Menu

Note: This API is for preview purposes only and is subject to change.

Device Data Collection

API v1
Last updated December 2022
Change log

When combined with order and transaction details, device data (IP Address, Device Id, Geolocation Information, etc.) can be a strong indicator for fraud or used via GeoIP lookup to create manual rules based on location. Utilizing device data with Access Exemptions is a two-step process. Step one is to collect the device data. Step two is to submit anassessmentthat will use the device data for evaluation. Described below is step one for Web (JS).

ThreatMetrix JS

ThreatMetrix JS library for web sites. It leverages the ThreatMetrix platform to detect fraud and security vulnerabilities originating from browsers in real-time.

Overview of implementation

  1. Create a JavaScript file containing the "Threatmetrix JavaScript V4" data below. The name of the file should be anonymous, e.g asdfghjkl.js

  2. Rename the function threatmetrix.profile (from the file asdfghjkl.js) to something anonymous, e.g. awddc.prfl

  3. On the web page where device data collection will occur, place the following (or similar) in the head section
    <script type="text/javascript" src="path/to/asdfghjkl.js"></script>

  4. Call the device profiling function (awddc.prfl) from the web page using the following (or similar)
    <script type="text/javascript">awddc.prfl ("PROFILING_DOMAIN", "ORGANISATION_ID", sessionid);</script>

Note: See “Details Required” section below describing function parameters

Details required

To call the device data function you need the following details:

PlaceholderDescription
ORGANISATION_ID
  • For testing use: afevfjm6
  • For live use: dzppsd1h
PROFILING_DOMAIN
  • For testing use: ddc-test.worldpay.com
  • For live use: ddc.worldpay.com
sessionIdYou must generate a unique value for the page view to represent that specific device data collection.

Note: A valid sessionId is between 30 and 128 characters long and consists of only upper or lowercase English letters (a-z, A-Z), digits (0-9), hyphens (-) or underscores (_). To make an incorrect match unlikely we recommend a UUID.

Example sessionId generation

You must submit the sessionId in theassessmentrequest in order for the device data to be applied as part of the risk assessment. Generating this in the backend as part of the page generation is recommended. Alternatively, you can generate it via JS and then submit it, so it's available in the backend.

Copied!
function create_uuid() {
  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {
   var r = Math.random() * 16 | 0,
     v = c == 'x' ? r : (r & 0x3 | 0x8);
    return v.toString(16);
 });

Call Threatmetrix function

Copied!
...
var sessionid = create_uuid(); // function to create UUID
awddc.prfl ("PROFILING_DOMAIN", "ORGANISATION_ID", sessionid); // call Threatmetrix
...

Linking the device data with the assessment

When sending theExemptions assessmentrequest include the sessionId in deviceData.collectionReference

Next steps

Assessment