Collect for an event, not forever

Profile rules

• Use a fresh action or session ID supplied by the application backend.
• Use consentFor(...) as an allowlist and field projection for minimization.
• Keep benchmark, fork-test, timing, numeric, and transaction probes off unless the flow requires them.
• Do not reuse one collection indefinitely across unrelated actions.
• Do not convert the raw event into a client-side score or verdict.

Login

Use low-cost identity, app, integrity, posture, locale, runtime, and network context. Collect immediately before submitting credentials or completing an identity-provider callback.

const loginConfig = {
  probes: {
    geolocation: {enabled: false},
    media_bluetooth_apps: {enabled: false},
    transaction_safety: {enabled: false},
    gpu_benchmark: {enabled: false},
    audio_latency: {enabled: false},
    runtime_timing: {enabled: false},
    numeric_consistency: {enabled: false},
    os_integrity_fork_test: {enabled: false},
  },
};

const observations = await deviceIntel.collect({
  sessionId: loginActionId,
  config: loginConfig,
});

Registration

Registration often needs app provenance, environment consistency, and coarse country or locale comparison. Keep precise location off unless the product has a separate documented purpose and existing permission.

Checkout or payment

Bind collection to the server-created order or payment attempt. The backend should compare freshness and action binding before using any derived feature.

const observations = await deviceIntel.collect({
  sessionId: paymentAttemptId,
  config: {
    probes: {
      application: {
        fields: {
          include: [
            "appVersion",
            "appBuild",
            "bundleId",
            "installerPackage",
            "signingCertificateSha256",
            "isDebuggable",
          ],
        },
      },
      transaction_safety: {enabled: false},
    },
  },
});

Account recovery

Account recovery is high impact. Collect current context, but keep recovery available when telemetry is missing, unavailable, or unusual. Strong authenticated recovery factors and server history remain primary.

Protected action with transaction context

transaction_safety uses a two-stage Android observation window. Collect once when the protected UI opens, then again immediately before its final action.

const protectedConfig = {
  probes: {
    transaction_safety: {enabled: true, timeoutMs: 900},
  },
};

await deviceIntel.collect({
  sessionId: protectedActionId,
  config: protectedConfig,
});

// Immediately before confirmation:
const observations = await deviceIntel.collect({
  sessionId: protectedActionId,
  config: protectedConfig,
});

Android capture observations additionally require the host to declare the applicable install-time permission. See the exact transaction integration instructions.

Send through the host API

Use your existing authenticated API client, idempotency key, retry policy, and request-size controls. The SDK performs no network request.