| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
Overview
Use this method to retrieve the latest Device Intelligence check result of an applicant. The result includes the devices used during applicant verification, their risk labels, and the other applicants seen on these devices.
NoteTo get the Device Intelligence check result of a specific applicant action, use Get Device check results for action.
Required permissions
To use this method:
- Your app token must have the View check results permission.
- Device Intelligence must be enabled for your account. Otherwise, the
checksarray in the response is empty.
Use case
Use this method to evaluate the device risk of an applicant after the verification. For example, check whether the applicant used a rooted device, an emulator, or an anti-detect browser, or whether the same devices were used by other applicants, as an indicator of multi-accounting or fraud. You can use the result to make your own decision on the applicant or to pass the applicant to manual review.
Request example
curl -X GET \
'https://api.sumsub.com/resources/checks/latest?applicantId=6ac7b79bdbd21a509b4a2790&type=DEVICE_CHECK' \
-H 'accept: application/json' \
-H 'X-App-Token: <your-app-token>' \
-H 'X-App-Access-Sig: <your-signature>' \
-H 'X-App-Access-Ts: <unix-timestamp>'Response explained
The response is a list with at most one check: the latest active DEVICE_CHECK of the applicant. If the applicant has no DEVICE_CHECK result yet, or Device Intelligence is not enabled for your account, the checks array is empty.
Root variables
| Field | Type | Description |
|---|---|---|
answer | String | Check answer. Matches deviceCheckInfo.riskLevel: GREEN, YELLOW, or RED. IGNORED means the check was skipped. |
checkType | String | Indicates that it is a DEVICE_CHECK check type. |
createdAt | Date | Date and time (UTC, format YYYY-MM-DD hh:mm:ss) of the check. |
id | String | Unique identifier of the check (UUID). |
deviceCheckInfo | Object | Device Intelligence check results. Absent if the check was skipped. |
deviceCheckInfo attributes
deviceCheckInfo attributes| Field | Type | Description |
|---|---|---|
riskLevel | String (Enum) | Overall risk level of the check: GREEN, YELLOW, or RED. It is RED if all of the applicant's devices are in your blocklist, and GREEN if they are all in your allowlist. Otherwise, it is the highest risk level among the devices used in the checked attempt. If no devices were captured in the attempt, it is based on the devices used by the applicant over the last 24 hours. |
blocklisted | Boolean | Returned with true if all of the applicant's devices are in your blocklist. Otherwise, omitted. |
whitelisted | Boolean | Returned with true if all of the applicant's devices are in your allowlist. Otherwise, omitted. |
devices | Array of objects | Devices used during applicant verification. May be absent. |
relatedApplicants | Array of objects | Applicants seen on the checked devices, starting with the checked applicant. The list is capped at 1000 items, so see relatedApplicantCount for the total number. May be absent. |
relatedApplicantCount | Integer | Total number of the applicants seen on the checked devices, including the checked one. May be absent. |
devices element fields
devices element fields| Field | Type | Description |
|---|---|---|
deviceId | String | Unique identifier of the device. |
info | Object | Device details. |
riskLevel | String (Enum) | Risk level of the device: GREEN, YELLOW, or RED. |
riskLabels | Array of strings | Risk labels detected on the device. See Risk labels. |
devices[].info attributes
devices[].info attributes| Field | Type | Description |
|---|---|---|
make | String | Device manufacturer (for example, Apple, Samsung). |
model | String | Device model (for example, iPhone 14 Pro). |
type | String | Device type (for example, mobile, desktop, tablet). |
platform | String | Operating system (for example, iOS, Android, Windows). |
browser | String | Browser used (for example, Safari, Chrome). |
sdkType | String (Enum) | SDK type used for device capturing:
|
relatedApplicants element fields
relatedApplicants element fields| Field | Type | Description |
|---|---|---|
applicantId | String | Unique identifier of the applicant seen on the checked devices. |
deviceIds | Array of strings | Identifiers of the checked devices the applicant was seen on. |
reviewStatus | String | Review status of the applicant at the time of the check. See review statuses. |
reviewAnswer | String | Review answer for the applicant at the time of the check: GREEN or RED. |
reviewRejectType | String | Rejection type, if the applicant was rejected: RETRY or FINAL. |
Risk labels
The following table explains the possible values of riskLabels.
| Value | Description |
|---|---|
rooted | The app is running on a rooted Android device. |
emulator | The app is running in an Android emulator instead of a physical device. |
badBot | Device activity appears to be automated, which may reflect malicious bot behavior or legitimate AI agent usage. |
tampering | An anti-detect browser is used, or the default browser behavior is tampered with. |
antiDetectBrowser | An anti-detect browser is used. Fraudsters use these browsers (for example, AdsPower, DolphinAnty, OctoBrowser, GoLogin) for multi-accounting and to avoid device identification. |
clonedApp | The request is from a cloned version of the app. |
jailbroken | The app is running on a jailbroken iOS device. |
fridaTool | The app is being tampered with using the Frida tool. |
virtualMachine | The browser is running inside virtualization software. |
locationSpoofing | The mobile device is trying to spoof its location. |
mitmAttack | The request from the app is intercepted and potentially modified. |
privacySettingsMode | Privacy settings that randomize and obfuscate signal output are enabled. |
goodBot | A well-known web crawler or other search engine bot. |
incognito | Incognito or private mode is used. |
developerTools | Developer tools were manually opened in the Chrome or Firefox browser. |
factoryReset | The device has been recently factory reset, which may be used to erase previous activity or bypass fraud detection. |
Response examples
Successful response:
{
"checks": [
{
"answer": "YELLOW",
"checkType": "DEVICE_CHECK",
"createdAt": "2026-10-28 10:15:42",
"id": "77d6c9fc-b34e-4745-832e-72f8b053ed09",
"deviceCheckInfo": {
"riskLevel": "YELLOW",
"devices": [
{
"deviceId": "abc123def456",
"info": {
"make": "Apple",
"model": "iPhone 14 Pro",
"type": "mobile",
"platform": "iOS",
"browser": "Safari",
"sdkType": "ios"
},
"riskLevel": "YELLOW",
"riskLabels": ["incognito"]
}
],
"relatedApplicants": [
{
"applicantId": "6ac7b79bdbd21a509b4a2790",
"deviceIds": ["abc123def456"],
"reviewStatus": "completed",
"reviewAnswer": "GREEN"
},
{
"applicantId": "6a8f21c0dbd21a509b4a1f33",
"deviceIds": ["abc123def456"],
"reviewStatus": "completed",
"reviewAnswer": "RED",
"reviewRejectType": "FINAL"
}
],
"relatedApplicantCount": 2
}
}
]
}No DEVICE_CHECK result yet, or Device Intelligence is not enabled:
{
"checks": []
}Possible errors
If the request fails, you will receive an HTTP response containing an error code along with a message explaining the error. For example, when applicantId is not a valid identifier:
{
"code": 400,
"correlationId": "e4491e56d5f23c319b4f901e0c8e4eb6",
"description": "Invalid id '123456789'"
}The following table lists the possible errors.
| HTTP code | Description |
|---|---|
400 | applicantId is not a valid identifier, or type is missing or not a valid check type. |
401 / 403 | The app token is missing or invalid, or does not have the View check results permission. |
404 | The applicant is not found. |
200