[{"data":1,"prerenderedAt":108},["ShallowReactive",2],{"doc:\u002Freference\u002Fwebhooks\u002Fvisitor-suspect":3},{"page":4,"toc":105,"updated":107},{"path":5,"title":6,"seoTitle":7,"description":8,"blocks":9,"examples":93},"\u002Freference\u002Fwebhooks\u002Fvisitor-suspect","visitor.suspect","Webhook: visitor.suspect","Sent when an identification reaches the high suspect level, with the score, your threshold and every signal behind it.",[10,15,18,22,27],{"type":11,"method":12,"path":13,"auth":14},"endpoint","POST","https:\u002F\u002Fyour-server.example.com\u002Fwebhooks\u002Ffingerly","signature",{"type":16,"text":17},"p","Sent alongside `identification.completed` when an identification lands at the `high` level: its score reached the threshold in force when it was scored. Subscribe to this alone if you only act on high-risk visitors.",{"type":19,"tone":20,"text":21},"callout","note","Verify the signature before you parse the body, and answer `2xx` within 10 seconds. See [webhooks](\u002Fdocs\u002Fwebhooks#verify-the-signature).",{"type":23,"level":24,"text":25,"id":26},"heading",2,"Body","body",{"type":28,"fields":29},"fields",[30,34,37,41,44,47,50],{"name":31,"type":32,"text":33},"id","string","The event's ID, a UUIDv7. The same on every retry: deduplicate on it. Also sent as `X-Fingerly-Event-ID`.",{"name":35,"type":32,"text":36},"type","Always `visitor.suspect`.",{"name":38,"type":39,"text":40},"version","integer","The envelope version, `1`.",{"name":42,"type":32,"text":43},"organization_id","Your organization.",{"name":45,"type":32,"text":46},"environment","`live` for production traffic, `test` for staging and development.",{"name":48,"type":32,"text":49},"created_at","When the underlying fact happened, RFC 3339 in UTC. Not when it was delivered.",{"name":51,"type":52,"text":53,"children":54},"data","object","The high-risk identification.",[55,58,61,64,67,70,73,90],{"name":56,"type":32,"text":57},"request_id","The identification's request ID.",{"name":59,"type":32,"text":60},"sdk_key_id","The public key that submitted it.",{"name":62,"type":32,"text":63},"visitor_id","The visitor.",{"name":65,"type":39,"text":66},"score","The suspect score.",{"name":68,"type":32,"text":69},"level","Always `high`.",{"name":71,"type":39,"text":72},"threshold","The threshold the score was compared with.",{"name":74,"type":75,"text":76,"children":77},"triggers","array","Every signal that fired, heaviest first.",[78,81,84,87],{"name":79,"type":32,"text":80},"signal","The signal.",{"name":82,"type":32,"text":83},"group","The signal's group.",{"name":85,"type":39,"text":86},"weight","The weight it added.",{"name":88,"type":32,"text":89},"confidence","`low`, `medium` or `high`.",{"name":91,"type":32,"text":92},"tag","Your tag. Empty when none was sent.",{"titles":94,"request":97,"response":101},{"request":95,"response":96},"Headers","Payload",[98],{"label":95,"lang":99,"code":100},"http","POST \u002Fwebhooks\u002Ffingerly HTTP\u002F1.1\nContent-Type: application\u002Fjson\nUser-Agent: Fingerly-Webhooks\u002F1.0\nX-Fingerly-Event-ID: 01a0a851-0c4e-7f23-b8d1-6e2f94c0a7b5\nX-Fingerly-Event-Type: visitor.suspect\nX-Fingerly-Timestamp: 1789551672\nX-Fingerly-Signature: sha256=6f1c0a3e9b…",[102],{"label":25,"lang":103,"code":104},"json","{\n  \"id\": \"01a0a851-0c4e-7f23-b8d1-6e2f94c0a7b5\",\n  \"type\": \"visitor.suspect\",\n  \"version\": 1,\n  \"organization_id\": \"01a0a7f2-3c18-7b40-8d2e-5f6a9b1c0d37\",\n  \"environment\": \"live\",\n  \"created_at\": \"2026-09-16T09:41:12Z\",\n  \"data\": {\n    \"request_id\": \"01a0a84b-e6a2-7c09-9f51-0b3d7a26c8e4\",\n    \"sdk_key_id\": \"01a0a7f3-9e05-7a61-b4c7-2d8e0f3a6b19\",\n    \"visitor_id\": \"X9pL2mRc7KvT4bQw8NdF\",\n    \"score\": 37,\n    \"level\": \"high\",\n    \"threshold\": 30,\n    \"triggers\": [\n      {\n        \"signal\": \"tor\",\n        \"group\": \"tor\",\n        \"weight\": 14,\n        \"confidence\": \"high\"\n      },\n      {\n        \"signal\": \"automation\",\n        \"group\": \"bot\",\n        \"weight\": 9,\n        \"confidence\": \"medium\"\n      },\n      {\n        \"signal\": \"tampering\",\n        \"group\": \"browser_tampering\",\n        \"weight\": 8,\n        \"confidence\": \"medium\"\n      },\n      {\n        \"signal\": \"high_activity\",\n        \"group\": \"high_activity\",\n        \"weight\": 6,\n        \"confidence\": \"low\"\n      }\n    ],\n    \"tag\": \"checkout:8412\"\n  }\n}",[106],{"id":26,"text":25,"level":24},"2026-09-17T08:28:36.000Z",1789667797949]