lookup (Deprecated)

Query parameters

Response fields