Shield · Events

Events reference

The standard event catalog, how auto-detection classifies forms, and the payload the SDK sends.

Standard events

Unknown names are stored as custom.

Event	Description
`page_view`	Page loaded
`session_start`	New or resumed session
`form_view`	Form became visible
`form_submitted`	Generic form submit (low confidence)
`signup_view` / `signup_attempt` / `signup_success`	Signup funnel
`login_view` / `login_attempt` / `login_success` / `login_failed`	Login funnel
`password_reset_view` / `password_reset_attempt`	Password reset
`checkout_view` / `checkout_started`	Checkout funnel
`payment_attempt` / `payment_failed`	Payments
`lead_form_view` / `lead_submitted`	Lead / contact forms
`api_request`	API request event
`custom`	Custom / manual event

Auto-detection

Forms are classified by fields, button text, and URL.

{
  "auto_detected": true,
  "confidence": 0.94,
  "detection_method": "form_fields_button_text_url"
}

0.90–1.00Very likely

0.70–0.89Likely

0.50–0.69Maybe

Below 0.50Falls back to form_submitted

Payload schema

Sent to the ingest endpoint below.

POST https://shield.findip.net/v1/shield/track

The SDK sends the JSON payload as text/plain so requests stay CORS "simple requests" — no preflight, and sendBeacon delivery on page unload always works.

{
  "site_key": "pub_xxx",
  "sdk": { "name": "findip-shield-js", "version": "1.12.0", "integration": "javascript" },
  "event": {
    "name": "signup_attempt", "timestamp": "...", "source": "auto_form_detect",
    "auto_detected": true, "confidence": 1, "detection_method": "form_fields_button_text_signup_fields_button_signup"
  },
  "page": { "url": "...", "path": "/signup", "title": "...", "referrer": "...", "utm": {} },
  "session": {
    "session_id": "sess_xxx", "visitor_id": "vis_xxx",
    "storage": "cookie", "visitor_storage": "cookie"
  },
  "browser": { "user_agent": "...", "language": "en-US", "timezone": "..." },
  "form": {
    "field_count": 2, "has_email_field": true, "has_password_field": true,
    "has_phone_field": false, "has_payment_field": false, "has_message_field": false,
    "submit_text_type": "signup",
    "form_id": "signup-form", "form_action": "/signup",
    "outline": {
      "fields": [
        { "type": "email", "label": "Work email" },
        { "type": "password", "label": "Password" }
      ],
      "button": "Create account"
    },
    "outline_hash": "3fa9c1d2"
  },
  "customer_context": { "email_domain": "gmail.com", "plan": "free" },
  "privacy": { "mode": "balanced", "retention_hint": "standard", "consent": { "granted": true, "source": "default" } }
}

sdk.version is the version of the SDK that sent the event. session.storage and session.visitor_storage (SDK 1.11.0 and later) say where the browser keeps the two IDs; see Cookies. form is present on form events only; form.outline (1.8.0 and later) and form.outline_hash (1.9.0 and later) are described in Data Collection. Outside strict mode, browser also carries the language list, platform, screen and viewport size, and whether cookies and touch are available.

Mobile app payload

For a mobile app site, which has no website origin

A native app names the app and sends a device block in place of browser. page.path carries the screen (/screen/<name>).

{
  "site_key": "pub_xxx",
  "sdk": { "name": "findip-shield-ios-snippet", "version": "1", "integration": "ios" },
  "app": { "bundle_id": "com.example.app", "version": "4.2.1", "build": "1021" },
  "event": { "name": "login_attempt", "source": "manual" },
  "page": { "path": "/screen/login" },
  "session": { "session_id": "sess_xxx", "visitor_id": "vis_xxx", "storage": "app", "visitor_storage": "app" },
  "device": {
    "platform": "ios", "os_version": "18.1", "model_family": "iPhone",
    "locale": "en-US", "timezone": "Europe/London",
    "screen": { "width": 393, "height": 852, "scale": 3 },
    "signals": { "emulator": false, "rooted": null, "debugger": false }
  },
  "privacy": { "mode": "balanced" }
}

Field	Rule
`sdk.integration`	`ios`, `android`, `react_native`, `flutter` or `webview`. Only an app site accepts these, and an app site accepts nothing else.
`app.bundle_id`	Must match an app registered on the site, ignoring case: an iOS id for `ios`, an Android id for `android`, either for `webview`.
`device.model_family`	A family such as `iPhone` or `Pixel`, letters and spaces only. An exact model identifier is dropped.
`device.signals`	`true`, `false` or `null` (not determined). Local heuristics, never proof.
`privacy.mode: strict`	Drops `screen`, `signals` and `model_family`.

Any other field is dropped. A WebView page sends the website payload above plus app.bundle_id and "integration": "webview" (SDK 1.13.0 and later).