Logs data schema | HUMAN Documentation

HUMAN supports the following log types:

The data schema for each log type is returned with the following fields:

Block

Field Name	Data Type	Description	Value
`access_token`	String	The display name for any access token used in the request
`agent_name`	String	Detected AI agent name
`asn`	String	ISP provider for the request’s original IP. Legacy field duplicate of `true_ip_asn_name`, supported for backwards compatibility with existing integrations. Use `true_ip_asn_name` as the primary field whenever possible.
`block_score`	Number	The block score assigned by HUMAN
`breached_account`	Boolean	Whether the account was breached
`browser_family`	String	Type of browser used
`browser_version`	String	Version of the browser used
`city`	String	City the request came from
`client_ip`	String	IP the request came from
`country`	String	Country the request came from
`custom_parameterN`	String	Custom parameters as defined by the customer, where `N` is a number between 1-20. Parameters 1-10 are custom values enriched from the request, while 11-20 are custom values derived from the origin response. For example, the first custom parameter is `custom_parameter1`.
`domain`	String	Parent domain for the request derived from the location HREF (URL)
`email`	String	Email address associated with the user account, if available
`event_type`	String	Activity type	`block`
`filter_category`	String	Indicates what category the filter belongs to (for example, known bots)
`filter_id`	String	The filter identifier
`filter_origin`	String	Indicates the origin of the filter: customer or HUMAN
`filter_type`	String	The type of filter applied
`full_url`	String	Full URL of the request, including domain and request parameters
`graphql_operation_name`	String	Name of the GraphQL operation of the request
`graphql_operation_type`	String	Type of GraphQL operation of the request
`http_method`	String	HTTP method used in communication (for example, between the end user’s browser and the client’s server)
`http_status`	Number	The HTTP status of the request
`incident_types`	Array of strings	The tagged detection types that flagged the request. See Incident Types for possible values.
`ivt`	Array of strings	The tagged IVT taxonomy types that flagged the request. See IVT for possible values.
`latitude`	String	Latitudinal coordinates that the request came from
`longitude`	String	Longitudinal coordinates that the request came from
`os_family`	String	Type of operating system used in the request
`os_version`	String	Version of the operating system used in the request
`path`	String	The raw URL path extracted from the request URL (for example, `/products/123?color=red` → `/products/123`). It represents the exact endpoint requested before generalization or route mapping.
`px_app_id`	String	HUMAN App ID assigned per application
`px_client_uuid`	String	Page-view identifier designated by HUMAN
`px_vid`	String	Visitor ID designated by the HUMAN cookie
`referrer`	String	Previous page the request came from; the page that led to this request
`risk_rtt`	Number	Roundtrip time for the Risk API from the Enforcer to the Collector and back
`route`	String	The normalized internal route identity used for aggregation, detection, and route configuration. Derived from the best available representation, such as a GraphQL operation, generalized path, or raw path, and may also be associated with the HTTP method
`simulated_block`	Boolean	Whether there was actual block activity or was instead a simulation for statistics and monitoring purposes
`timestamp`	String	Time of the request
`traffic_type`	String	Traffic type: web or mobile
`true_ip`	String	Original IP for the request, ignoring CDN or load balancers
`true_ip_asn_name`	String	ISP provider for the request’s original IP
`true_ip_classification`	JSON	Known classifications or characteristics for the original IP
`user_agent`	String	User-Agent string the request came from

CAPTCHA

Field Name	Data Type	Description	Value
`access_token`	String	The display name for any access token used in the request
`agent_name`	String	Detected AI agent name
`asn`	String	ISP provider for the request’s original IP. Legacy field duplicate of `true_ip_asn_name`, supported for backwards compatibility with existing integrations. Use `true_ip_asn_name` as the primary field whenever possible.
`breached_account`	Boolean	Whether the account was breached
`browser_family`	String	Type of browser used
`browser_version`	String	Version of the browser used
`captcha_abandoned_reason`	String	Reason for why the CAPTCHA was not completed
`captcha_difficulty`	String	Difficulty level assigned to the CAPTCHA
`captcha_fail_reason`	String	Reason for why the CAPTCHA was classified as failed
`captcha_type`	String	Challenge type (for example, the HUMAN Challenge)
`challenge_render_duration`	Number	Time in milliseconds it took to render the HUMAN Challenge
`challenge_tries_count`	Number	The number of times the challenge was attempted
`city`	String	City the request came from
`client_ip`	String	IP the request came from
`country`	String	Country the request came from
`custom_parameterN`	String	Custom parameters as defined by the customer, where `N` is a number between 1-20. Parameters 1-10 are custom values enriched from the request, while 11-20 are custom values derived from the origin response. For example, the first custom parameter is `custom_parameter1`.
`domain`	String	Parent domain for the request, derived from the location HREF (URL)
`event_type`	String	Activity type	`captcha_pass`, `captcha_block*`
`filter_category`	String	Indicates what category the filter belongs to (for example, known bots)
`filter_id`	String	The filter identifier
`filter_origin`	String	Indicates the origin of the filter: customer or HUMAN
`filter_type`	String	The type of filter applied
`full_url`	String	Full URL of the request, including domain and request parameters
`http_method`	String	HTTP method used in communication (for example, between the end user’s browser and the client’s server)
`human_challenge_release_version`	String	The release number of the Human Challenge used
`incident_types`	Array of strings	The tagged detection types that flagged the request. See Incident Types for possible values.
`ivt`	Array of strings	The tagged IVT taxonomy types that flagged the request. See IVT for possible values.
`latitude`	String	Latitudinal coordinates that the request came from
`longitude`	String	Longitudinal coordinates that the request came from
`os_family`	String	Type of operating system used in the request
`os_version`	String	Version of the operating system used in the request
`path`	String	The raw URL path extracted from the request URL (for example, `/products/123?color=red` → `/products/123`). It represents the exact endpoint requested before generalization or route mapping.
`px_app_id`	String	HUMAN app ID assigned per application
`px_client_uuid`	String	Page-view identifier designated by HUMAN
`px_vid`	String	Visitor ID designated by the HUMAN cookie
`referrer`	String	Previous page the request came from, the page that led to this request
`risk_score`	Number	The risk score assigned to the request	Number between 0 and 100
`route`	String	The normalized internal route identity used for aggregation, detection, and route configuration. Derived from the best available representation, such as a GraphQL operation, generalized path, or raw path, and may also be associated with the HTTP method
`timestamp`	String	Time of the request
`total_challenge_page_time`	Number	Total time in milliseconds that the HUMAN Challenge was active, from initial page load until the Challenge was completed. This includes rendering and user interaction time.
`traffic_type`	String	Traffic type: web or mobile
`true_ip`	String	Original IP for the request, ignoring CDN or load balancers
`true_ip_asn_name`	String	ISP provider for the request’s original IP
`true_ip_classification`	JSON	Known classifications or characteristics for the original IP
`user_agent`	String	User-Agent string the request came from

Legitimate

Field Name	Data Type	Description	Value
`access_token`	String	The display name for any access token used in the request
`agent_name`	String	Detected AI agent name
`breached_account`	Boolean	Whether the account was breached
`browser_family`	String	Type of browser used
`browser_version`	String	Version of the browser used
`city`	String	City the request came from
`client_ip`	String	IP the request came from
`country`	String	Country the request came from
`custom_parameterN`	String	Custom parameters as defined by the customer, where `N` is a number between 1-20. Parameters 1-10 are custom values enriched from the request, while 11-20 are custom values derived from the origin response. For example, the first custom parameter is `custom_parameter1`.
`domain`	String	Parent domain for the request, derived from the location HREF (URL)
`email`	String	Email address associated with the user account, if available
`event_type`	String	Activity type	`legitimate`
`filter_category`	String	Indicates what category the filter belongs to (for example, known bots)
`filter_id`	String	The filter identifier
`filter_origin`	String	Indicates the origin of the filter: customer or HUMAN
`filter_type`	String	The type of filter applied
`full_url`	String	Full URL of the request, including domain and request parameters
`graphql_operation_name`	String	Name of the GraphQL operation of the request
`graphql_operation_type`	String	Type of GraphQL operation of the request
`http_method`	String	HTTP method used in communication (for example, between the end user’s browser and the client’s server)
`http_status`	Number	The HTTP status of the request
`incident_types`	Array of strings	The tagged detection types that flagged the request. See Incident Types for possible values.
`ivt`	Array of strings	The tagged IVT taxonomy types that flagged the request. See IVT for possible values.
`latitude`	String	Latitudinal coordinates that the request came from
`longitude`	String	Longitudinal coordinates that the request came from
`os_family`	String	Type of operating system used in the request
`os_version`	String	Version of the operating system used in the request
`path`	String	The raw URL path extracted from the request URL (for example, `/products/123?color=red` → `/products/123`). It represents the exact endpoint requested before generalization or route mapping.
`px_app_id`	String	HUMAN app ID assigned per application
`px_client_uuid`	String	Page-view identifier designated by HUMAN
`px_vid`	String	Visitor ID designated by the HUMAN cookie
`referrer`	String	Previous page the request came from, the page that led to this request
`request_id`	String	ID of the request
`risk_rtt`	Number	Roundtrip time for the Risk API from the Enforcer to the Collector and back
`risk_score`	Number	The risk score assigned to the request	Number between 0 and 100
`route`	String	The normalized internal route identity used for aggregation, detection, and route configuration. Derived from the best available representation, such as a GraphQL operation, generalized path, or raw path, and may also be associated with the HTTP method
`timestamp`	String	Time of the request
`traffic_type`	String	Traffic type: web or mobile
`true_ip`	String	Original IP for the request, ignoring CDN or load balancers
`true_ip_asn_name`	String	ISP provider for the request’s original IP
`true_ip_classification`	JSON	Known classifications or characteristics for the original IP
`user_agent`	String	User-Agent string the request came from

Field values

Some fields have certain values. These are listed here.

Incident Types

Type ID	Name	Description
12	UI Anomaly	User interface interaction typical of non-human users
13	Denied Service	One or more of the client’s properties was denied
14	Custom Denylist	The request was denied because of a customer-defined rule
15	Cloud Service	The request was detected as a cloud service
16	Anonymizing Service	Request originates from a Cloud Provider, VPN, Anonymizing Proxy, or spoofed IP
17	Bot Behavior	Behavioral patterns deviate from typical human activity
18	Spoof	The detected browser does not match the declared browser
19	Predictive Analytics	Anomalies in behavioral data relevant for the request
20	Automation Tool	Request properties indicate the use of an automation tool
21	Bad Reputation	Users with the same properties previously performed malicious activities
22	Volumetric Rule	Activity exceeded volumetric policy definition
23	Missing Sensor Data	JavaScript sensor information was not sent
24	Allowed Volume Exceeded	Request volume anomaly detected
25	Captcha Solving Attack	Indications of a CAPTCHA solving attack, such as solving farms or automation

IVT (Invalid Traffic Taxonomy)

Code	Category
AB	Automated Browsing
DC	Data Center
FR	False Representation
KC	Known Crawler
UC	Undisclosed Classification

Account Defender Logs

Single incidents logs

Field Name	Description
`timestamp`	Time of the request
`user_id`	Account ID as known on the customer side
`vid`	Visitor ID designated by the HUMAN cookie
`activity_type`	Activity type (e.g., fingerprint - Sensor, page_requester - Enforcer, app_info - mobile)
`device`	Hash of the device browser fingerprint
`ip`	IP the request originates from
`user_agent`	User agent the request originates from
`path`	Path the request originates from (within the customer’s domain)
`score`	Score assigned by Account Defender - an integer in the range of 1-100
`asn`	ISP provider for the request’s original IP
`country`	Country the request originates from
`state`	State the request originates from
`city`	City the request originates from
`continent`	Continent the request originates from
`carrier`	Carrier for the request’s original IP
`organization`	Network organization of the request’s original IP
`anonymizer_status`	Anonymizer status for the request’s original IP
`proxy_type`	Proxy for the request’s original IP
`hosting_facility`	Hosting for the request’s original IP
`attack_pattern`	Attack pattern classified by Account Defender
`matched_rules_names`	Account Defender rules matched against the request
`custom_param1`	Custom parameter 1 defined by the customer
`custom_param2`	Custom parameter 2 defined by the customer
`custom_param3`	Custom parameter 3 defined by the customer
`custom_param4`	Custom parameter 4 defined by the customer
`custom_param5`	Custom parameter 5 defined by the customer
`custom_param6`	Custom parameter 6 defined by the customer
`custom_param7`	Custom parameter 7 defined by the customer
`custom_param8`	Custom parameter 8 defined by the customer
`custom_param9`	Custom parameter 9 defined by the customer
`custom_param10`	Custom parameter 10 defined by the customer
`sensitive_transaction`	Classification of the path, if the path was defined as a sensitive one
`account_age`	The age of the account on the customer side (i.e., time since registration) in hours

Network incidents logs

Field Name	Description
`timestamp`	Time of incident creation
`attack_type`	An attack classification of the network incident
`score`	Score assigned by Account Defender, ranging from 1 to 100
`network_type`	Type of the network attack that was detected by Account Defender
`network_id`	ID of the network attack that was detected by Account Defender
`user_ids`	List of account IDs that are part of the network incident, as known on the customer side
`matched_rule_id`	ID of the Account Defender rule that matched against the network
`matched_rule_name`	Name of the Account Defender rule that matched against the network