Reference · SDK
Behaviour collection
What is recorded about behaviour, and what never is.
What is recorded about what the visitor did, and what never is.
It adds no request#
For the whole time the visitor is on the page, the behaviour collector makes no request. It listens from script load, holds a rolling window in memory, and rides the collect that was going out anyway.
The one exception is the departure flush. See POST /api/v1/behavior.
Shape only, never content#
No keycode, no typed text, no field value, no element text, no href, no query string.
For the keyboard, only four classes are recorded: a character, a correction, Enter, movement between fields. The character itself is read for its length and discarded in the same expression.
Sensitive fields are excluded from every path#
Nothing at all is recorded, the click included, for elements that are:
contenteditableinputof type password, email, tel- carrying an
autocompletetoken ofcc-*,current-password,new-password,otp,one-time-code
autocomplete is a token list, and the type is read off the element rather than the markup.
Three states that must stay apart#
| State | Means |
|---|---|
Both null | The SDK never collected |
| A status with no events | Collected, nothing had happened yet |
| Events | There is data |
The second is what every honest auto-collect at DOMContentLoaded looks like, and it is not a bot signal.
No rule reads it#
The behaviour score is computed at read time and is not wired to the verdict. The signed field list, the score and the verdict are identical with and without the behaviour block.
That is the order the work has to happen in, not a half-finished state: an uncalibrated model in front of a payment gate refuses real customers.
Turning it off#
data-behavior="false". The visit then reads as never collected, rather than as a visitor who sat perfectly still, those are very different claims.