Response Categories, Reasons, & Identifiers Index

Each response returns the following information. These help you evaluate and act on security risks.

Context category: Groups the information by its source or nature (e.g., Request, Session, Device, Network, or Account). This allows you to pinpoint exactly what aspect of the interaction triggered a risk label. Based on the request_category value provided in the request
Risk labels: Specifies the types of risks or behavioral markers detected within that category (e.g., volume, incident, malicious cluster, or profile deviation). These labels indicate the specific security concern found.
Applicable identifiers: Lists the identifiers used to track or link the risk to a specific entity, such as a Visitor ID (vid), User ID, Email, or Socket IP. This helps connect the threat to a specific user or session. Returned as the type property in the response.
Evidence: Provides the supporting data or proof behind the assigned risk label. This includes detailed metrics like specific signature types, traffic volume thresholds, or historical incident patterns. This provides the “why” behind the risk assessment.

Each category also has their own unique risk reasons and risk identifiers. Refer to the tables below for all available categories, their associated risk reasons, and their risk identifiers.

Context Categories

The table below shows all possible context categories, their possible risk labels and identifiers, and any associated evidence. For details about what each risk label means, see Risk Reasons Reference.

Evidence is currently unavailable in this version, but will be included in future iterations. The intent is to use this evidence to understand and assign a trust score to the event, which is a combination of risk and evidence.

Context category	Risk Labels	Applicable identifiers (`type`)
`request`	`signature` `known_agent` `compromised_credential` (CI)	None
`session`	`volume` (BD) `incident` (BD) `agent_behavior` (AT)	`vid` (visitor id) `hid` (human session) `customer_defined`
`device`	`malicious_cluster`	`fingerprint` (BD/AD)
`network`	`reputation`	`ip` `ja4`
`account`	`profile_deviation` (AD ATO) `velocity` (AD) `fraud_expression` (AD ATO) `fake_account` `compromised_credential`	`account_id` `email` `password`

Risk Reasons Reference

Request

Risk Label	What it indicates	Primary attack/risk mapping	OWASP mapping
`signature`	A known signature or recognized traffic pattern.	Depends on the matched signature.	No universal mapping; may map to automation, scraping, credential abuse, or other OAT categories.
`known_agent`	Traffic associated with a recognized AI/automated agent. This is not necessarily malicious.	Agentic automation; risk depends on behavior and authorization.	No direct OAT equivalent; conditionally OAT-006 Expediting, OAT-011 Scraping, or OAT-017 Spamming.
`compromised_credential` (CI)	The supplied credential is known to have appeared in a breach.	Credential compromise; elevated risk of ATO.	OWASP API2: Broken Authentication; if replayed at scale, OAT-008 Credential Stuffing.

Session

Risk Label	What it indicates	Primary attack/risk mapping	OWASP mapping
`volume` (BD)	Abnormally high request rate or traffic volume during a session.	Automation, abuse of rate limits, or resource exhaustion.	API4: Unrestricted Resource Consumption; conditionally OxAT-006 Expediting or OAT-015 Denial of Service.
`incident` (BD)	The session previously generated a BD incident or enforcement event.	Historical suspicious-session context; not a new attack by itself.
`agent_behavior` (AT)	Behavior consistent with an autonomous or AI-driven agent.	Agentic automation or automated abuse.	No direct OAT equivalent; conditionally OAT-006 Expediting, OAT-011 Scraping, or OAT-017 Spamming.

Device

Risk Label	What it indicates	Primary attack/risk mapping	OWASP mapping
`malicious_cluster`	The device fingerprint is linked to other suspicious or malicious users.	Fraud ring, shared malicious infrastructure, or multi-account abuse.	Conditionally OAT-019 Account Creation for fake-account networks or OAT-008 Credential Stuffing for ATO networks.

Network

Risk Label	What it indicates	Primary attack/risk mapping	OWASP mapping
`reputation`	IP, ASN, proxy, VPN, TOR, hosting, or JA4 reputation is suspicious.	Malicious infrastructure or evasion signal.	Not an attack by itself; supports OAT-008, OAT-019, OAT-011, or OAT-015 depending on observed behavior.

Account

Risk Label	What it indicates	Primary attack/risk mapping	OWASP mapping
`profile_deviation` (AD)	Current device, location, or behavior deviates from the account’s historical profile.	Suspicious account activity; commonly an ATO indicator. AD uses profile deviation to detect anomalous account behavior.	OWASP API2: Broken Authentication as an outcome/supporting signal; often associated with OAT-008 Credential Stuffing when the account was accessed using stolen credentials.
`velocity` (AD)	Abnormally rapid or frequent sensitive account activity.	Automated business-flow abuse, rapid account changes, or cash-out behavior.	API6: Unrestricted Access to Sensitive Business Flows; conditionally OAT-006 Expediting or OAT-012 Cashing Out.
`fraud_expression` (AD)	A configured expression matched request, enrichment, or upstream detector output.	Rule-defined fraud behavior; not a single attack type.	Depends on trigger: fake_account → OAT-019; ATO/login abuse → OAT-007 or OAT-008; withdrawal/payment abuse → OAT-012 or OAT-001 Carding. AD Fraud Expression supports both ATO and Fake Account classifications.
`fake_account`	AD classified the activity as fake-account behavior.	Creation or operation of fraudulent accounts.	OAT-019 Account Creation — bulk creation of accounts for subsequent misuse.
`compromised_credential` (CI)	Account is associated with breached credentials.	Potential stolen-account access or ATO.	API2: Broken Authentication; OAT-008 if credentials are mass-tested/replayed.