Skip to main content
POST
Ingest Telemetry
This is the endpoint the Android, iOS, and Flutter SDKs call automatically. Most integrations never call this directly — document it here for server-side integrations building against the SDK’s data model without using the SDK itself.
Every request must be HMAC-signed — see Authentication. Unsigned or incorrectly signed requests are rejected before any processing.

Headers

string
required
Base64-encoded HMAC-SHA256 of the raw request body, signed with your tenant’s private HMAC secret.

Body

string
required
Your tenant slug.
string
required
Persisted, install-scoped device identifier.
string
required
Fresh per app launch.
object
required
object
required
The client-computed rasp_score/rasp_action/rasp_flags — treated as advisory; InsightAI re-scores server-side from signals for the authoritative decision. See Beyond RASP — securing the pipeline for why.
object
required
Nested by detection category (root, emulator, debugger, tamper, ecosystem, network) — see RASP detection categories for what each contains.

Response

string
accepted
integer
Server-recomputed score (0–100).
string
Server-recomputed action — this, not the client-submitted one, is authoritative.
Example response