INTEGRITY Cloudflare Docs

Account Abuse Protection Events

The descriptions below detail the fields available for account_abuse_protection_events.

AuthenticationIdentityProvider

Type: string

The identity provider used for login authentication. Only populated for login events.
Possible values are unknown | other | selfHosted | amazon | apple | discord | facebook | github | linkedin | microsoft.

AuthenticationMethod

Type: string

The authentication method used for login. Only populated for login events.
Possible values are unknown | password | sso | magicLink | biometric | passkey.

AuthenticationStatus

Type: string

The outcome of a login attempt. Only populated for login events.
Possible values are unknown | other | success | failureOther | failureUserNotFound | failureIncorrectPassword | failureAccountLocked | pendingMfa.

BotScore

Type: int

Cloudflare Bot Management score. Values from 1 (likely bot) to 99 (likely human).

ClientASN

Type: int

Client AS number.

ClientCity

Type: string

Approximate city of the client.

ClientCountry

Type: string

2-letter ISO-3166 country code of the client IP address.

ClientIP

Type: string

IP address of the client.

Email

Type: string

The email address associated with the event.

EphemeralID

Type: string

The Turnstile ephemeral device identifier, hex-encoded.

EventSource

Type: string

The source of the Account Abuse Protection event.
Possible values are cdn | api.

EventType

Type: string

The type of user action.
Possible values are login | logout | signup | warpEnrollment | profileUpdate | transaction | unknown | passwordReset | addPaymentMethod.

FraudEmailRisk

Type: string

Risk level of the email address.
Possible values are Unknown | Low | Medium | High.

Host

Type: string

The HTTP hostname requested by the visitor.

JA4

Type: string

The JA4 TLS client fingerprint.

RayID

Type: string

The RayID of the request.

Timestamp

Type: int or string

The date and time the event occurred. To specify the timestamp format, refer to Output types.

UserAgent

Type: string

The user-agent string of the visitor.

UserID

Type: string

A zone-unique identifier for the user, hex-encoded. Derived from the external user identifier provided during event submission.