Time	Status	User Agent
Retrieving recent requests…

Time

Status

User Agent

Retrieving recent requests…

Overview

Use this method to retrieve the latest Device Intelligence check result of an applicant action. The result includes the devices used in the checked attempt, their risk labels, and the other applicants seen on these devices.

Required permissions

To use this method:

Your app token must have the View check results permission.
Device Intelligence must be enabled for your account. Otherwise, the checks array in the response is empty.

Request example

curl -X GET \
     'https://api.sumsub.com/resources/api/applicantActions/6ac7b8a2dbd21a509b4a27a8/checks/latest?type=DEVICE_CHECK' \
     -H 'accept: application/json' \
     -H 'X-App-Token: <your-app-token>' \
     -H 'X-App-Access-Sig: <your-signature>' \
     -H 'X-App-Access-Ts: <unix-timestamp>'

Note
The type query parameter must be DEVICE_CHECK. The method has no other parameters.

Response explained

The response represents a singleton list of checks. If the action has no DEVICE_CHECK result yet, or Device Intelligence is not enabled for your account, the checks array is empty.

Root variables

The root variables are the core DEVICE_CHECK check result data items. Some of them include nested attributes and element fields.

Field	Type	Description
`answer`	String	Check answer: `GREEN` — no issues found. `YELLOW` — the check found issues that require attention. `RED` — the check found high-risk issues. `IGNORED` — the check was skipped.
`checkType`	String	Indicates that it is a `DEVICE_CHECK` check type.
`createdAt`	Date	Date and time (UTC, format `YYYY-MM-DD hh:mm:ss`) of the latest `DEVICE_CHECK` check result.
`id`	String	Unique identifier of the check.
`deviceCheckInfo`	Object	Includes the `DEVICE_CHECK` check results. It is absent if the check was skipped.

`deviceCheckInfo` attributes

Field	Type	Description
`riskLevel`	String (Enum)	Overall risk level of the check: `GREEN`, `YELLOW`, or `RED`. It is computed from the risk labels of the devices and the applicants related through them.
`blocklisted`	Boolean	`true` if all checked devices are in your blocklist.
`whitelisted`	Boolean	`true` if all checked devices are in your allowlist.
`devices`	Array of objects	Devices used in the checked attempt.
`relatedApplicants`	Array of objects	Applicants seen on the checked devices, starting with the checked applicant. The list is capped, so see `relatedApplicantCount` for the total number.
`relatedApplicantCount`	Integer	Total number of the applicants seen on the checked devices, including the checked one. It may be bigger than the number of the objects in `relatedApplicants`.

`devices` element fields

Field	Type	Description
`deviceId`	String	Unique identifier of the device.
`info`	Object	Device details.
`riskLevel`	String (Enum)	Risk level of the device: `GREEN`, `YELLOW`, or `RED`. It is computed from the device risk labels and the applicants related through the device.
`riskLabels`	Array of strings	Risk labels detected on the device. See risk labels.

`info` attributes

Field	Type	Description
`make`	String	Device manufacturer (for example, `Apple`, `Samsung`).
`model`	String	Device model (for example, `iPhone 14 Pro`).
`type`	String	Device type (for example, `mobile`, `desktop`, `tablet`).
`platform`	String	Operating system (for example, `iOS`, `Android`, `Windows`).
`browser`	String	Browser used (for example, `Safari`, `Chrome`).
`sdkType`	String	SDK type used for device capturing (for example, `js`, `android`, `ios`).

`relatedApplicants` element fields

Field	Type	Description
`applicantId`	String	Unique identifier of the applicant seen on the checked devices.
`deviceIds`	Array of strings	Identifiers of the checked devices the applicant was seen on.
`reviewStatus`	String	Review status of the applicant at the time of the check. See review statuses.
`reviewAnswer`	String	Review answer for the applicant at the time of the check: `GREEN` or `RED`.
`reviewRejectType`	String	Rejection type, if the applicant was rejected: `RETRY` or `FINAL`.

Risk labels

The following table explains the possible values of riskLabels.

Value	Description
`rooted`	The app is running on a rooted Android device.
`emulator`	The app is running in an Android emulator instead of a physical device.
`badBot`	Device activity appears to be automated, which may reflect malicious bot behavior or legitimate AI agent usage.
`tampering`	An anti-detect browser is used, or the default browser behavior is tampered with.
`antiDetectBrowser`	An anti-detect browser is used. Fraudsters use these browsers (for example, AdsPower, DolphinAnty, OctoBrowser, GoLogin) for multi-accounting and to avoid device identification.
`clonedApp`	The request is from a cloned version of the app.
`jailbroken`	The app is running on a jailbroken iOS device.
`fridaTool`	The app is being tampered with using the Frida tool.
`virtualMachine`	The browser is running inside virtualization software.
`locationSpoofing`	The mobile device is trying to spoof its location.
`mitmAttack`	The request from the app is intercepted and potentially modified.
`privacySettingsMode`	Privacy settings that randomize and obfuscate signal output are enabled.
`goodBot`	A well-known web crawler or other search engine bot.
`incognito`	Incognito or private mode is used.
`developerTools`	Developer tools were manually opened in the Chrome or Firefox browser.
`factoryReset`	The device has been recently factory reset, which may be used to erase previous activity or bypass fraud detection.

Response examples

If the request is successfully processed, you will get a response like the one below.

{
  "checks": [
    {
      "answer": "YELLOW",
      "checkType": "DEVICE_CHECK",
      "createdAt": "2026-10-28 10:15:42",
      "id": "6ac7b8b4dbd21a509b4a27c1",
      "deviceCheckInfo": {
        "riskLevel": "YELLOW",
        "blocklisted": false,
        "whitelisted": false,
        "devices": [
          {
            "deviceId": "abc123def456",
            "info": {
              "make": "Apple",
              "model": "iPhone 14 Pro",
              "type": "mobile",
              "platform": "iOS",
              "browser": "Safari",
              "sdkType": "ios"
            },
            "riskLevel": "YELLOW",
            "riskLabels": ["incognito"]
          }
        ],
        "relatedApplicants": [
          {
            "applicantId": "6ac7b79bdbd21a509b4a2790",
            "deviceIds": ["abc123def456"],
            "reviewStatus": "completed",
            "reviewAnswer": "GREEN"
          },
          {
            "applicantId": "6a8f21c0dbd21a509b4a1f33",
            "deviceIds": ["abc123def456"],
            "reviewStatus": "completed",
            "reviewAnswer": "RED",
            "reviewRejectType": "FINAL"
          }
        ],
        "relatedApplicantCount": 2
      }
    }
  ]
}

If the action has no DEVICE_CHECK result yet, or Device Intelligence is not enabled for your account, the checks array is empty.

{
  "checks": []
}

If the request fails, you will receive an HTTP response containing an error code along with a message explaining the error.

// This example shows the response when `actionId` is not a valid identifier.

{
  "code": 400,
  "correlationId": "e4491e56d5f23c319b4f901e0c8e4eb6",
  "description": "Invalid id '123456789'"
}

Possible errors

HTTP code	Description
`400`	`actionId` is not a valid identifier, or `type` is missing or not a valid check type.
`401` / `403`	The app token is missing or invalid, or does not have the View check results permission.
`404`	The applicant action is not found.

Overview

Required permissions

Request example

Note

Response explained

Root variables

deviceCheckInfo attributes

devices element fields

info attributes

relatedApplicants element fields

Risk labels

Response examples

Possible errors

`deviceCheckInfo` attributes

`devices` element fields

`info` attributes

`relatedApplicants` element fields