ShieldLabs

aid: shieldlabs
name: ShieldLabs
description: 'Anonymous visitor identification and fraud-prevention platform. A browser ES-module snippet loaded from cdn.shieldlabs.ai
  collects 100+ device and network signals and returns six persistent identifiers (DeviceID, VisitorID, CookieID, SessionID,
  RequestID and a caller-supplied hashed UserHID) plus an explainable 0-100 Risk Score built from weighted anonymity signals
  — VPN, proxy, Tor, privacy relay, datacenter, IP reputation, anti-detect browser, geolocation spoofing, OS mismatch, incognito,
  browser automation and suspicious paid clicks. ShieldLabs deliberately makes no allow/challenge/block decision: it returns
  the score and the signals behind it, and the customer''s own code owns the verdict. Delivery is a signed at-most-once webhook
  (identification.scored, HMAC-SHA256 in X-Shield-Signature, no retries), backed by two server-side REST surfaces on account.shieldlabs.ai
  and api.shieldlabs.ai — both read-only, neither consuming request balance — described by a public OpenAPI 3.1 specification
  the company maintains in its own MIT-licensed GitHub repo and serves from its docs host. The Management API''s history path
  was deprecated on 2026-09-01 with a dated Sunset of 2027-01-01, a named successor, and RFC 8594 Deprecation/Sunset/Link
  headers. Self-serve and per-identification priced, with a 5,000-identification free tier and no sales gate.'
deliveryModel:
  model: unknown
  open_source: unknown
  commercial: true
  callable_host: true
  label: Delivery model not determined — needs a product licence on record
  confidence: low
  source:
  - openapi
  - pricing
  - repository-unlicensed
  generated: '2026-08-28'
  method: derived
accessModel:
  pricing: freemium
  onboarding: self-serve
  trial: false
  try_now: true
  public: false
  label: Freemium · Self-serve signup
  confidence: high
  source:
  - plans
  - authentication
  - rate-limits
  - security
  - sandbox
  generated: '2026-09-03'
  method: derived
image: https://shieldlabs.ai/og/home.png
url: https://shieldlabs.apievangelist.com/apis.yml
created: '2026-08-19'
modified: '2026-09-04'
specificationVersion: '0.21'
tags:
- Fraud Detection
- Abuse Prevention
- Visitor Identification
- Device Fingerprinting
- Bot Detection
- vpn-proxy-detection
- Risk Scoring
- Identity
- Security
- Webhook
- Anti-Fraud
- traffic-quality
tags_raw:
- fraud-detection
- abuse-prevention
- visitor-identification
- device-fingerprinting
- bot-detection
- vpn-proxy-detection
- risk-scoring
- identity
- security
- webhooks
- anti-fraud
- traffic-quality
apis:
- aid: shieldlabs:shieldlabs-history-api-api
  name: ShieldLabs History API
  description: Recommended snapshot reads on account.shieldlabs.ai. Authenticated with a Private API Key. Response envelope
    `{ data, total }`, limit/offset pagination, newest first. Free — reads do not consume request balance. Carries its own
    soft rate limit of 15 requests per second per site.
  humanURL: https://docs.shieldlabs.ai/api/overview
  baseURL: https://account.shieldlabs.ai/api
  tags:
  - history-api
  properties:
  - type: OpenAPI
    url: openapi/shieldlabs-history-api-api-openapi.yml
  - type: JSONSchema
    url: json-schema/shieldlabs-identification-scored.schema.json
  - type: Examples
    url: examples/shieldlabs-identification-scored-example.json
  - type: Documentation
    url: https://docs.shieldlabs.ai/api/overview
  - type: Documentation
    url: https://docs.shieldlabs.ai/api/server-api
  - type: Documentation
    url: https://docs.shieldlabs.ai/api/webhooks
  - type: APIReference
    url: https://docs.shieldlabs.ai/api/server-api
  - type: DataModel
    url: data-model/shieldlabs-data-model.yml
  - type: ToolCrosswalk
    url: mcp/shieldlabs-tool-crosswalk.yml
  - type: LLMsTxt
    url: https://shieldlabs.ai/llms.txt
  - type: LLMsTxt
    url: https://docs.shieldlabs.ai/llms.txt
- aid: shieldlabs:shieldlabs-management-api-api
  name: ShieldLabs Management API
  description: 'Profile and balance on api.shieldlabs.ai. Authenticated with Secret Key headers (`Authorization: Bearer` plus
    `X-Shield-Domain`). Its `GET /v1/history` path returns a PascalCase JSON array and is DEPRECATED with a Sunset of 2027-01-01
    — use the History API instead. Legacy path authentication carries the same sunset date.'
  humanURL: https://docs.shieldlabs.ai/api/overview
  baseURL: https://api.shieldlabs.ai
  tags:
  - Management API
  tags_raw:
  - management-api
  properties:
  - type: OpenAPI
    url: openapi/shieldlabs-management-api-api-openapi.yml
  - type: JSONSchema
    url: json-schema/shieldlabs-identification-scored.schema.json
  - type: Examples
    url: examples/shieldlabs-identification-scored-example.json
  - type: Documentation
    url: https://docs.shieldlabs.ai/api/overview
  - type: Documentation
    url: https://docs.shieldlabs.ai/api/server-api
  - type: Documentation
    url: https://docs.shieldlabs.ai/api/webhooks
  - type: APIReference
    url: https://docs.shieldlabs.ai/api/server-api
  - type: DataModel
    url: data-model/shieldlabs-data-model.yml
  - type: ToolCrosswalk
    url: mcp/shieldlabs-tool-crosswalk.yml
  - type: LLMsTxt
    url: https://shieldlabs.ai/llms.txt
  - type: LLMsTxt
    url: https://docs.shieldlabs.ai/llms.txt
- aid: shieldlabs:shieldlabs-shieldlabs-api-api
  name: ShieldLabs ShieldLabs API
  description: The event half of the ShieldLabs contract. This document carries no REST paths — it holds the OpenAPI 3.1 top-level
    `webhooks` object describing `identification.scored`, the signed at-most-once envelope ShieldLabs POSTs to a customer
    endpoint after a visit is scored, plus the payload, signal, detection-flag and traffic-source schemas behind it.
  humanURL: https://docs.shieldlabs.ai/api/overview
  baseURL: https://api.shieldlabs.ai
  tags:
  - ShieldLabs API
  properties:
  - type: OpenAPI
    url: openapi/shieldlabs-shieldlabs-api-api-openapi.yml
  - type: JSONSchema
    url: json-schema/shieldlabs-identification-scored.schema.json
  - type: Examples
    url: examples/shieldlabs-identification-scored-example.json
  - type: Documentation
    url: https://docs.shieldlabs.ai/api/overview
  - type: Documentation
    url: https://docs.shieldlabs.ai/api/server-api
  - type: Documentation
    url: https://docs.shieldlabs.ai/api/webhooks
  - type: APIReference
    url: https://docs.shieldlabs.ai/api/server-api
  - type: DataModel
    url: data-model/shieldlabs-data-model.yml
  - type: ToolCrosswalk
    url: mcp/shieldlabs-tool-crosswalk.yml
  - type: LLMsTxt
    url: https://shieldlabs.ai/llms.txt
  - type: LLMsTxt
    url: https://docs.shieldlabs.ai/llms.txt
maintainers:
- FN: ShieldLabs
  url: https://shieldlabs.ai
  email: contact@shieldlabs.ai
generated:
  by: apis.io/add
  model: claude-opus-4-8
  confidence: 90
  at: '2026-08-19T16:02:26.724Z'
common:
- type: Website
  url: https://shieldlabs.ai
- type: License
  name: MIT
  url: https://github.com/ShieldLabs-ai/shieldlabs-openapi/blob/main/LICENSE
- type: Overlay
  url: overlays/shieldlabs-server-api-overlay.yaml
- type: DeveloperPortal
  url: https://docs.shieldlabs.ai/
- type: Documentation
  url: https://docs.shieldlabs.ai/
- type: APIReference
  url: https://docs.shieldlabs.ai/api/server-api
- type: GettingStarted
  url: https://docs.shieldlabs.ai/quickstart
- type: Support
  url: https://docs.shieldlabs.ai/support
- type: Blog
  url: https://shieldlabs.ai/blog
- type: BlogRSS
  url: https://shieldlabs.ai/rss.xml
- type: GitHubOrganization
  url: https://github.com/ShieldLabs-ai
- type: SourceCode
  url: https://github.com/ShieldLabs-ai/shieldlabs-openapi
- type: Pricing
  url: https://shieldlabs.ai/pricing
- type: SignUp
  url: https://app.shieldlabs.ai/signup
- type: Login
  url: https://app.shieldlabs.ai/login
- type: TermsOfService
  url: https://docs.shieldlabs.ai/legal/terms
- type: PrivacyPolicy
  url: https://docs.shieldlabs.ai/legal/privacy-policy
- type: Twitter
  url: https://x.com/Shieldlabs_ai
- type: LinkedIn
  url: https://www.linkedin.com/company/shieldlabs-ai
- type: Authentication
  url: authentication/shieldlabs-authentication.yml
- type: Conventions
  url: conventions/shieldlabs-conventions.yml
- type: Idempotency
  url: conventions/shieldlabs-conventions.yml
- type: ErrorCatalog
  url: errors/shieldlabs-problem-types.yml
- type: RateLimits
  url: rate-limits/shieldlabs-rate-limits.yml
- type: Plans
  url: plans/shieldlabs-plans-pricing.yml
- type: Lifecycle
  url: lifecycle/shieldlabs-lifecycle.yml
- type: Deprecation
  url: lifecycle/shieldlabs-lifecycle.yml
- type: ChangeLog
  url: changelog/shieldlabs-changelog.yml
- type: ChangeLog
  url: https://docs.shieldlabs.ai/changelog
- type: Webhooks
  url: asyncapi/shieldlabs-webhooks.yml
- type: Sandbox
  url: sandbox/shieldlabs-sandbox.yml
- type: Components
  url: components/shieldlabs-components.yml
- type: Packages
  url: packages/shieldlabs-packages.yml
- type: SDKs
  url: packages/shieldlabs-packages.yml
- type: Conformance
  url: conformance/shieldlabs-conformance.yml
- type: Security
  url: https://docs.shieldlabs.ai/security
- type: VulnerabilityDisclosure
  url: security/shieldlabs-vulnerability-disclosure.yml
- type: DomainSecurity
  url: security/shieldlabs-domain-security.yml
- type: WellKnown
  url: well-known/shieldlabs-well-known.yml
- type: MCPServer
  url: mcp/shieldlabs-mcp.yml
- type: ToolCrosswalk
  url: mcp/shieldlabs-tool-crosswalk.yml
- type: AgentCard
  url: a2a/shieldlabs-a2a.yml
- type: AgentSkill
  url: skills/_index.yml
- type: LLMsTxt
  url: llms/shieldlabs-llms.txt
- type: LLMsFullTxt
  url: https://shieldlabs.ai/llms-full.txt
- type: LLMsTxt
  url: https://shieldlabs.ai/llms.txt
- type: SDKs
  url: https://github.com/orgs/ShieldLabs-ai/repositories
  note: JS, React, Next.js, Vue, Node, Python, Go, PHP + runnable examples; first-party pointer, org page verified.
x-enrichment:
  date: '2026-09-05'
  status: nochange
  artifacts_added: 0
  pass: local-v3
x-coverage:
  state: covered
  reason: already-covered
  detail: Full local-v3 profile from 2026-09-04 re-verified 2026-09-05 — the upstream OpenAPI at docs.shieldlabs.ai/references/openapi.yaml
    (200, 17,881b), the A2A agent card, the .well-known/mcp.json descriptor, the docs llms.txt and the anonymous MCP tools/list
    are all byte-identical to the saved artifacts, and the changelog carries no entry newer than August 2026.
  evidence:
  - url: https://docs.shieldlabs.ai/references/openapi.yaml
    status: 200
  - url: https://docs.shieldlabs.ai/.well-known/agent-card.json
    status: 200
  - url: https://docs.shieldlabs.ai/mcp
    status: 200
  - url: https://docs.shieldlabs.ai/llms.txt
    status: 200
  checked: '2026-09-05'
x-evidence:
  round: '2026-08-19'
  admitted_from: Add-API gate auto-publish, submission shieldlabs-b6a2bad8 at 16:05:29 UTC, confidence 90. A FIRST attempt
    11 minutes earlier (shieldlabs-d19973c6, 15:54:05) carried the bare name with no URL, so the gate had nothing to research
    and parked it at confidence 2. That record was dropped as superseded, not as a rejection.
  slug: No rename needed — shieldlabs.ai already yields shieldlabs under the domain rule.
  host_health: shieldlabs.ai 200 / invented path 404. docs.shieldlabs.ai 200 / 404. api.shieldlabs.ai 404 on both, an API
    host with no root route. Checked with BOTH a default and a browser user-agent and the bytes are identical — unlike two
    providers profiled earlier today, ShieldLabs filters nobody.
  found_by_pipeline_not_by_my_probes: "My contract-discovery probes MISSED both of the following, and the enrichment pipeline\
    \ found them. Recorded because the probe list is what was wrong, not the provider.\n  OpenAPI  https://docs.shieldlabs.ai/references/openapi.yaml\
    \ — 200 text/yaml 18,115b, valid OpenAPI 3.1.0, \"ShieldLabs API\" v1.2, 3 paths, servers account.shieldlabs.ai/api and\
    \ api.shieldlabs.ai. I had probed /openapi.json and /openapi.yaml at the docs ROOT only.\n  MCP      https://docs.shieldlabs.ai/mcp\
    \ with a descriptor at /.well-known/mcp.json. An anonymous tools/list returns real tools over SSE. I had probed /_mcp/server,\
    \ the Mintlify path seen on another provider, and not /mcp."
  mcp_scope_note: The MCP server is REAL and unauthenticated, and it is a DOCUMENTATION server emitted by the Mintlify docs
    platform — not a ShieldLabs Server API server. Its tools search and read the docs corpus; none call the History or Management
    API, none identify a visitor, none return a Risk Score. An agent can learn how to integrate ShieldLabs through MCP but
    cannot transact with it. Recorded so the MCPServer pointer is not read as a transactional agent surface.
  two_llms_txt: Both shieldlabs.ai/llms.txt (9,660b) and docs.shieldlabs.ai/llms.txt (12,291b) are real text/plain. The submission
    recorded only the apex one.
  round_2026_09_04: 'Re-profiled under the local-v3 contract. THE CONTRACT MOVED UNDER US, WHICH IS THE FINDING OF THE ROUND.
    The provider changed its published OpenAPI three times between 2026-09-01 and 2026-09-03: it marked GET /v1/history deprecated
    and removed a per-row billing claim (and that path''s 402 response) on the 1st, stripped internal repository and Go type
    names from the spec and the webhook JSON Schema on the 2nd, and documented Sunset 2027-01-01 with a named successor and
    RFC 8594 Deprecation/Sunset/Link headers on the 3rd. RFC 8594 conformance flipped false to true and a Deprecation pointer
    is now emitted; it was correctly absent before because the deprecation did not exist. All four OpenAPI documents were
    re-harvested and re-split from the current upstream, and three superseded pre-scrub copies were pruned from openapi/_original/
    so a future re-split cannot resurrect the internal service names the provider deliberately removed.'
  round_2026_09_04_corrections: 'Four facts this catalog previously published about ShieldLabs were WRONG and are corrected,
    each against the provider''s own current words. The per-IP rate limit is 15 requests/minute, not 20. The ban that follows
    is 10 minutes, not one hour. The History API is no longer exempt from rate limiting — it now carries a 15 requests/second
    per-site soft cap. And the deprecated Management History path does not bill per returned row; the provider''s DRIFT.md
    says plainly that "code does not debit". The first three corrections come from an August 2026 changelog entry that names
    the numbers it got wrong ("not 20/minute and not a 1-hour ban"), which is why this was a correction rather than a drift
    discovery. Three new limits were also published in that entry and are now recorded: per-domain ingest by plan (5/5/10/15
    RPS), a domain freeze after 10 seconds at the cap, and a 40 RPS shared ingest cap.'
  round_2026_09_04_docs_contradiction: 'Observed first-hand, not read: the Errors page states 429 and 503 come from "REST
    ingest and network-check gateways only, not the Server API", while the Rate limits page states the Management API applies
    the same per-IP limit independently. During the well-known sweep on 2026-09-04, api.shieldlabs.ai and rest.shieldlabs.ai
    both returned 429 {"error":"too many requests"} to an unauthenticated probe. The Rate limits page is right and the Errors
    page understates the surface.'
  round_2026_09_04_well_known: 'The well-known manifest was rewritten from a bare documents[] list into the hosts[] -> documents[]
    shape the scorer actually reads, and widened from five hosts and five paths to eight hosts and sixteen paths. APIs.json,
    AAuth, UCP, ACP and oauth-protected-resource were probed here for the first time and all miss. A negative control was
    run per host: app.shieldlabs.ai FAILED it, answering 200 with the same 1,512-byte SPA shell for every path including one
    that cannot exist, so none of its 200s is counted and it earns no pointer credit. docs.shieldlabs.ai passed the control
    with a 404, so its two documents — the A2A agent card and the MCP descriptor — are real.'
  round_2026_09_04_provider_moved_agent_surface: 'Both agent-facing documents on the docs host changed and were re-saved verbatim.
    The A2A card''s advertised skill description was rewritten, and the provider-published Agent Skill itself was rewritten
    more substantially — it now opens with the situations that should trigger it rather than a feature list, and it adds an
    explicit negative boundary ("Do not use ShieldLabs for: authentication ... authorization ... or as a standalone blocker").
    A skill that tells an agent when NOT to reach for it is rare and worth recording. The MCP server is byte-identical and
    still returns the same three documentation-scope tools to an anonymous tools/list; the scope note stands.'
  round_2026_09_04_sdk_decay: Every registry was re-probed and nothing has shipped — npm, PyPI, Packagist, RubyGems, crates.io
    and the Go proxy all still return nothing for the eight first-party libraries, and the tag count across all six SDK repositories
    is zero. Seven of the eight have had no commit since 2026-07-27, while the contract they wrap moved twice in the first
    week of September. The SDKs are now measurably behind the spec they are generated from, and because none is published
    a consumer cannot pin an older version either.
  round_2026_09_04_negatives: 'Re-verified absences, recorded so a later run does not re-credit them. No status page: shieldlabs.statuspage.io
    returns 200 but the subdomain is unclaimed and Atlassian serves its own Statuspage marketing page there (title "Real-Time
    Incident Communication with Statuspage | Atlassian"), status.shieldlabs.ai does not resolve. No trust center: trust.shieldlabs.ai
    does not resolve. No certifications, and the privacy page explicitly declines to make a compliance claim — so no Compliance
    pointer. No security.txt on any of eight hosts. No CLI (docs /cli 404, no CLI repository in the organization). No Postman
    collection. No roadmap page. No gRPC/Protobuf and no WSDL in the organization or on any host. No AsyncAPI. No OAuth, hence
    no scopes/ artifact.'
  round_2026_09_04_spec_divergence: ShieldLabs publishes the same OpenAPI at two public locations and they no longer match.
    The GitHub mirror still carries a stun_request_seen detection flag the docs copy has dropped, and the docs copy adds browser_vpn_proxy
    to the ConnectionType enum, which the mirror lacks. The docs copy is treated as canonical because the provider's own DRIFT.md
    names it upstream and calls the repository a mirror — which matters, because that same repository's README calls itself
    the "source of truth for generating the client SDKs".