Device Metadata

Markdown

This capability returns the data of the device the user captured from, alongside the results of the other contracted products.

What it does

Collects the metadata of the device used in the capture session and the risk signals detected on it (details of the data below).

It is not a validation: it never approves or rejects the process, and it never makes the process fail. Use the data in your own risk rules or internal decision engines.

Inputs

No extra field is needed. The capability uses the capture session the process already has.

• Web & Native contract: enabled in a flow contracted for your account. The process lists PROCESS_CAPACITY_DEVICE_METADATA in capacities.
• API contract: enabled in the Recipe of your API key.

Metadata depends on the Unico SDK

The Unico SDK is what collects the metadata, during the capture. An API integration may or may not use the Unico SDK:

• API with the Unico SDK: the metadata is returned as usual.
• API without the Unico SDK: there is no metadata, and the response is not_found.

Talk to your Unico contact to enable it.

Possible responses

The result comes in a deviceMetadata object:

• Web & Native contract: in authenticationInfo.deviceMetadata of Get Process.
• API contract: in deviceMetadata of Get Process.

status	Meaning
found	The device metadata was found. The fields below are filled with what the device collected.
not_found	There is no device metadata for this capture, for example an API process without the Unico SDK.
unavailable	The metadata could not be fetched at that moment. The process result is not affected.

When status is found:

Field	Type	Description
deviceId	string	Device identifier.
platform	string	Platform the capture came from, e.g. WEB, ANDROID, IOS.
ip	string	IP address of the device.
ipCountry	string	Country of the IP address.
ipGeoCoordinates	object	Location of the IP address (lat, lng).
gpsCoordinates	object	Location reported by the device GPS (lat, lng).
osName	string	Operating system name.
osVersion	string	Operating system version.
browserName	string	Browser name. Web only.
userAgent	string	Browser user agent. Web only.
appStore	string	App store your app was installed from. Native SDK only.
detectedSignals	array of strings	Groups of risk signals detected on the device. Empty when none was detected.

A field the device did not collect is absent in the Web & Native contract and null in the API contract.

detectedSignals lists only the groups detected. A group is detected when at least one of its signals was found:

Group	What it means
origin_obfuscated	The real origin of the access is hidden, for example by Tor or anti-fingerprinting tools.
untrusted_location	The location may be false, for example by a proxy, a VPN or a GPS spoofer.
environment_altered	The device environment is altered, for example an emulator or a rooted or jailbroken device.
app_manipulated	The app was tampered with, hooked or debugged.
assisted_session	Someone else may be driving the session, for example by screen sharing or a bot.
payload_untrusted	The data sent by the device was tampered with.

Not every signal exists on every platform, so the same device can show different groups on web and on the native SDK.

Availability

Surface	Supported
SDK (Android, iOS, Flutter)	✅
Web (iFrame, Redirect)	✅

Valid combinations

Device Metadata isn't part of the pre-composed flow catalog in Available flows. It is enabled in a flow contracted for your account (Web & Native contract) or in your API key's Recipe (API contract), and can be enabled together with any other Unico product in Web and SDK integrations.

Use cases that use this capability

It can be added to any Unico use case in Web and SDK integrations.