Console screens

The console is in Portuguese (pt-BR). Screens are listed here by their menu name, exactly as shown, with an English gloss. Every role sees the whole menu; a screen your role cannot use shows a notice instead. See roles.

Menu group	Screens
Principal	Início, Visão geral, Acessos, Fila de revisão
Detecção	Configuração de risco, Simulações de política, Listas, Catálogo de indicadores
Operação	Integração e saúde, Uso, Exportações, Relatórios
Administração	Usuários e acessos, Auditoria, Ciclo de vida do cliente, Conta e segurança
Configurações	Configuração inicial (only once your company is connected; see Início)

Every screen reads your company’s real data; screens that read records carry a Dados reais (real data) mark in their own header. Ciclo de vida do cliente and Catálogo de indicadores are the exceptions that read no records: the first does not send requests yet, and the second is a fixed reference.

The top bar has the Aplicação (application) selector and, on screens that use it, the Período (period): Últimas 24 horas, Últimos 7 dias or Últimos 30 dias, measured on the server clock, in UTC. If you belong to more than one company, an Empresa (company) selector appears there too. The search field in the top bar, Buscar titular ou conta pelo ID da sua empresa (find a person or an account by your company’s ID), finds the accesses your backend sent with one exact subject_ref or account_ref (Busca por ID). There is no search by device. While your company has no active application, Visão geral shows a notice pointing to Início.

Recommendations do not execute actions

FingerTrackID assesses and recommends. No screen, score, rule or list blocks a login, holds a withdrawal or changes an order in your product; your backend executes every action, including a block recommended by your own active rules.

Início

(Start). The five setup steps of your company: Criar a aplicação, Configurar a coleta web, Credencial servidor a servidor, Configuração do SDK and Primeiro evento recebido, plus Membros da equipe for inviting people. The first four steps are requests, normally approved as soon as they are sent and then applied automatically; the fifth needs no request and completes when the first assessment arrives. A step is shown as Concluída only with confirmation from the server. Visão geral remains the opening screen. Step by step: onboarding.

Once your company has received its first access, Início leaves Principal and moves to the end of the menu as Configuração inicial (initial setup), the only item of Configurações (settings). The screen and its address stay the same.

Visão geral

(Overview). The opening screen. For the selected application and period it shows the cards Acessos a conferir (accesses to check), Acessos avaliados (assessed accesses), Com nota (with a score), Sem nota (without a score) and Saques avaliados (assessed withdrawals); the chart Acessos avaliados e parte a conferir; Destaques do período (period highlights); Checagens no dispositivo (device checks); and Saques a conferir (withdrawals to check).

Saques avaliados and Saques a conferir count only the fixed v1 withdrawal journey. When the period has tagged accesses and no v1 withdrawal, the card shows — and points to Acessos por etiqueta: FingerTrackID does not infer which of your tags are withdrawals.

Acessos por etiqueta (accesses by tag) lists the tags of the period with Acessos, Com nota, Sem nota and Participação (share), from the highest volume down, counted by when FingerTrackID received each access. Accesses without a tag (v1 requests) are not in this table; when there are many tags, it shows the ones with the most accesses and says so.

These totals are not HTTP traffic, service health, precision/recall or fraud probability. Response time, collection availability and recommendation accuracy are not measured on this screen yet.

Acessos

(Accesses). The latest assessed accesses, 25 per page, newest first. The list shows when it happened, the journey (for a v1.1 access, its tag exactly as sent), assessment and session, score, state and recommendation, and the network country when available. Risk indicators, browser and system, city and network, and the customer’s action show indisponível na lista (not available in the list): open the access to see them. Ver só o contrato switches to a compact view with the event and application. Times are shown in the America/Sao_Paulo time zone. A single period covers at most 31 days.

The views Todos os acessos, Logins, Saques and Ordens work; tagged accesses are not in Logins, Saques and Ordens. After them come up to four views Etiqueta tag, one for each of the period’s tags with the most accesses; choosing one filters the list by that tag. The other saved views are not available yet.

Filtros opens Filtros de investigação (investigation filters); with filters applied the button reads Filtros (n). All filters combine (AND):

• Etiqueta da jornada (journey tag): an exact v1.1 tag, as sent.
• Provedor de internet (the network’s autonomous system number) and País da rede (network country).
• Instalação do dispositivo (device installation).
• Motivo de “não avaliado” (the reason an indicator was not evaluated).
• Indicador 1 and Indicador 2, each with a state.

There is no IP address filter. Some filters need the risk roles’ read permissions. With filters applied, the list shows the newest matches first, read in batches of up to 1000.

Access detail

Opening an access shows what was actually recorded: Nota de confiança (trust score), Cobertura de evidência (evidence coverage), Continuidade do dispositivo (device continuity), Recomendação e ação (recommendation and action), the signals, limitations and reasons, session and device, device and account links, freshness and versions, and Localização aproximada (approximate location). A v1.1 access is titled Acesso com etiqueta and shows its tag. Later policy changes never recompute a past recommendation. Recomendação e ação also shows the latest action your backend recorded for the access, whether it followed the recommendation, and the latest outcome you reported, for roles that read customer feedback. Sessão e dispositivo shows Navegador e sistema (browser and system) as the browser declared them; that is never a verification of the device. The access detail also shows each of your company’s rules that fired on that access, with the points an active rule deducted or a ghost rule would have deducted; ghost rules never change the access’s score or recommendation.

• Contexto do acesso (access context) adds context normally computed during the assessment; it changes the score and the recommendation only through context rules your company made active. See Contexto do acesso below.
• Localização aproximada shows a position derived from the observed IP address by the IP2Location LITE DB11 database: the coordinates of the city, not of the access, inside a fixed 15 km circle labelled as conventional, because the database states no precision. It is not GPS, an address or a live position, and only the risk roles see it.
• Registrar ação do cliente (record customer action) is not available in the console yet; your backend reports actions and outcomes through the feedback API. Ver dados brutos (view raw data) is not available either.
• The device and session buttons open Vínculos (links), which shows what was recorded in each assessed access, not the state now; from there you can open a linked account. Accounts appear there only for accesses your backend sent with account_ref. A link is not proof of civil identity.

Contexto do acesso

(Access context). Computed during the assessment, from your company’s own history, within a short time budget. It changes the score and the recommendation only through context rules your company made active in Configuração de risco; such a rule that fires appears in the reason_codes of a scored API response under the item’s code, and the items themselves are not part of the API response. No item alone indicates fraud. The items are grouped under Conta e dispositivo (account and device), Saques e ordens (withdrawals and orders), Rede e localização (network and location), Navegador e integridade do SDK (browser and SDK integrity), Velocidade (velocity) and Ligações entre contas (links between accounts). An item that could not be computed shows não avaliado with its reason; Passou do limite de cálculo (volume ou tempo) means it did not fit in the assessment’s time budget, and such an item never deducts. If the step does not run inside the assessment at all (it failed as a whole, or FingerTrackID switched it off), the card is computed after the assessment instead: those items were not inputs to the delivered score or recommendation, add nothing to reason_codes, and the access’s rules say so with Os itens de contexto deste acesso não ficaram prontos dentro do prazo da avaliação (the access context items were not ready within the assessment’s time limit).

Visualização (view) chooses how to read the card, and the browser remembers the choice: Grupos (groups) or Tabela (table). In Grupos, each group opens and closes: a closed group shows only its summary, and a group with an item read as Incomum (unusual) or Muito incomum (very unusual) opens by itself; Abrir todos os grupos opens them all. Tabela shows one row per computed item, with its value, its band and the reading, grouped by Tema (the groups above) or Gravidade (severity, with the group under each item’s name). In the table a count’s bar carries its value on the pointer, without the band bounds written under it. The Foco (focus) switch keeps only the unusual items, and the items without data follow the table, by reason. Each computed item carries a reference band, Esperado (expected), Incomum, Muito incomum or Informativo (informative), drawn as a bar whose zones have the same width, with the value’s zone filled and a pointer under it. The bands come from the ruler that applied to that access, and the legend says which: your company’s own ruler, from the rules it published, or FingerTrackID’s default ruler in force when the access arrived (version 1, not calibrated with real outcomes yet). A band is a reading aid and not a fraud label; it changes the score only when your company has activated that item’s rule, which then fires at Incomum or Muito incomum. In FingerTrackID’s default ruler, the privacy context (iCloud Private Relay, the VPN’s country, guest mode, a browser inside an app) is Informativo; your company can grade it in its own rules. A yes/no item says Sim or Não before its detail, so Não · macOS under Sistema operacional novo para esta conta means the system is not new. The ⓘ beside each item’s name says, in plain words, what the item measures: the same explanation as the indicator catalog.

The account items need the account_ref your backend sends (person and account references); without it they show Conta não informada pelo sistema da empresa (account not sent by the company’s system):

• Dispositivo novo para esta conta, País novo para esta conta, Provedor de internet novo para esta conta and Sistema operacional novo para esta conta;
• Viagem impossível: velocidade entre este acesso e o anterior (impossible travel);
• Quantidade de acessos desta conta and Repetições da mesma ação nesta conta;
• Dispositivos que esta conta usou (24 horas), Países de onde esta conta acessou (24 horas), Provedores de internet usados por esta conta (24 horas) and IPs diferentes usados por esta conta (última hora);
• Outras contas que usaram os mesmos dispositivos (30 dias), Contas ligadas por dispositivo em que houve robô ou navegador falsificado (30 dias) and Contas ligadas por dispositivo que a sua empresa marcou como fraude; the last one also reads your outcomes from the feedback API: while the application has never sent any outcome, it shows Sem dado: a empresa não envia resultados (no data: the company does not send outcomes); once it has sent any outcome, even one that is not a confirmed fraud, the item is computed and shows 0 when no neighbouring account has a confirmed fraud;
• most withdrawal and order items of Saques e ordens.

An account’s history starts with the first event that carries its account_ref: earlier events are never linked to it afterwards. With a completed browser collection, the first access of each account shows Primeira vez: ainda sem histórico (first time: no history yet) on the items that compare with the account’s past, never a clean history; without one they show Sem coleta concluída do navegador (no completed browser collection). A later access evaluates Dispositivo novo para esta conta only when an earlier access of the same account in the last 90 days also had a browser collection whose browser installation was linked; an account idle for more than 90 days shows Primeira vez again. Contas que usaram este dispositivo (30 dias), Contas de um mesmo titular neste dispositivo (30 dias) and Contas que usaram este mesmo IP (última hora) are computed even without account_ref, but they count only the accounts your backend sent, so without it they show 0.

Viagem impossível (impossible travel) needs an earlier location of the same account in the last 24 hours. Its location is the city of the connection as FingerTrackID’s network edge sees it, rounded to a coarse cell, a different source from the Localização aproximada card. The checks run in this order: without a record of this access from the network edge it shows Dados de rede da borda indisponíveis (network edge data unavailable); with that record but no location cell, it shows Localização aproximada indisponível, which here refers to that edge location. Only then, when this access, or an access of the same account in the last 24 hours, was detected behind a VPN, a proxy, a hosting network or Tor, or with Safari’s reinforced privacy, it is not evaluated (Rede anonimizada: localização não confiável).

Under Velocidade, Repetições da mesma ação nesta conta and Repetições da mesma ação neste dispositivo, em qualquer conta count the events with the same tag in the last minute, five minutes and hour. On an access sent with a tag, the card names them by that tag, as your integration wrote it: Repetições de saque_pix nesta conta. As the screen says, the thresholds and windows are those of the calculation version and are not calibrated with real outcomes yet: a high count of accounts or people on one device is not evidence of fraud.

The Listas da empresa card says whether the device, the account or the IP of the access is on one of your lists, who put it there and why, and adds one of them without typing its value. The card shows a listed IP only up to its network (203.0.113.***) for every role; the whole address appears on Listas to company administrators and risk supervisors. When a list decided the response of this access, the card names the policy’s recommendation, the one returned, and the entries that decided it as they were at that moment.

Busca por ID

(Search by ID). Opened from the top bar field Buscar titular ou conta pelo ID da sua empresa, which ⌘K (on Apple platforms) or Ctrl+K (elsewhere) focuses. On the page, choose Titular (person) or Conta (account) and type the ID enviado pela sua empresa (the ID your company sent): the exact subject_ref or account_ref your backend sends, never a tax ID, email or phone number. The match is exact, uppercase and lowercase included, with no prefix or approximate match, inside the selected application and period.

The top bar field has no Titular or Conta choice of its own: pressing Enter there runs the search at once, with the kind of your last search in this session, Titular by default, and opens Busca por ID with its result. An account ID typed there in a new session therefore first runs an audited search as Titular, which usually finds nothing; choose Conta on Busca por ID and search again.

• The result, Acessos encontrados para o ID buscado (accesses found for the searched ID), uses the rows of Acessos. Abrir o acesso opens the access detail, and Ver conta or Ver dispositivo open Vínculos. There is no page for the person or the account. A search keeps at most its 500 most recent accesses (narrow the period to see older ones) and expires after a while; then search again.
• Administrador da empresa, Analista de risco and Supervisor de risco can search. For the other roles, or while the search is not enabled for your company, the field stays disabled and says why.
• Each search that runs is recorded in Auditoria as Busca por titular or Busca por conta, without the ID and without saying whether it found anything, and so is every page of its result you read, under the same label; a search refused before it runs leaves no record. The ID travels only in the body of the console’s request: never in the page address, the browser history, the page title or browser storage.
• A search by account finds only the accesses your backend sent with account_ref. When nothing matches, the screen says that no retained access in the period carries that ID, and that your integration may not send that kind of ID yet.

Fila de revisão

(Review queue). Withdrawals that need human review, with state Aberto, Em revisão or Encerrado, priority and deadline, up to 50 per page. Risk analysts and supervisors use Atribuir a mim, Iniciar triagem and Concluir triagem; only the assigned person starts or completes a triage. Supervisors can reassign, use Reabrir item and set the Perfil da fila (priority and deadline for new items). Without a profile the queue shows Fila não configurada.

The queue organizes review only. Holding, challenging or blocking a withdrawal is always your company’s decision, outside FingerTrackID.

Configuração de risco

(Risk configuration). Your company’s risk rules for the selected application, one configuration for every journey and tag of that application. Any rule can be published as active directly, but only your company can activate it; while no rule is active, every recommendation stays MONITOR (availability). A company that never published its own rules opens the editor with FingerTrackID’s recommendation, marked as not published yet: points for each indicator, five score bands and thresholds for the context items. Nothing changes until you publish it, and Voltar à recomendação brings it back after you discard it.

• Indicators. Each of the 13 Web indicators has a mode, Desligada (off), Fantasma (ghost) or Ativa (active), and a weight from 1 to 100 points. A ghost rule is computed and recorded on every assessment but never changes the score or the response. An active rule that fires deducts its weight from the score.
• Context items. Each of the 54 items of Contexto do acesso, computed during the assessment, has the same three modes, a ruler and two point values, one for Incomum and one for Muito incomum (at least as many as Incomum). The ruler sets where the item’s reading turns Incomum and Muito incomum; it starts from FingerTrackID’s default ruler, maintained in the backoffice, and your company adjusts it. An active item that fires deducts the points of the band it reached; an item read as Informativo never fires. An active item without data never deducts; if the score then falls into your allow band, the assessment stays without a score (INCONCLUSIVE, MONITOR). When FingerTrackID publishes a new default ruler, your published rules do not change: the screen shows a notice, and adopting it is a publication of your own.
• Bands. You set the score bands and the action of each one (block, review, extra verification, monitor, allow). The score starts at 100, each active rule that fires deducts its weight, the score never goes below 0, and the final score falls into one of your bands. Until your company publishes its own rules, the managed configuration stays in force, with every band on monitor. FingerTrackID’s recommendation that opens in the editor has five bands instead: block from 0 to 19, review from 20 to 39, extra verification from 40 to 59, monitor from 60 to 80 and allow from 81 to 100, so publishing it unchanged can already return BLOCK_RECOMMENDED, REVIEW, STEP_UP or ALLOW.
• Impact. Optional. When you ask for it, the impact card replays your draft over the assessments already recorded in the last 1, 7 or 30 days and shows how many would have had each action as delivered, with your draft, and with your ghost rules counting, for example how many accesses would have been blocked. Publicar never waits for a measurement; when it stays disabled, the reason is written beside it.
• Publish. A confirmation dialog shows the impact summary when this exact draft was measured, and says so when it was not. Publishing creates a new version for the application, recorded in the audit trail, and affects only future assessments; past assessments are never recomputed.
• Tudo em fantasma (everything to ghost) publishes, in one step, a new version where every active rule becomes ghost with its weight kept. From the next assessment on, none of your rules deducts from the score and every response is MONITOR. Use it to stop your rules at once.
• Put in ghost by support. FingerTrackID’s support can also put every rule of an application in ghost, with a recorded reason, for example when an administrator session may be compromised. The screen then shows a notice that FingerTrackID support did it, when, and the reason; it names the support team, not the individual operator. Support never activates a rule or changes a weight, band or context item. To reactivate, your administrator or risk supervisor switches the rules you want back to Ativa and publishes; the notice disappears once you publish again.

Publishing and Tudo em fantasma need Administrador da empresa or Supervisor de risco and a recent authenticator check; every role that reads policy sees the configuration and the impact, and every rule hit, active or ghost, including the context items, per access and in the impact. Apart from putting every rule in ghost, FingerTrackID’s operators never publish or activate a rule for your company.

A BLOCK_RECOMMENDED produced by your rules is still a recommendation: your backend executes it. Missing evidence, a timeout or a failure never recommend blocking.

Simulações de política

(Policy simulations). Re-evaluates 1 to 10 recorded assessments against a policy version already saved on the server, and compares original and simulated state, score and recommendation. Local drafts cannot be simulated. Choose Capturar simulação (capture simulation); past simulations open by their identifier. Simulating never changes the policy in force or past assessments.

Listas

(Lists). Your company’s own Lista de bloqueio (block list) and Lista de permissão (allow list), kept one entry at a time. An entry names one identifier of your traffic: the FingerTrackID device (the dev_… id the API returns, or the id the console shows), the account reference your backend sends, or one IP address (IPv4 or IPv6; ranges are not accepted). A block-list entry carries the action Bloquear (block) or Revisar (review); an allow-list entry carries Liberar (allow). An entry may carry a comment of up to 500 characters, and the list shows who added it and when. An identifier sits on one list at a time, and a company keeps at most 10,000 active entries across both lists.

Add an entry by typing it on this page (Adicionar), or from the detail of an access (Adicionar à lista), where the value comes from the access itself and is never typed. Taking an entry off (Tirar da lista) keeps its history: who removed it and when. Company administrators and risk supervisors change the lists; risk analysts read them and see an IP only up to its network (203.0.113.***).

Effect on the response. When an active entry names the device, the account or the IP of an access that FingerTrackID scored (COMPLETED), the response carries the entry’s action whatever the score: Bloquear returns BLOCK_RECOMMENDED, Revisar returns REVIEW and Liberar returns ALLOW. With several entries, block wins over review, which wins over allow. The score stays the policy’s, and reason_codes starts with the deciding entries (recommended_action). An access without a score keeps the policy’s recommendation. The lists apply to production only. FingerTrackID never creates, imports or publishes an entry, your backend executes the action, and an entry is your company’s decision, not proof of fraud.

The device and the IP of an access are the ones its FingerTrackID collection recorded: the IP is the address the collection edge saw, which a whole office or mobile network may share, so allowing an IP allows every scored access coming from it. An access sent without the collection’s token can match by its account only. An entry applies to the accesses answered after it was added. If FingerTrackID later merges a listed device into another, the entry stops matching; add the device the access detail shows. In Simulações de política, the original answer of an access is the one returned, a list’s decision included, while the simulated one is the candidate policy’s alone.

Catálogo de indicadores

(Indicator catalog). A fixed reference of what FingerTrackID can report, marked Catálogo versão 3 and Referência fixa: the 13 browser (Web) indicators, the 18 app indicators (which need the mobile SDK, not available today) and the context information, which changes the score only through context rules your company made active. It reads no records and has no application or period selector. A listed indicator is not proof of an active detector.

Integração e saúde

(Integration and health). For the selected application, the last 24 recorded hours: integration stage, the path from collection to assessment, observation and the first-party collection domain, the Credenciais de servidor (server credentials) table with client, state, key_id, version and credential state, and integration governance. Numbers are not live.

• Segredo da credencial de servidor: a pending credential’s secret appears exactly once, when a company administrator or integration manager chooses Receber segredo; it is never stored by the console or shown again.
• Trocar segredo ou revogar acesso: Trocar segredo generates a new secret for an active client (the old one stays valid for up to 24 hours), delivered once in the card above. This is also how a lost secret is replaced.
• Limite de requisições: the rate limit in force, with Pedir aumento de limite (limits).
• Pacote do SDK Web: download the private SDK package and see its SHA-256 and SHA-512, with the commands to check and install it for macOS e Linux and for Windows (PowerShell) (installation).
• Origens das páginas (page origins), for the company administrator and integration manager: the website origins the SDK collects from, up to 10, all under the collection domain. Add one with Adicionar origem or remove one with Remover; the change takes effect at once, with no request, and is recorded in the audit trail. The origin used in the collection setup is marked Principal and cannot be removed here, and at least one origin stays. Device continuity is per origin.
• Modelos de jornada (journey templates): ten suggested tags with when to call, where to collect in the browser, which pseudonyms to send and what to look at in the console; the same content as journey templates. They are guidance only.

Executar teste de integração (run integration test) is not available yet. Applications and credentials are requested in Início, not here.

Uso

(Usage). A page of up to 50 usage records of your whole company, each counted as eligible or not, with a reason. Only a qualified SDK collection counts as one unit; everything else counts zero. The screen is labelled Estimativa não faturável (non-billable estimate): it is not an invoice, a price or a month’s consumption. It has no application or period selector. Records appear after the SDK completes its first collection.

Exportações

(Exports). Request a CSV of Avaliações (assessments) or Chamadas de dispositivo (device calls) for the selected application, with a time window up to 31 days, 1 to 1000 rows and a reason. The Avaliações file gains a sixth column, tag, when at least one exported access has a tag; there is no tag filter on exports. Each company can make 20 requests per hour. A request moves through Gerando, Pronta, Cancelada or Expirada; download with Baixar while it is ready. You see only your own requests. Treat the CSV as untrusted data in spreadsheets.

Relatórios

(Reports). A monthly recount for the selected application, for the open month and the five before it, in UTC calendar months: eligible units, device calls and assessments. The numbers are recounted on every read and can change; no period is closed yet and nothing here is billable.

Usuários e acessos

(Users and access). Your own access and role, the role and permission matrix and, for the company administrator, the member list with Conceder acesso (grant access) and Gerenciar o acesso (manage access). Changes are requests and take effect only when completed. The Convite column shows whether each invitation is Pendente or Aceito; while it is pending, Reenviar convite sends a new invitation email (at most 3 per hour for each person). See member changes.

Auditoria

(Audit). The recorded actions and sensitive reads of your company, 50 per page: when, kind, operation, source, result, actor and environment. Search by person, period or operation is not available yet. Audit never shows secrets or raw collection.

Ciclo de vida do cliente

(Customer lifecycle). Retention, offboarding and legal-hold operations. The screen shows your company and role, but the console does not send or read these requests yet: every operation is disabled and points to FingerTrackID support, and the history is not available in the console.

Conta e segurança

(Account and security). Your display name and time zone (the saved time zone does not change how times are shown yet), session and security settings, with Trocar a senha (change password) and your authenticators. See signing in.