Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.didit.me/llms.txt

Use this file to discover all available pages before exploring further.

Device & IP Analysis emits warning tags when Didit detects suspicious device, network, or location behavior. These tags are returned in decision payloads, shown in the console, and included in reports so your team can understand why a session was approved, sent to review, or declined. The device fingerprint warnings are intentionally split into exact and recovered signals:
  • DUPLICATED_DEVICE_FINGERPRINT means the same persistent device identity was reused across sessions from different vendor_data values.
  • DEVICE_RECOVERED_HIGH_CONFIDENCE means v2 fingerprint recovery matched the session to a previously seen device after the persistent ID changed. This warning only appears when the match passes the high-confidence threshold and hard gates.
Didit Device and IP Analysis warning example with device, VPN, proxy and location-mismatch alerts

​
Automatic Decline Conditions

The following conditions always result in an automatic decline:
  • IP_ADDRESS_IN_BLOCKLIST - The IP address used for this session is in the application’s IP blocklist
  • DEVICE_FINGERPRINT_IN_BLOCKLIST - The device fingerprint used for this session is in the application’s device blocklist

​
Configurable Verification Settings

Applications can configure how the system handles various verification issues by setting actions for different risk categories:
  1. VPN/Proxy Detection
    • Risks: PRIVATE_NETWORK_DETECTED
    • Configurable action: Decline, Review, or Approve
  2. Location Discrepancy
    • Risks: COUNTRY_FROM_DOCUMENT_DOES_NOT_MATCH_COUNTRY_FROM_IP
    • Configurable action: Decline, Review, or Approve
  3. Expected IP Address Mismatch
    • Risks: EXPECTED_IP_ADDRESS_MISMATCH
    • Configurable action: Decline, Review, or Approve
  4. Duplicated IP Address
    • Risks: DUPLICATED_IP_ADDRESS
    • Configurable action: Decline, Review, or Approve (default: Approve / no action)
  5. Duplicated Device Fingerprint
    • Risks: DUPLICATED_DEVICE_FINGERPRINT
    • Configurable action: Decline, Review, or Approve (default: Approve / no action)
  6. Recovered Device Fingerprint
    • Risks: DEVICE_RECOVERED_HIGH_CONFIDENCE
    • Configurable action: Decline, Review, or Approve (default: Approve / no action)
    • Recommended rollout: start with Review while you inspect real warning volume and match context.

​
Warning Rejection Tags

These are the Device & IP Analysis warning tags and their descriptions:
TagDescription
PRIVATE_NETWORK_DETECTEDThe system detected that the user is attempting to access through a VPN, proxy, or Tor network, potentially to mask their true location.
COUNTRY_FROM_DOCUMENT_DOES_NOT_MATCH_COUNTRY_FROM_IPThe country indicated in the user’s identity or address documents does not match the country associated with their IP address.
EXPECTED_IP_ADDRESS_MISMATCHOne of the IP addresses used for this session does not match the expected IP address provided during session creation.
IP_ADDRESS_IN_BLOCKLISTThe IP address used for this session was found in the application’s IP blocklist, indicating a known suspicious or forbidden origin.
DEVICE_FINGERPRINT_IN_BLOCKLISTThe device fingerprint used for this session was found in the application’s device blocklist, indicating a known suspicious or forbidden device.
DUPLICATED_IP_ADDRESSThe same IP address was used in another session with a different vendor_data, which may indicate multiple users sharing the same network or a potential fraud pattern.
DUPLICATED_DEVICE_FINGERPRINTThe same device fingerprint was detected in another session with a different vendor_data, which may indicate multiple identities verified from the same device.
DEVICE_RECOVERED_HIGH_CONFIDENCEThe v2 device fingerprint recovery model matched this session to a previously seen device with high confidence, even though the persistent device ID changed.

​
Duplicate Device vs. Recovered Device

Use both warnings, but treat them differently:
WarningTriggerTypical meaningRecommended first action
DUPLICATED_DEVICE_FINGERPRINTExact persistent device identity or trusted duplicate fingerprint match.Strong evidence that the same device appears across different users.Review or Decline, depending on your fraud tolerance.
DEVICE_RECOVERED_HIGH_CONFIDENCEHigh-confidence v2 recovery after storage, session, or app identity changed.Strong signal for incognito/storage reset/app reinstall attempts, but intentionally separated so you can monitor it.Review first, then tighten after measuring your false-positive rate.
Recovered-device warnings are useful for detecting fraud rings that rotate accounts and sessions from the same hardware, but Didit is conservative by design. The system prefers missing some duplicate users over merging unrelated devices when the evidence is not strong enough.

​
Cross-Session Matches

When the same IP address, exact device fingerprint, or recovered device is detected across sessions belonging to different users, the system records these as matches on the Device & IP Analysis response. This helps detect when different individuals verify from the same device or network. Sessions are grouped by vendor_data: when you provide a vendor_data (your user ID), sessions with the same vendor_data are treated as the same user and excluded from matches. Without vendor_data, every session is treated as a unique user and all potential duplicates are surfaced. We strongly recommend always providing vendor_data to reduce noise. Each match includes:
  • session_id and session_number of the matching session
  • vendor_data of the matching session
  • match_type — either ip_address or device_fingerprint
  • matched_value — the actual IP or fingerprint that matched
  • device_info — device brand, model, browser, OS, platform, and fingerprint of the matched session
  • location_info — IP address, country, state, city, and VPN/data center flags of the matched session
  • recovered-device metadata when available, including the matched device and similarity band
Matches are returned in the matches array on both V2 and V3 decision endpoints under ip_analysis / ip_analyses.

​
Warning Types

Each risk is assigned a warning type based on your application’s configuration settings. Warnings fall into three severity categories: