curl --request GET \
--url https://api.poh.org/v1/sessions/{sessionId}/report \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.poh.org/v1/sessions/{sessionId}/report"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.poh.org/v1/sessions/{sessionId}/report', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.poh.org/v1/sessions/{sessionId}/report",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.poh.org/v1/sessions/{sessionId}/report"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.poh.org/v1/sessions/{sessionId}/report")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.poh.org/v1/sessions/{sessionId}/report")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"session_id": "abc123def456",
"user_id": "user-456",
"visitor_id": "1c9f6d5e-2b71-4c3a-8f0d-4e5a6b7c8d9e",
"tags": [
"intake-survey",
"checkout-flow"
],
"risk_score": 75,
"risk_explanation": "User was flagged for multiple likely bot behaviors, indicating a medium to high risk of fraud.",
"recommended_action": "Manual review or require additional verification",
"user_logs": [
{
"action": "Signed in",
"user_time": "Mar 25, 2025 14:30:45",
"unix_timestamp": 1743055845000
},
{
"action": "Navigated to /dashboard",
"user_time": "Mar 25, 2025 14:30:50",
"unix_timestamp": 1743055850000
},
{
"action": "Updated credit card",
"user_time": "Mar 25, 2025 14:32:15",
"unix_timestamp": 1743055935000
}
],
"biometric_checks": {
"agent_behavior": "Not detected",
"programmatic_typing": "Detected",
"teleporting_mouse": "Not detected",
"no_corrections": "Detected",
"all_pasted": "Unknown",
"jump_scrolling": "Detected",
"centered_clicks": "Detected",
"programmatic_clicking": "Not detected",
"external_input": "Not detected"
},
"device_checks": {
"bot": "Detected",
"virtual_machine": "Not detected",
"software_renderer": "Not detected",
"vpn": "Detected",
"tor": "Not detected",
"location_spoofing": "Unknown"
}
}Getting session data
Get the risk score, risk explanation, biometric checks, and device checks for a specific session ID. The user_logs field is also included for backward compatibility but is deprecated — use the /v1/sessions/{sessionId}/events endpoint to retrieve a session’s event log.
curl --request GET \
--url https://api.poh.org/v1/sessions/{sessionId}/report \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.poh.org/v1/sessions/{sessionId}/report"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.poh.org/v1/sessions/{sessionId}/report', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.poh.org/v1/sessions/{sessionId}/report",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.poh.org/v1/sessions/{sessionId}/report"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.poh.org/v1/sessions/{sessionId}/report")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.poh.org/v1/sessions/{sessionId}/report")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"session_id": "abc123def456",
"user_id": "user-456",
"visitor_id": "1c9f6d5e-2b71-4c3a-8f0d-4e5a6b7c8d9e",
"tags": [
"intake-survey",
"checkout-flow"
],
"risk_score": 75,
"risk_explanation": "User was flagged for multiple likely bot behaviors, indicating a medium to high risk of fraud.",
"recommended_action": "Manual review or require additional verification",
"user_logs": [
{
"action": "Signed in",
"user_time": "Mar 25, 2025 14:30:45",
"unix_timestamp": 1743055845000
},
{
"action": "Navigated to /dashboard",
"user_time": "Mar 25, 2025 14:30:50",
"unix_timestamp": 1743055850000
},
{
"action": "Updated credit card",
"user_time": "Mar 25, 2025 14:32:15",
"unix_timestamp": 1743055935000
}
],
"biometric_checks": {
"agent_behavior": "Not detected",
"programmatic_typing": "Detected",
"teleporting_mouse": "Not detected",
"no_corrections": "Detected",
"all_pasted": "Unknown",
"jump_scrolling": "Detected",
"centered_clicks": "Detected",
"programmatic_clicking": "Not detected",
"external_input": "Not detected"
},
"device_checks": {
"bot": "Detected",
"virtual_machine": "Not detected",
"software_renderer": "Not detected",
"vpn": "Detected",
"tor": "Not detected",
"location_spoofing": "Unknown"
}
}Authorizations
Use your secret API key as the bearer token
Path Parameters
The unique session identifier (from window.getRoundtableSessionId())
Response
Session data retrieved successfully
Unique identifier for the session
"abc123def456"
User identifier provided during script initialization (if any)
"user-456"
A fingerprint of the user's device and browser; sessions with the same visitor ID likely came from the same device. Currently in beta.
"1c9f6d5e-2b71-4c3a-8f0d-4e5a6b7c8d9e"
Tags associated with this session
["intake-survey", "checkout-flow"]
Overall risk score for the session (0-100). Higher scores indicate higher risk.
0 <= x <= 10075
Short explanation of the factors contributing to the risk score
"User was flagged for multiple likely bot behaviors, indicating a medium to high risk of fraud."
Suggested action based on the risk score
Auto-accept, Accept with monitoring, Manual review or require additional verification, Auto-reject or high-priority review, Unknown "Manual review or require additional verification"
Deprecated. Chronological list of user actions recorded during the session. This field will be removed soon — use the /v1/sessions/{sessionId}/events endpoint instead.
Show child attributes
Show child attributes
[
{
"action": "Signed in",
"user_time": "Mar 25, 2025 14:30:45",
"unix_timestamp": 1743055845000
},
{
"action": "Navigated to /dashboard",
"user_time": "Mar 25, 2025 14:30:50",
"unix_timestamp": 1743055850000
},
{
"action": "Updated credit card",
"user_time": "Mar 25, 2025 14:32:15",
"unix_timestamp": 1743055935000
}
]
Results of biometric analysis for bot detection
Show child attributes
Show child attributes
{
"agent_behavior": "Not detected",
"programmatic_typing": "Detected",
"teleporting_mouse": "Not detected",
"no_corrections": "Detected",
"all_pasted": "Unknown",
"jump_scrolling": "Detected",
"centered_clicks": "Detected",
"programmatic_clicking": "Not detected",
"external_input": "Not detected"
}
Results of device and network checks for environment anomalies
Show child attributes
Show child attributes
{
"bot": "Detected",
"virtual_machine": "Not detected",
"software_renderer": "Not detected",
"vpn": "Detected",
"tor": "Not detected",
"location_spoofing": "Unknown"
}

