# Device Attestation

{% hint style="info" %}
The Device Attestation result must be actively parsed and evaluated within your backend as part of your core business logic. Each flag should be assessed according to your specific risk model and use case. While some attributes may require contextual evaluation depending on your policies and fraud strategy, other attributes should immediately be treated as high-risk indicators.

Please note that Device Attestation protects the SDK runtime environment only. For comprehensive application security, such as detecting app tampering, cloning, or unauthorized distribution, it is strongly recommended to implement additional protection mechanisms (e.g., Google Play Integrity or equivalent solutions) to safeguard the entire application.
{% endhint %}

### For Mobile

```json
{
  "deviceAttestation": {
    "risk": {
      "applicationStore": "receipt",
      "debugging": false,
      "hooking": false,
      "deviceMasked": false,
      "emulated": false,
      "rooted": false,
      "proxy": false,
      "gpsSpoofers": false,
      "screenSharing": false,
      "vpnRunning": false,
      "suspiciousFactoryReset": false,
      "sdkConnectionIntercepted": false,
      "payloadTampered": false
    },
    "info": {
      "identifier": "3b3464596d481243ec3dd10e776d8cd1",
      "platform": "IOS",
      "manufacturer": "apple",
      "model": "iphone14,2",
      "version": "26.2.1",
      "cpuArchitecture": "darwin kernel version 25.2.0: fri jan  9 18:26:51 pst 2026; root:xnu-12377.62.10~267/release_arm64_t8110",
      "timezone": "7",
      "userAgent": "Demo/1 CFNetwork/3860.300.31 Darwin/25.2.0",
      "ipInfo": [
        {
          "ip": "1.1.1.1",
          "countryCode": "AE"
        }
      ],
      "gpsCoordinates": []
    }
  }
}
```

### For Web

```json
{
  "deviceAttestation": {
    "risk": {
      "emulated": false,
      "proxy": false,
      "bot": false,
      "incognito": false,
      "tor": false,
      "antiFingerprintingDetected": false,
      "browserSpoofed": false
    },
    "info": {
      "identifier": "391d6baa5425b6dd3b77694d426ecf42",
      "platform": "WEB",
      "manufacturer": "Apple",
      "model": "iPhone",
      "timezone": "7",
      "userAgent": "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.2 Mobile/15E148 Safari/604.1",
      "ipInfo": [
        {
          "ip": "1.1.1.1",
          "countryCode": "AE"
        }
      ],
      "gpsCoordinates": [],
      "browserName": "Mobile Safari",
      "browserPlatform": "iPhone",
      "browserVersion": "26.2",
      "browserType": "MOBILE",
      "osName": "iOS",
      "osVersion": "18.7",
      "siteReferrer": "https://example.com"
    }
  }
}
```

### Risk Attributes

{% hint style="info" %}
In general, each risk flag listed below should be evaluated according to your own business logic and specific use case. However, certain attributes should clearly be treated as red flags when processing the SDK result on your backend. These attributes include:<br>

**applicationStore**\
**debugging**\
**hooking**\
**emulated** \
**rooted**\
**proxy**\
**sdkConnectionIntercepted**\
**payloadTampered**
{% endhint %}

| Attribute                      | Description                                                                                                                                                                | Additional info |
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------- |
| **applicationStore**           | Indicates where the app is downloaded from                                                                                                                                 | Mobile only     |
| **debugging**                  | Indicates if debugging is enabled on the device                                                                                                                            | Mobile only     |
| **hooking**                    | Indicates if the user is altering the behavior of the OS or apps by intercepting function calls or events                                                                  | Mobile only     |
| **deviceMasked**               | Indicates if the user has modified or spoofed device attributes to appear as another device                                                                                | Mobile only     |
| **emulated**                   | Indicates if the user is using the app in an emulator                                                                                                                      | Mobile and Web  |
| **rooted**                     | Indicates if the user is using a jailbroken or rooted device                                                                                                               | Mobile only     |
| **proxy**                      | Indicates if the traffic runs through a VPN, proxy, or other hosting facility                                                                                              | Mobile and Web  |
| **gpsSpoofers**                | Indicates if the user is running GPS spoofers while using the app                                                                                                          | Mobile only     |
| **screenSharing**              | Indicates if the user's screen is remotely accessed or shared to an external display                                                                                       | Mobile only     |
| **vpnRunning**                 | Indicates if the user is running VPN apps while using the app                                                                                                              | Mobile only     |
| **suspiciousFactoryReset**     | The device shows evidence of a recent or abnormal factory reset, which may indicate an attempt to hide tampering or create a clean environment for fraudulent KYC activity | Mobile only     |
| **sdkConnectionIntercepted**   | Someone is actively intercepting, modifying, or inspecting the SDK’s encrypted traffic                                                                                     | Mobile only     |
| **payloadTampered**            | Indicates if the device attestation payload was modified in transit                                                                                                        | Mobile only     |
| **bot**                        | Indicates if this is a bot activity                                                                                                                                        | Web only        |
| **incognito**                  | Indicates if the user is running a browser in incognito mode                                                                                                               | Web only        |
| **tor**                        | Indicates if the Tor browser is being used                                                                                                                                 | Web only        |
| **antiFingerprintingDetected** | Indicates if any anti-fingerprinting tools are activated. Browser fingerprint data is being intentionally modified or obfuscated                                           | Web only        |
| **browserSpoofed**             | Indicates if the user has modified or spoofed the browser attributes                                                                                                       | Web only        |

### Info Attributes

{% hint style="info" %}
The unique device identifier listed below remains consistent across multiple installations of the same app. This is valuable because it enables you to associate multiple sessions with a single device. It should be leveraged for fraud detection purposes, for example, identifying cases where the same device is used by different individuals with different ID documents.
{% endhint %}

<table><thead><tr><th>Attribute</th><th>Description</th><th>Additional info</th></tr></thead><tbody><tr><td><strong>identifier</strong></td><td>Unique device identifier</td><td><strong>Note</strong>: This is a critical information that can be used to link multiple sessions to the same device</td></tr><tr><td><strong>platform</strong></td><td>The device platform (Android, iOS, or Web)</td><td><p>Possible values: </p><pre><code>ANDROID, IOS, WEB
</code></pre></td></tr><tr><td><strong>manufacturer</strong></td><td>Device manufacturer</td><td></td></tr><tr><td><strong>model</strong></td><td>Device model</td><td></td></tr><tr><td><strong>version</strong></td><td>Device version</td><td></td></tr><tr><td><strong>cpuArchitecture</strong></td><td>CPU architecture</td><td></td></tr><tr><td><strong>ipInfo</strong></td><td>Array of IP addresses and related countries</td><td></td></tr><tr><td><strong>gpsCoordinates</strong></td><td>Array of GPS coordinates in the form astring, e.g. "lat,long"</td><td><strong>Note</strong>: GPS coordinates are accessible only if the hosting application has been granted the appropriate permissions and the end user has approved access. The Uqudo SDK does not request location permissions directly</td></tr><tr><td><strong>timezone</strong></td><td>Device timezone. A string representing the offset of a number of hours (and occasionally half or quarter hours) "ahead of GMT" or "behind GMT"</td><td></td></tr><tr><td><strong>userAgent</strong></td><td>Device user agent</td><td></td></tr><tr><td><strong>browserName</strong></td><td>Browser name, e.g. Chrome</td><td>Web only</td></tr><tr><td><strong>browserPlatform</strong></td><td>Browser platform, e.g. MacIntel</td><td>Web only</td></tr><tr><td><strong>browserVersion</strong></td><td>Browser version</td><td>Web only</td></tr><tr><td><strong>browserType</strong></td><td>Browser type, e.g. Desktop</td><td><p>Web only.<br>Possible values:</p><pre><code>DESKTOP, MOBILE
</code></pre></td></tr><tr><td><strong>osName</strong></td><td>OS name, e.g. Mac OS X</td><td>Web only</td></tr><tr><td><strong>osVersion</strong></td><td>OS version, e.g. 10.15.7</td><td>Web only</td></tr><tr><td><strong>siteReferrer</strong></td><td>Referer header content if present</td><td>Web only</td></tr></tbody></table>