Risk signals

Google's AI Surfaces will provide contextual data to merchants to help them assess transaction risk and make decisions on whether or not they want to proceed with the transactions. This allows merchants to be in full control of the purchases that happen on their platforms.

This data is primarily shared during the Complete CheckoutAPI call.

In the 2026-01-23specification, these signals are found within the risk_signals object.
In the 2026-04-08specification, this object is named signals .

The data signals provided are the same for both specification versions.

Google will share the following data types with merchants:

Session Data

Signal Name	Description	API Path (2026-01-23: `risk_signals` / 2026-04-08: `signals` )
IP Address	IP address of the user in the session.	`ip_address`
Session Start Time	Time when the purchase was initiated (Unix epoch timestamp).	`session_start_time`

Device Data

Signal Name	Description	API Path (2026-01-23: `risk_signals` / 2026-04-08: `signals` )
Device Type	Type of device being used (e.g., `MOBILE` , `DESKTOP` , `TABLET` , or `UNKNOWN` ). Derived from User Agent.	`device_type`
Device Timezone	Current timezone of the device being used in the session.	`device_timezone`

Browser Data

Signal Name	Description	API Path (2026-01-23: `risk_signals` / 2026-04-08: `signals` )
User Agent	Browser client information string.	`user_agent`
Browser Language	Language being used in the browser on the device (e.g., "en").	`locale`
Viewport Height	Height of the browser viewport in pixels.	`viewport_height_px`
Viewport Width	Width of the browser viewport in pixels.	`viewport_width_px`

Order Data

The following data points are available within the Create/Update Checkout API calls and provide context for the order:

Signal Name	Description	API Path ( `Create/Update Checkout` )
Product ID	Helps the merchant identify the item.	`line_items[x].item.id`
Fulfillment ID	Helps determine delivery type and method.	Varies based on fulfillment setup

Shipping & Billing Data

Address and buyer information is primarily provided during the Create/Update Checkout API calls.

Buyer Information:

Signal Name	Description	API Path ( `Create/Update Checkout` )
User's Email ID	Signed-in user's Google Email ID.	`buyer.email`

Shipping Address:Available in Create/Update Checkout under fulfillment.methods.destinations[x] (where type is "shipping" and x is the selected_destination_id ).

Signal Name	Description	API Path	Optional
First Name	Recipient's first name	`first_name`	No
Last Name	Recipient's last name	`last_name`	No
Full Name	Recipient's full name	`full_name`	Yes
Phone Number	Recipient's phone number	`phone_number`	Yes
Street Address	Main street address line	`street_address`	No
Extended Address	Apartment, suite, etc.	`extended_address`	Yes
City	City or locality	`address_locality`	No
Region	State or region	`address_region`	No
Postal Code	ZIP or postal code	`postal_code`	No
Country	Country code	`address_country`	No

Billing Address:Available in Complete Checkout . The fields are the same as those listed in the Shipping Address table and are found within the payment.instruments[x].billing_address object (where x is the selected_instrument_id ). ---

Payment Verification Data

The following fields are available within the risk_signals (for Version 2026-01-23 ) or signals (for Version 2026-04-08 ) object in the Complete Checkoutresponse.

Signal Name	Description	API Path (2026-01-23: `risk_signals` / 2026-04-08: `signals` )
AVS Full Result	Address Verification System (AVS) check result.	`avs_full_result`
CVV Result	Card Verification Value (CVV) check result.	`cvv_result`
Authentication Triggered	Indicates if extra user authentication was performed.	`authentication_triggered`
Authorization Processed With 3DS	Indicates if 3D Secure verification was performed.	`authorization_processed_with_3ds`

Examples

The following examples show the structure of the risk signals object for different UCP specification versions.

Version 2026-04-08

In this version, the risk signals are contained within the signals object.

 { 
  
 "signals" 
 : 
  
 { 
  
 "ip_address" 
 : 
  
 "123.456.7.890" 
 , 
  
 "session_start_time" 
 : 
  
 "1717521120" 
 , 
  
 "device_type" 
 : 
  
 "MOBILE" 
 , 
  
 "device_timezone" 
 : 
  
 "America/Los_Angeles" 
 , 
  
 "user_agent" 
 : 
  
 "Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Mobile Safari/537.36" 
 , 
  
 "locale" 
 : 
  
 "en-US" 
 , 
  
 "viewport_height_px" 
 : 
  
 1080 
 , 
  
 "viewport_width_px" 
 : 
  
 1920 
 , 
  
 "avs_full_result" 
 : 
  
 "Y" 
 , 
  
 "cvv_result" 
 : 
  
 "M" 
 , 
  
 "authentication_triggered" 
 : 
  
 true 
 , 
  
 "authorization_processed_with_3ds" 
 : 
  
 true 
  
 } 
 }

Version 2026-01-23

In this version, the risk signals are contained within the risk_signals object.

 { 
  
 "risk_signals" 
 : 
  
 { 
  
 "ip_address" 
 : 
  
 "123.456.7.890" 
 , 
  
 "session_start_time" 
 : 
  
 "1778090291092" 
 , 
  
 "device_type" 
 : 
  
 "DESKTOP" 
 , 
  
 "device_timezone" 
 : 
  
 "America/Los_Angeles" 
 , 
  
 "user_agent" 
 : 
  
 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" 
 , 
  
 "locale" 
 : 
  
 "en" 
 , 
  
 "viewport_height_px" 
 : 
  
 893 
 , 
  
 "viewport_width_px" 
 : 
  
 1515 
 , 
  
 "avs_full_result" 
 : 
  
 "Y" 
 , 
  
 "cvv_result" 
 : 
  
 "M" 
 , 
  
 "authentication_triggered" 
 : 
  
 true 
 , 
  
 "authorization_processed_with_3ds" 
 : 
  
 true 
  
 } 
 }