# visitor.suspect

> Sent when an identification reaches the high suspect level, with the score, your threshold and every signal behind it.

Last updated: 2026-09-17

```http
POST https://your-server.example.com/webhooks/fingerly
```

Authentication: Signed by Fingerly (`x-fingerly-signature`)

Sent alongside `identification.completed` when an identification lands at the `high` level: its score reached the threshold in force when it was scored. Subscribe to this alone if you only act on high-risk visitors.

> **Note:** Verify the signature before you parse the body, and answer `2xx` within 10 seconds. See [webhooks](https://docs.fingerly.io/docs/webhooks#verify-the-signature).

## Body

- `id` (string): The event's ID, a UUIDv7. The same on every retry: deduplicate on it. Also sent as `X-Fingerly-Event-ID`.
- `type` (string): Always `visitor.suspect`.
- `version` (integer): The envelope version, `1`.
- `organization_id` (string): Your organization.
- `environment` (string): `live` for production traffic, `test` for staging and development.
- `created_at` (string): When the underlying fact happened, RFC 3339 in UTC. Not when it was delivered.
- `data` (object): The high-risk identification.
  - `request_id` (string): The identification's request ID.
  - `sdk_key_id` (string): The public key that submitted it.
  - `visitor_id` (string): The visitor.
  - `score` (integer): The suspect score.
  - `level` (string): Always `high`.
  - `threshold` (integer): The threshold the score was compared with.
  - `triggers` (array): Every signal that fired, heaviest first.
    - `signal` (string): The signal.
    - `group` (string): The signal's group.
    - `weight` (integer): The weight it added.
    - `confidence` (string): `low`, `medium` or `high`.
  - `tag` (string): Your tag. Empty when none was sent.

## Headers

```http Headers
POST /webhooks/fingerly HTTP/1.1
Content-Type: application/json
User-Agent: Fingerly-Webhooks/1.0
X-Fingerly-Event-ID: 01a0a851-0c4e-7f23-b8d1-6e2f94c0a7b5
X-Fingerly-Event-Type: visitor.suspect
X-Fingerly-Timestamp: 1789551672
X-Fingerly-Signature: sha256=6f1c0a3e9b…
```

## Payload

```json Body
{
  "id": "01a0a851-0c4e-7f23-b8d1-6e2f94c0a7b5",
  "type": "visitor.suspect",
  "version": 1,
  "organization_id": "01a0a7f2-3c18-7b40-8d2e-5f6a9b1c0d37",
  "environment": "live",
  "created_at": "2026-09-16T09:41:12Z",
  "data": {
    "request_id": "01a0a84b-e6a2-7c09-9f51-0b3d7a26c8e4",
    "sdk_key_id": "01a0a7f3-9e05-7a61-b4c7-2d8e0f3a6b19",
    "visitor_id": "X9pL2mRc7KvT4bQw8NdF",
    "score": 37,
    "level": "high",
    "threshold": 30,
    "triggers": [
      {
        "signal": "tor",
        "group": "tor",
        "weight": 14,
        "confidence": "high"
      },
      {
        "signal": "automation",
        "group": "bot",
        "weight": 9,
        "confidence": "medium"
      },
      {
        "signal": "tampering",
        "group": "browser_tampering",
        "weight": 8,
        "confidence": "medium"
      },
      {
        "signal": "high_activity",
        "group": "high_activity",
        "weight": 6,
        "confidence": "low"
      }
    ],
    "tag": "checkout:8412"
  }
}
```