What Digital Fraud Prevention Response Fields Mean

This article describes every field that DFP sends to you.

DFP sends the user’s browser JSON with an encrypted payload. The browser forwards this response to your backend, where you decrypt it with the secret key. This article describes all fields: both the fields in the response before decryption and the fields in the decrypted payload.

DFP Response Before Decryption

A DFP response looks like this:

{
  "cipher_type": "aes-256-gcm/json",
  "iv": "kUtwgQ8ket0kYwbY",
  "payload": "qaBKmqp5rmGHvqWXqvbyTDY3+M4cxO1LlB47gNOh+tRx0wq4IxhXlsNpxNtoMiegyNDDlHd3w2or8J5R8HM6HwMCKj0VeUuXn8pHd7AiTA2rESvQx8ziwKreFbgj8s1K7gbS0P+i7t0sD4dgw3tMkRB8XjAeasOBdbSZLceCgQQfKIM00HAVtyP3zbU4kybR4Z0FXcIK3q19kpaEiCqDgpXsfvrUPpOJgo3nQ0b4uhmbpb8e6BWjXSOSnzf86sQxJD6tu6aUlqUqtt3GxXuB6Ig2ffXEK9JCK7Uv0LnEAzqYJ4ZVdihIwJfrSzXW4agzRAFlSa92wwurSmXV5KBUfi1o2DuZkP+W8wiZ/5xmcSN1ZMYz/GD+WWfPVtI7FlwWSsXiKwjLm/+BcvdNv2QsSrV7gAOKJdhwPPz73bCFTvHZ7D/TYCpm5IQmQV00QPbyieBkBj/kNdp8eXLDwXgFvG+sFaBv9pXalFmvuvVtVbJMzT+WAjj9s6V95CRycR9tksCyD85l7XUuQzvYitu3m0nbd7eAeWkS0uNjsGo7vcOJtvws7q6bm1EidBgCrPknGSwJqd1LvdemKzm81SfFQoE72EzxVZ/cEedPPBFeax1NOQCtFaD/+WUl0cZa36OblMgTw4umdocEJvm9yJc=",
  "request_id": "cIK7aBF8WqM1",
  "success": true,
  "tag": "msxs6Dyk5LBzF6VnpVJ5bw=="
}

Here is what each field means.

Field Possible values Meaning

Field	Possible values	Meaning
`success`	`true`, `false`	Whether DFP processed the request successfully. `true` means successful; `false` means unsuccessful. If you receive `false`, save the `request_id` and send it to support. We will investigate the issue.
`cipher_type`	`aes-256-gcm/json`	`aes-256-gcm` is the encryption algorithm; `json` is the data format after decryption.
`iv`	Base64 string	The initialization vector used to decrypt the payload. It is sent as Base64 and is 12 bytes after decoding.
`payload`	Encrypted Base64 string	The result of analyzing technical signals from the client environment and network interaction while sending the request. This result is sent encrypted and does not include the authentication tag.
`request_id`	String	The request ID. Support uses it to find the request quickly if there is a problem with it.
`tag`	Base64 string	The AES-256-GCM authentication tag. It is used to check integrity and decrypt the payload. It is 16 bytes after decoding.

success

true, false

Whether DFP processed the request successfully. true means successful; false means unsuccessful.

If you receive false, save the request_id and send it to support. We will investigate the issue.

cipher_type

aes-256-gcm/json

aes-256-gcm is the encryption algorithm; json is the data format after decryption.

iv

Base64 string

The initialization vector used to decrypt the payload. It is sent as Base64 and is 12 bytes after decoding.

payload

Encrypted Base64 string

The result of analyzing technical signals from the client environment and network interaction while sending the request. This result is sent encrypted and does not include the authentication tag.

request_id

String

The request ID. Support uses it to find the request quickly if there is a problem with it.

tag

Base64 string

The AES-256-GCM authentication tag. It is used to check integrity and decrypt the payload. It is 16 bytes after decoding.

Decrypted Payload

After decryption, the backend receives JSON similar to this:

{
  "details": {
    "bot_hosting": false,
    "bot_score": 0.215,
    "engine": "blink",
    "hosting": false,
    "incognito": false,
    "isp_active_subnet": true,
    "mobile": false,
    "os": "macos",
    "vpn": true,
    "new_user": false,
    "confidence_score": 1
  },
  "user_id": "7d052a5b7e99b6d528646708f3422e6f",
  "referer_md5": "9f0b84073da2ef97a63c2f4179981a2e",
  "timestamp": 1780406318499,
  "version": 1,
  "custom_data": "{\"event\":\"login_attempt\"}"
}

Here is what each field means.

Field Possible values Meaning

details.bot_score

Number from 0 to 1

The likelihood that a bot sent the request. Values:

< 0.4: a regular client.
From 0.4 to 0.5: a suspicious client. Some signs of automation, browser parameter spoofing, or other anomalies were detected. When making a decision, we recommend considering the values of other fields: hosting, bot_hosting, incognito, mobile, and vpn, as well as the history of this user_id in your system.
0.5 and above: very likely a bot. Significant signs typical of automation or browser parameter spoofing were detected.

details.engine

blink, webkit, gecko, and others

The browser engine.

details.hosting

true, false

Whether the IP belongs to a hosting subnet.

details.bot_hosting

true, false

Whether the IP belongs to a hosting subnet from which we have detected bot activity or other suspicious activity.

details.incognito

true, false

Whether incognito mode is enabled in the browser.

details.isp_active_subnet

true, false

Whether the IP belongs to an active Internet service provider subnet used to connect private or corporate customers to the Internet.

details.mobile

true, false

Whether the request came from a mobile device.

details.os

String, for example linux, windows, macos, ios, android

The operating system on the device.

details.vpn

true, false

Whether a VPN is enabled.

details.new_user

true, false

Whether this client environment is visiting your resource for the first time.

details.confidence_score

Number from 0 to 1

How confident DFP is that the user_id was identified correctly.

If DFP encounters an environment that has not visited your resource before (new_user: true), it assigns a new user_id. In these cases, confidence_score is always 1.

If DFP encounters an environment that has already visited your resource, it returns the user_id linked to it. In this case, confidence_score may differ from 1. The lower the value, the more current environment parameters differ from the set DFP saw earlier. However, there are still enough matches to recognize the environment.

user_id

String

A persistent identifier of the client environment.

Put simply, it is an ID that describes a specific browser-device pair. The ID remains stable even if a user changes device, browser, or network settings. For example, if the user:

enables a VPN;
updates the operating system;
enables incognito mode;
changes the time on their computer;
updates the browser version.

The ID stays the same because the main condition is met: the device and browser are unchanged.

If the user opens another browser or sends a request from another device, you will see a different ID. This is because every browser-device pair has its own unique ID.

referer_md5

MD5 hash

The hash of the Referer header value.

The Referer value is the URL of the page where the DFP script was run. The response does not contain the URL itself; it only contains the hash. It is useful for comparing and grouping requests, for example to filter DFP checks that came from the same page.

timestamp

Unix timestamp in milliseconds

The time when DFP generated the analysis result shown in this payload.

Configure your backend not to trust responses that are more than a few seconds old. This protects you from replay attacks. Learn more.

version

Number

The version of the core software that DFP is based on.

custom_data

String

The string you passed in the request through the customData parameter. DFP returns it unchanged.

In client code, the parameter is called customData; in the decrypted payload, it is returned as custom_data. Do not worry: it is the same field, and its value is the one you set. The only difference is the naming format. customData is a JavaScript method parameter, so it uses the usual JavaScript camelCase format. custom_data is a JSON response field, so it uses snake_case.

How to Use This Data

For guidance on interpreting response field values, see How to Interpret a DFP Response.

We have also prepared instructions for using DFP in specific business scenarios: