{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition","tabs","tab"]},"redocly_category":"Guides","product":"Fraud Prevention","type":"markdown"},"seo":{"title":"Cross-session correlation","description":"Everything about Mosaic Journeys, SDKs, and APIs","siteUrl":"https://developer.transmitsecurity.com"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"cross-session-correlation","__idx":0},"children":["Cross-session correlation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Cross-session correlation links actions that belong to the same business flow, even when they run on different channels or devices (for example, web, mobile app, and WebView—a web page embedded in a native mobile app). This article explains how cross-session correlation works and what your app needs to do to enable it."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your backend generates a correlation ID for the flow and passes it with every action, on every device. Mosaic groups all evaluated actions that share the same correlation ID and compares them across devices to assess risk for the whole flow, without adding friction for the user."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Note"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Cross-session correlation is available since Web SDK 1.20.0 and is supported on Android, iOS, React Native, Flutter, and Cordova. It's currently available in the EU region only and must be enabled for your tenant. Contact your Transmit Security representative to enable it."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"benefits","__idx":1},"children":["Benefits"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Once your actions are linked, you get:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["No changes to your user flow"]},": You don't need to add screens, prompts, or codes. Your backend generates the correlation ID and shares it with each device through a channel you already control, so the user never sees, enters, or manages it."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Unified risk assessment"]},": Mosaic evaluates each action against the latest evaluated action from every other device in the flow."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Cross-session anomaly detection"]},": Mosaic detects anomalies across the flow based on IP address, such as an unexpected distance between devices or impossible travel."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"how-it-works","__idx":2},"children":["How it works"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your backend is responsible for generating the correlation ID and sharing it with every device in the flow."]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Generate a correlation ID."]}," When the flow starts (for example, a login or a transaction), your backend generates a unique ID for it, such as a UUID or a base64url string."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Share the correlation ID with each device."]}," Use a channel you control to deliver the ID to each device, for example, a QR code, a push notification, a deep link, or URL parameters of a WebView."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Pass the correlation ID with every action."]}," On each device, include the correlation ID when you trigger an action, using the SDK or the backend API."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Request a recommendation for every action."]}," Mosaic only correlates actions that have been evaluated. Actions that are triggered but don't receive a recommendation are excluded."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You don't need to chain devices. All devices that use the same correlation ID join the same group, regardless of how many devices are involved (for example, web → mobile identity verification → web)."]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"sequenceDiagram\n participant backend as Your backend\n participant web as Web app\n participant mobile as Mobile app\n participant M as Mosaic\nbackend->>backend: Generate correlation ID\nbackend-->>web: Correlation ID\nweb->>M: Trigger action (correlationId)\nbackend->>M: Get recommendation\nweb-->>mobile: Correlation ID (for example, via QR code)\nmobile->>M: Trigger action (correlationId)\nbackend->>M: Get recommendation\nM-->>backend: Recommendation based on actions from both devices\n","diagramHtml":"MosaicMobile appWeb appYour backendMosaicMobile appWeb appYour backendGenerate correlation IDCorrelation IDTrigger action (correlationId)Get recommendationCorrelation ID (for example, via QR code)Trigger action (correlationId)Get recommendationRecommendation based on actions from both devices","diagramHtmlDark":"MosaicMobile appWeb appYour backendMosaicMobile appWeb appYour backendGenerate correlation IDCorrelation IDTrigger action (correlationId)Get recommendationCorrelation ID (for example, via QR code)Trigger action (correlationId)Get recommendationRecommendation based on actions from both devices"},"children":["sequenceDiagram\n participant backend as Your backend\n participant web as Web app\n participant mobile as Mobile app\n participant M as Mosaic\nbackend->>backend: Generate correlation ID\nbackend-->>web: Correlation ID\nweb->>M: Trigger action (correlationId)\nbackend->>M: Get recommendation\nweb-->>mobile: Correlation ID (for example, via QR code)\nmobile->>M: Trigger action (correlationId)\nbackend->>M: Get recommendation\nM-->>backend: Recommendation based on actions from both devices\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"pass-the-correlation-id","__idx":3},"children":["Pass the correlation ID"]},{"$$mdtype":"Tag","name":"Tabs","attributes":{"size":"medium"},"children":[{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"JavaScript","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"js","header":{"controls":{"copy":{}}},"source":"// Correlation ID generated by your backend for this flow\nawait drs.triggerActionEvent('[ACTION_TYPE]', { correlationId: '[CORRELATION_ID]' });\n","lang":"js"},"children":[]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"Kotlin","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"kotlin","header":{"controls":{"copy":{}}},"source":"TSAccountProtection.triggerAction(\n \"[ACTION_TYPE]\",\n object : ActionEventOptions {\n // Correlation ID generated by your backend for this flow\n override val correlationId: String?\n get() = \"[CORRELATION_ID]\"\n },\n null\n)\n","lang":"kotlin"},"children":[]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"Swift","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"swift","header":{"controls":{"copy":{}}},"source":"// Correlation ID generated by your backend for this flow\nlet options = TSActionEventOptions(correlationId: \"[CORRELATION_ID]\")\nTSAccountProtection.triggerAction(\"[ACTION_TYPE]\", options: options) { [weak self] result in\n // Handle result\n}\n","lang":"swift"},"children":[]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"Backend API","disable":false},"children":[{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"js","header":{"controls":{"copy":{}}},"source":"// POST https://api.transmitsecurity.io/risk/v1/action/trigger-action\nbody: JSON.stringify({\n session_token: '[SESSION_TOKEN]', // Device session token returned by the SDK\n action_type: '[ACTION_TYPE]',\n correlation_id: '[CORRELATION_ID]' // Correlation ID generated by your backend for this flow\n})\n","lang":"js"},"children":[]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For the full method signatures, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/sdk-ref/platform/modules/drs#triggeractionevent"},"children":["triggerActionEvent()"]}," and ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/risk/client-actions.openapi/other/triggeranaction"},"children":["Trigger an action"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"limits","__idx":4},"children":["Limits"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Limit"},"children":["Limit"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Value"},"children":["Value"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Correlation ID format"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Up to 128 characters. Letters, digits, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["."]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["_"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[":"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["-"]},". Spaces aren't supported. Standard base64 (with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["+"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["="]},") isn't supported, so use a UUID or base64url instead. An ID in a different format isn't used for correlation, but the action is still evaluated."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Time window"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["30 minutes after the latest device joins the group. This value can be configured per tenant."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Retention of evaluated actions"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["1 hour"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Group size"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A group includes up to 10 devices, including the device that performs the action."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"example-use-cases","__idx":5},"children":["Example use cases"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Web to mobile (identity verification via QR code)"]},": The user starts a flow on the web, scans a QR code with their phone to complete identity verification on mobile, and returns to the web."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Mobile to WebView"]},": A native mobile app opens a WebView to complete an authentication or verification step."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Multi-domain web"]},": A flow spans multiple web domains that belong to the same organization."]}]}]},"headings":[{"value":"Cross-session correlation","id":"cross-session-correlation","depth":1},{"value":"Benefits","id":"benefits","depth":2},{"value":"How it works","id":"how-it-works","depth":2},{"value":"Pass the correlation ID","id":"pass-the-correlation-id","depth":3},{"value":"Limits","id":"limits","depth":2},{"value":"Example use cases","id":"example-use-cases","depth":2}],"frontmatter":{"title":"Cross-session correlation","seo":{"title":"Cross-session correlation"}},"lastModified":"2026-11-12T15:17:52.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/risk/cross_session_correlation","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}