> This page is for Applications Protection.
> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.
# Logs data schema
HUMAN supports the following log types:
* [Block](#block)
* [CAPTCHA](#captcha)
* [Legitimate](#legitimate)
* [Precheck](#precheck)
* [Account Defender Logs](#account-defender-logs)
The data schema for each log type is returned with the following fields:
## Block
| **Field Name** | **Data Type** | **Description** | **Value** |
| --------------------------------------------------------------- | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------- |
| `access_token` | String | The display name for any [access token](https://docs.humansecurity.com/applications-and-accounts/docs/bot-defender-policy-settings#access-tokens) used in the request | |
| `agent_name` | String | Detected AI agent name | |
| `asn` | String | ISP provider for the request's original IP. Legacy field duplicate of [`true_ip_asn_name`](#true_ip_asn_name-block), supported for backwards compatibility with existing integrations. Use `true_ip_asn_name` as the primary field whenever possible. | |
| `block_score` | Number | The block score assigned by HUMAN | |
| `breached_account` | Boolean | Whether the account was breached | |
| `browser_family` | String | Type of browser used | |
| `browser_version` | String | Version of the browser used | |
| `city` | String | City the request came from | |
| `client_ip` | String | IP the request came from | |
| `country` | String | Country the request came from | |
| `custom_parameterN` | String | Custom parameters as defined by the customer, where `N` is a number between 1-20. Parameters 1-10 are custom values enriched from the request, while 11-20 are custom values derived from the origin response. For example, the first custom parameter is `custom_parameter1`. | |
| `domain` | String | Parent domain for the request derived from the location HREF (URL) | |
| `email` | String | Email address associated with the user account, if available | |
| `event_type` | String | Activity type | `block` |
| `filter_category` | String | Indicates what category the filter belongs to (for example, known bots) | |
| `filter_id` | String | The filter identifier | |
| `filter_origin` | String | Indicates the origin of the filter: customer or HUMAN | |
| `filter_type` | String | The type of filter applied | |
| `full_url` | String | Full URL of the request, including domain and request parameters | |
| `graphql_operation_name` | String | Name of the GraphQL operation of the request | |
| `graphql_operation_type` | String | Type of GraphQL operation of the request | |
| `http_method` | String | HTTP method used in communication (for example, between the end user's browser and the client's server) | |
| `http_status` | Number | The HTTP status of the request | |
| `incident_types` | Array of strings | The tagged detection types that flagged the request. See [Incident Types](#incident-types) for possible values. | |
| `ivt` | Array of strings | The tagged IVT taxonomy types that flagged the request. See [IVT](#ivt-invalid-traffic-taxonomy) for possible values. | |
| `latitude` | String | Latitudinal coordinates that the request came from | |
| `longitude` | String | Longitudinal coordinates that the request came from | |
| `os_family` | String | Type of operating system used in the request | |
| `os_version` | String | Version of the operating system used in the request | |
| `path` | String | The raw URL path extracted from the request URL (for example, `/products/123?color=red` → `/products/123`). It represents the exact endpoint requested before generalization or route mapping. | |
| `px_app_id` | String | HUMAN App ID assigned per application | |
| `px_client_uuid` | String | Page-view identifier designated by HUMAN | |
| `px_vid` | String | Visitor ID designated by the HUMAN cookie | |
| `referrer` | String | Previous page the request came from; the page that led to this request | |
| `risk_rtt` | Number | Roundtrip time for the Risk API from the Enforcer to the Collector and back | |
| `route` | String | The normalized internal route identity used for aggregation, detection, and route configuration. Derived from the best available representation, such as a GraphQL operation, generalized path, or raw path, and may also be associated with the HTTP method | |
| `simulated_block` | Boolean | Whether there was actual block activity or was instead a simulation for statistics and monitoring purposes | |
| `timestamp` | String | Time of the request | |
| `traffic_type` | String | Traffic type: web or mobile | |
| `true_ip` | String | Original IP for the request, ignoring CDN or load balancers | |
| `true_ip_asn_name` | String | ISP provider for the request's original IP | |
| `true_ip_classification` | JSON | Known classifications or characteristics for the original IP | |
| `user_agent` | String | User-Agent string the request came from | |
## CAPTCHA
| **Field Name** | **Data Type** | **Description** | **Value** |
| ----------------------------------------------------------------- | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------- |
| `access_token` | String | The display name for any [access token](/applications/bot-defender-policy-settings#access-tokens) used in the request | |
| `agent_name` | String | Detected AI agent name | |
| `asn` | String | ISP provider for the request's original IP. Legacy field duplicate of [`true_ip_asn_name`](#true_ip_asn_name-captcha), supported for backwards compatibility with existing integrations. Use `true_ip_asn_name` as the primary field whenever possible. | |
| `breached_account` | Boolean | Whether the account was breached | |
| `browser_family` | String | Type of browser used | |
| `browser_version` | String | Version of the browser used | |
| `captcha_abandoned_reason` | String | Reason for why the CAPTCHA was not completed | |
| `captcha_difficulty` | String | Difficulty level assigned to the CAPTCHA | |
| `captcha_fail_reason` | String | Reason for why the CAPTCHA was classified as failed | |
| `captcha_type` | String | Challenge type (for example, the HUMAN Challenge) | |
| `challenge_render_duration` | Number | Time in milliseconds it took to render the HUMAN Challenge | |
| `challenge_tries_count` | Number | The number of times the challenge was attempted | |
| `city` | String | City the request came from | |
| `client_ip` | String | IP the request came from | |
| `country` | String | Country the request came from | |
| `custom_parameterN` | String | Custom parameters as defined by the customer, where `N` is a number between 1-20. Parameters 1-10 are custom values enriched from the request, while 11-20 are custom values derived from the origin response. For example, the first custom parameter is `custom_parameter1`. | |
| `domain` | String | Parent domain for the request, derived from the location HREF (URL) | |
| `event_type` | String | Activity type | `captcha_pass`, `captcha_block*` |
| `filter_category` | String | Indicates what category the filter belongs to (for example, known bots) | |
| `filter_id` | String | The filter identifier | |
| `filter_origin` | String | Indicates the origin of the filter: customer or HUMAN | |
| `filter_type` | String | The type of filter applied | |
| `full_url` | String | Full URL of the request, including domain and request parameters | |
| `http_method` | String | HTTP method used in communication (for example, between the end user's browser and the client's server) | |
| `human_challenge_release_version` | String | The release number of the Human Challenge used | |
| `incident_types` | Array of strings | The tagged detection types that flagged the request. See [Incident Types](#incident-types) for possible values. | |
| `ivt` | Array of strings | The tagged IVT taxonomy types that flagged the request. See [IVT](#ivt-invalid-traffic-taxonomy) for possible values. | |
| `latitude` | String | Latitudinal coordinates that the request came from | |
| `longitude` | String | Longitudinal coordinates that the request came from | |
| `os_family` | String | Type of operating system used in the request | |
| `os_version` | String | Version of the operating system used in the request | |
| `path` | String | The raw URL path extracted from the request URL (for example, `/products/123?color=red` → `/products/123`). It represents the exact endpoint requested before generalization or route mapping. | |
| `px_app_id` | String | HUMAN app ID assigned per application | |
| `px_client_uuid` | String | Page-view identifier designated by HUMAN | |
| `px_vid` | String | Visitor ID designated by the HUMAN cookie | |
| `referrer` | String | Previous page the request came from, the page that led to this request | |
| `risk_score` | Number | The risk score assigned to the request | Number between 0 and 100 |
| `route` | String | The normalized internal route identity used for aggregation, detection, and route configuration. Derived from the best available representation, such as a GraphQL operation, generalized path, or raw path, and may also be associated with the HTTP method | |
| `timestamp` | String | Time of the request | |
| `total_challenge_page_time` | Number | Total time in milliseconds that the HUMAN Challenge was active, from initial page load until the Challenge was completed. This includes rendering and user interaction time. | |
| `traffic_type` | String | Traffic type: web or mobile | |
| `true_ip` | String | Original IP for the request, ignoring CDN or load balancers | |
| `true_ip_asn_name` | String | ISP provider for the request’s original IP | |
| `true_ip_classification` | JSON | Known classifications or characteristics for the original IP | |
| `user_agent` | String | User-Agent string the request came from | |
## Legitimate
| **Field Name** | **Data Type** | **Description** | **Value** |
| ------------------------ | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------ |
| `access_token` | String | The display name for any [access token](/applications/bot-defender-policy-settings#access-tokens) used in the request | |
| `agent_name` | String | Detected AI agent name | |
| `breached_account` | Boolean | Whether the account was breached | |
| `browser_family` | String | Type of browser used | |
| `browser_version` | String | Version of the browser used | |
| `city` | String | City the request came from | |
| `client_ip` | String | IP the request came from | |
| `country` | String | Country the request came from | |
| `custom_parameterN` | String | Custom parameters as defined by the customer, where `N` is a number between 1-20. Parameters 1-10 are custom values enriched from the request, while 11-20 are custom values derived from the origin response. For example, the first custom parameter is `custom_parameter1`. | |
| `domain` | String | Parent domain for the request, derived from the location HREF (URL) | |
| `email` | String | Email address associated with the user account, if available | |
| `event_type` | String | Activity type | `legitimate` |
| `filter_category` | String | Indicates what category the filter belongs to (for example, known bots) | |
| `filter_id` | String | The filter identifier | |
| `filter_origin` | String | Indicates the origin of the filter: customer or HUMAN | |
| `filter_type` | String | The type of filter applied | |
| `full_url` | String | Full URL of the request, including domain and request parameters | |
| `graphql_operation_name` | String | Name of the GraphQL operation of the request | |
| `graphql_operation_type` | String | Type of GraphQL operation of the request | |
| `http_method` | String | HTTP method used in communication (for example, between the end user's browser and the client's server) | |
| `http_status` | Number | The HTTP status of the request | |
| `incident_types` | Array of strings | The tagged detection types that flagged the request. See [Incident Types](#incident-types) for possible values. | |
| `ivt` | Array of strings | The tagged IVT taxonomy types that flagged the request. See [IVT](#ivt-invalid-traffic-taxonomy) for possible values. | |
| `latitude` | String | Latitudinal coordinates that the request came from | |
| `longitude` | String | Longitudinal coordinates that the request came from | |
| `os_family` | String | Type of operating system used in the request | |
| `os_version` | String | Version of the operating system used in the request | |
| `path` | String | The raw URL path extracted from the request URL (for example, `/products/123?color=red` → `/products/123`). It represents the exact endpoint requested before generalization or route mapping. | |
| `px_app_id` | String | HUMAN app ID assigned per application | |
| `px_client_uuid` | String | Page-view identifier designated by HUMAN | |
| `px_vid` | String | Visitor ID designated by the HUMAN cookie | |
| `referrer` | String | Previous page the request came from, the page that led to this request | |
| `request_id` | String | ID of the request | |
| `risk_rtt` | Number | Roundtrip time for the Risk API from the Enforcer to the Collector and back | |
| `risk_score` | Number | The risk score assigned to the request | Number between 0 and 100 |
| `route` | String | The normalized internal route identity used for aggregation, detection, and route configuration. Derived from the best available representation, such as a GraphQL operation, generalized path, or raw path, and may also be associated with the HTTP method | |
| `timestamp` | String | Time of the request | |
| `traffic_type` | String | Traffic type: web or mobile | |
| `true_ip` | String | Original IP for the request, ignoring CDN or load balancers | |
| `true_ip_asn_name` | String | ISP provider for the request's original IP | |
| `true_ip_classification` | JSON | Known classifications or characteristics for the original IP | |
| `user_agent` | String | User-Agent string the request came from | |
## Field values
Some fields have certain values. These are listed here.
### Incident Types
| Type ID | Name | Description |
| ------- | ----------------------- | ------------------------------------------------------------------------------- |
| 12 | UI Anomaly | User interface interaction typical of non-human users |
| 13 | Denied Service | One or more of the client's properties was denied |
| 14 | Custom Denylist | The request was denied because of a customer-defined rule |
| 15 | Cloud Service | The request was detected as a cloud service |
| 16 | Anonymizing Service | Request originates from a Cloud Provider, VPN, Anonymizing Proxy, or spoofed IP |
| 17 | Bot Behavior | Behavioral patterns deviate from typical human activity |
| 18 | Spoof | The detected browser does not match the declared browser |
| 19 | Predictive Analytics | Anomalies in behavioral data relevant for the request |
| 20 | Automation Tool | Request properties indicate the use of an automation tool |
| 21 | Bad Reputation | Users with the same properties previously performed malicious activities |
| 22 | Volumetric Rule | Activity exceeded volumetric policy definition |
| 23 | Missing Sensor Data | JavaScript sensor information was not sent |
| 24 | Allowed Volume Exceeded | Request volume anomaly detected |
| 25 | Captcha Solving Attack | Indications of a CAPTCHA solving attack, such as solving farms or automation |
### IVT (Invalid Traffic Taxonomy)
| Code | Category |
| ---- | -------------------------- |
| AB | Automated Browsing |
| DC | Data Center |
| FR | False Representation |
| KC | Known Crawler |
| UC | Undisclosed Classification |
## Account Defender Logs
### Single incidents logs
| **Field Name** | **Description** |
| ----------------------- | ---------------------------------------------------------------------------------------- |
| `timestamp` | Time of the request |
| `user_id` | Account ID as known on the customer side |
| `vid` | Visitor ID designated by the HUMAN cookie |
| `activity_type` | Activity type (e.g., fingerprint - Sensor, page_requester - Enforcer, app_info - mobile) |
| `device` | Hash of the device browser fingerprint |
| `ip` | IP the request originates from |
| `user_agent` | User agent the request originates from |
| `path` | Path the request originates from (within the customer’s domain) |
| `score` | Score assigned by Account Defender - an integer in the range of 1-100 |
| `asn` | ISP provider for the request's original IP |
| `country` | Country the request originates from |
| `state` | State the request originates from |
| `city` | City the request originates from |
| `continent` | Continent the request originates from |
| `carrier` | Carrier for the request's original IP |
| `organization` | Network organization of the request's original IP |
| `anonymizer_status` | Anonymizer status for the request's original IP |
| `proxy_type` | Proxy for the request's original IP |
| `hosting_facility` | Hosting for the request's original IP |
| `attack_pattern` | Attack pattern classified by Account Defender |
| `matched_rules_names` | Account Defender rules matched against the request |
| `custom_param1` | Custom parameter 1 defined by the customer |
| `custom_param2` | Custom parameter 2 defined by the customer |
| `custom_param3` | Custom parameter 3 defined by the customer |
| `custom_param4` | Custom parameter 4 defined by the customer |
| `custom_param5` | Custom parameter 5 defined by the customer |
| `custom_param6` | Custom parameter 6 defined by the customer |
| `custom_param7` | Custom parameter 7 defined by the customer |
| `custom_param8` | Custom parameter 8 defined by the customer |
| `custom_param9` | Custom parameter 9 defined by the customer |
| `custom_param10` | Custom parameter 10 defined by the customer |
| `sensitive_transaction` | Classification of the path, if the path was defined as a sensitive one |
| `account_age` | The age of the account on the customer side (i.e., time since registration) in hours |
### Network incidents logs
| Field Name | Description |
| ------------------- | ---------------------------------------------------------------------------------------- |
| `timestamp` | Time of incident creation |
| `attack_type` | An attack classification of the network incident |
| `score` | Score assigned by Account Defender, ranging from 1 to 100 |
| `network_type` | Type of the network attack that was detected by Account Defender |
| `network_id` | ID of the network attack that was detected by Account Defender |
| `user_ids` | List of account IDs that are part of the network incident, as known on the customer side |
| `matched_rule_id` | ID of the Account Defender rule that matched against the network |
| `matched_rule_name` | Name of the Account Defender rule that matched against the network |