Verdict schema

This page describes a successful GET /v1/verdict/{requestId} response. api_version is "2"; provenance.assessment_schema is 15. Use IDs, enums, and version fields in code. summary, headline, and detail are prose.

Top level

Field	Meaning
`request_id`	32 lowercase hex characters.
`verdict`	`contradicted`, `refused`, or `uncontradicted`.
`created_at`	UTC RFC 3339.
`signals`	The findings. See signal.
`families`	Coverage and findings per evidence family.
`contradicting_families`	Families with a verdict-bearing finding.
`provenance`	Schema, ruleset, collector, and sensor versions. Store it with any decision you must reproduce.
`network`	The visitor’s network. `null` when the routing table has no entry.
`identity`	Available scoped identifier facets and their inputs.
`concealment`	Network-class observations. Does not affect the verdict.
`record`	Everything the sensor measured and the browser claimed.
`summary`, `geometry`, `sensor`	Prose summary, latency-versus-location numbers, sensor state.

Verdicts

Verdict	Meaning
`contradicted`	Required measurement completed and a conclusive contradiction was found.
`refused`	Required measurement did not complete.
`uncontradicted`	Required measurement completed and no conclusive contradiction was found. Conditional and weak findings may still be present.

A sensor failure creates no assessment. An assessment never changes after creation.

Signal

{ "id": "stack.os-contradiction", "tier": "composite", "family": "transport-stack",
  "headline": "Operating-system claims conflict", "detail": "…" }

Tier	Effect on the verdict
`absolute`, `composite`	Sets `contradicted`, except required-measurement refusal findings, which set `refused`.
`conditional`, `weak`	Reported, no effect.

IDs are listed in the signal reference.

Family

{ "family": "transport-stack", "status": "contradicted", "highest_tier": "composite",
  "coverage": { "state": "measured" }, "signals": ["stack.os-contradiction"] }

status is contradicted, consistent, or not-assessed. coverage.state is measured, unavailable, or not-yet-ruled.

Identity

{
  "version": 3,
  "instance": "7c1e0b0e…",
  "machine": "3b2a1f0e…",
  "rendering": { "version": 1, "hash": "2e8f…", "tier": "conditional" },
  "tier": { "instance": "conditional", "machine": "conditional" },
  "components": { "display": "982x1512@2", "cores": 8, "platform": "MacIntel", "timezone": "Europe/Warsaw" }
}

Field	Meaning
`instance`	Browser instance identifier, from the hardware plus the browser’s rendered output. Absent when no rendering anchor was measured. Disabling `render` reduces coverage but other canvas/audio measurements can still supply an anchor. Distinct devices with equal rendering inputs can share it.
`machine`	Machine identifier, from display, platform, timezone, and core count. Identical stock devices in one timezone share it.
`rendering`	Optional stable Canvas/WebGL signature with its own version, independent of timezone/display declarations. Conditional; omitted if either raster is unavailable or unstable.
`version`	Compare identifiers only at the same version.
`components`	The inputs, each omitted when absent.

Version 3 normalizes portrait and landscape dimensions. Version 2 records remain version 2; do not compare identifiers across versions. All identity facets are conditional. Distinct devices can have the same normalized inputs and therefore the same identifier. Identifiers are 64 hex characters, salted per site key, and computed from the session alone. Heretic keeps no index of them and offers no lookup. Store the values you compare against.

Network

{ "asn": 133481, "country": "TH", "description": "AIS-FIBRE-AS-AP AIS Fibre",
  "category": "isp", "network_role": "access_provider", "unrouted": false, "classification_available": true }

Field	Meaning
`asn`	The network’s number.
`country`	Where the address range is registered. Can differ from the visitor’s location.
`category`	`isp`, `hosting`, `business`, `education_research`, `government_admin`, or `null`.
`network_role`	`access_provider`, `content_network`, `stub`, `tier1_transit`, `major_transit`, `midsize_transit`, or `null`.
`unrouted`	`true` when the routing table has no route for the range.
`classification_available`	`false` when no classification table was loaded.

Concealment

{ "network_class": "access", "asn": 133481, "network": "AIS-FIBRE-AS-AP AIS Fibre",
  "indicators": [], "unchecked": [], "nothing_observed": true }

network_class is hosting, access, institutional, or unknown. indicators lists what was observed; unchecked what could not be checked.

Record

The recorded browser and connection measurements. Fields inside tcp, quic, and claims depend on what the browser did.

Field	Meaning
`client_ip`, `client_port`	Where the connection came from. A VPN or proxy can be the observed source.
`network`	Same as top-level `network`.
`page`, `collect`	HTTP details of the page request and the submission: header names in order, `user_agent`, `accept_language`, `sec_ch_ua*`, `alpn`, `host`.
`tcp`	The TCP connection: `syn` (TTL, hops, window, MSS), `os_hint`, `tls` (JA4 inputs), `h2`, `handshake_rtt_us`, `clock`.
`quic`	The QUIC connection, or `null` when none joined.
`claims`	What the browser reported and measured, as submitted.
`collected_us`	Sensor time of the submission, microseconds since the Unix epoch.
`nonce`, `tenant_id`, `site_id`, `origin`, `tag`, `zero_data_retention`	Session attribution. `nonce` equals `request_id`.
`sensor_`, `alt_svc_`, `pressure_evicted`, contract versions	Sensor state at the time of the ruling.

Provenance

{ "assessment_schema": 15, "ruleset_revision": 13, "sensor_build": "<deployed build>",
  "collector_version": "0.2.5", "telemetry_contract_version": 8, "compute_probe_version": 2,
  "wasm_probe_version": 1, "wasm_artifact_sha256": "…", "identity_algorithm_version": 3,
  "geometry_reference_version": "waw-2026-01", "configuration_revision": "central-v1" }

Get started

Application integration

Collector

Challenge widget

Clearance

Frameworks and server clients

Understand Heretic

Reference

Manage and troubleshoot

Top level

Verdicts

Signal

Family

Identity

Network

Concealment

Record

Provenance

​Top level

​Verdicts

​Signal

​Family

​Identity

​Network

​Concealment

​Record

​Provenance

Top level

Verdicts

Signal

Family

Identity

Network

Concealment

Record

Provenance