Castle

No entries match these filters. Clear filters

1. announced Oct 27, 2026 · issue 123

   Castle adds AI agent identification, exposing agent identity via a top-level agent object in the Castle API response.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   └──▷ TRY IT
   Inspect which AI agent triggered a Castle event — and how it was identified — to decide whether to allow, challenge, or block the request.
   copy

   $ {
     "agent": {
       "name": "ChatGPT agent",
       "operator": "openai",
       "category": "ai_agent",
       "identified_by": ["web_bot_auth"]
     }
   }

   • Adds a top-level agent object to the Castle API response with fields name, operator, category, and identified_by (supporting values web_bot_auth, fingerprint, and user_agent).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports category values ai_agent, ai_browser, and browser_automation to distinguish agent types in API responses.
   • Identifies named AI agents and browsers — including Meta Muse, OpenAI Dots, Grok Bot, ChatGPT agent, Instinct, and Perplexity Comet — using Web Bot Auth cryptographic signing, fingerprinting, and user-agent string analysis.
   • Enables filtering and investigating events by agent identity in Castle's event dashboard to see which users, accounts, and operations are associated with a particular agent.
   • Enables agent-specific policies to allow, restrict, or require additional verification for specific agents or agent categories based on the operation being performed.

   5 details in Everything

2. Identify AI agents Oct 22, 2026 · issue 117

   Castle now identifies AI agents and browser automation tools in traffic, returning name, operator, category, and detection method.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   • Adds a new top-level object in Castle's response identifying AI agents and browser automation tools, including the agent's name, operator, category, and how it was identified.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports detection via verified Web Bot Auth signatures for AI agent identification.

   2 details in Everything

3. SDKs page Sep 1, 2026 · issue 061

   Castle adds an SDKs page giving a single view of SDK integration versions and update status.

   ⤢
   └──▷ HOW TO FIND IT
   Check which of your SDK integrations are behind the latest release to ensure full detection model coverage.
   📍In the Castle dashboard, navigate to the SDKs page to see the version status of each integrated SDK and identify any that need updating.
   • New SDKs page provides a centralized view of all SDK integrations, showing which are outdated so teams can quickly identify where to upgrade.

   1 detail in Everything

4. IP Intelligence API Aug 6, 2026 · release notes

   Castle introduces dedicated IP Intelligence API for querying residential proxy and VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. signals independently of the Risk API.

   └──▷ TRY IT
   Check if an IP is associated with a residential proxy network before processing a login.
   copy

   $ curl -X GET 'https://api.castle.io/v1/ip-intelligence/203.0.113.42' \
     -H 'Authorization: Bearer <api_key>'

   • Adds GET /api/ip-intelligence/{ip} endpoint to query raw intelligence signals directly
   • Enables standalone detection of residential proxies without sending a user event

   2 details in Everything

5. 1 seen Aug 5, 2026 · issue 036

   API surface changed: +2 endpoints, 2 modified

   API change

   API surface changed: +2 endpoints, 2 modified

   • + GET /ips/downloads/{dataset}/{window}.{format}.gz
   • + HEAD /ips/downloads/{dataset}/{window}.{format}.gz
   • ~ GET /ips/{value}: response schema changed
   • ~ POST /ips/query: request body changed
   • New endpoint GET /ips/downloads/{dataset}/{window}.{format}.gz
   • New endpoint HEAD /ips/downloads/{dataset}/{window}.{format}.gz
   • GET /ips/{value}: response schema changed
   • POST /ips/query: request body changed

   4 details in Everything

6. 1 seen Aug 2, 2026 · issue 033

   Castle now publishes an API — 25 endpoints across 6 areas: List Items, Lists, Privacy, …

   • List Items (8 endpoints) — List Items represents entries in a List.
   • Lists (6 endpoints) — Lists represents a generic collection of items, such as Users, IPs, Transactions or any custom property.
   • Privacy (4 endpoints) — APIs intended to help adhere to GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. Compliance and specifically assist in supporting Article 15: Right of access by the data subject and Article 17: Right to be forgotten.
   • Events (3 endpoints) — Castle Events APIs allow you to query and aggregate Events that have been sent to the Castle Risk Assessment APIs.
   • IP Intelligence (2 endpoints) — Look up Castle's IP intelligence data (address metadata + tunnel observations) for a single IP or a batch.

   +1 more show less

   • Risk Assessment (2 endpoints) — Castle Risk Assessment APIs will calculate a risk score as well as evaluate policies based on the provided payload.

   6 details in Everything

7. Detect VPN traffic with new IP intelligence seen Jul 27, 2026 · issue 027

   Castle adds VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. traffic detection via new IP intelligence signals.

   • Detects VPN traffic using new IP intelligence, extending existing tunnel and residential proxy detection capabilities.

   1 detail in Everything

8. Detect residential proxies with new IP intelligence seen Jul 27, 2026 · issue 027

   Castle adds Residential Proxy IP signal and richer IP tunnel intelligence to its IP risk detection.

   • New Residential Proxy IP signal detects traffic routed through real consumer ISPs, catching proxies invisible to traditional datacenter-based detection.
   • Expanded IP tunnel intelligence provides richer context alongside existing Proxy IP and Tor IP signals.

   2 details in Everything

9. Export team members to CSV seen Jul 27, 2026 · issue 027

   Castle lets you export your team members list to CSV from Team Settings for access reviews and compliance audits.

   └──▷ HOW TO FIND IT
   Pull an offline team roster for a periodic access review or compliance audit.
   📍In the Castle console, go to Settings › Team, then click the Export to CSV button to download all visible columns (name, email, user role, 2FA status, member since).
   • Export team members list to CSV from the Team Settings page, including name, email, user role, 2FA status, and member-since date.

   1 detail in Everything

10. New event field: `email.registered_domain` seen Jul 27, 2026 · issue 027

    Castle adds email.registered_domain field to collapse subdomain variants for better fraud detection.

    • Adds email.registered_domain event field that strips subdomains down to the registered domain using the public suffix list, making it easier to detect fraud patterns that rotate across subdomains.

    1 detail in Everything

11. Additional Authentication Method types seen Jul 23, 2026 · issue 023

    Castle adds Proof-of-Personhood and Payment authentication method types for richer signal classification.

    • Adds Proof-of-Personhood (pop) authentication method type for events verified through PoP providers (e.g., Worldcoin, Humanode, etc.).
    • Adds Payment authentication method type for events tied to a payment method or provider (e.g., card, bank, wallet variants).

    2 details in Everything

12. CSV export for Lists seen Jul 23, 2026 · issue 023

    Castle Lists can now be exported to CSV, with background processing and email delivery for large datasets.

    └──▷ HOW TO FIND IT
    Download all entries from a Castle List for offline analysis or reporting.
    📍In the Castle console, open the target List, then click Export in the list toolbar to download the CSV (large lists will be emailed as a download link when ready).
    • Adds CSV export for List entries — click Export in the list toolbar to download; large lists run in the background and deliver a link via email.

    1 detail in Everything

13. Dark mode seen Jul 23, 2026 · issue 023

    Castle adds dark mode with automatic system-preference detection and manual Light/Dark/System override.

    └──▷ HOW TO FIND IT
    Manually switch between Light, Dark, or System (auto) display modes without relying on OS preference.
    📍In the Castle console, open the user menu and select your preferred appearance: Light, Dark, or System (auto).
14. Fraudulent Email Domain signal seen Jul 23, 2026 · issue 023

    Castle adds a Fraudulent Email Domain signal to detect domains registered specifically for fraud and bot signups.

    • New Fraudulent Email Domain signal detects email domains confirmed as actively used in fraud and abuse campaigns, distinct from disposable email services like Mailinator or TempMail.

    1 detail in Everything

15. IOS SDK 4.0.0 Release seen Jul 23, 2026 · issue 023

    Castle iOS SDK 4.0.0 adds expanded device signals and SDK protection in a major update.

    • Collects additional device signals for broader fraud and bot detection coverage.
    • Adds SDK protection capabilities.

    2 details in Everything

16. Multiple API keys seen Jul 23, 2026 · issue 023

    Castle now supports multiple API keys per account, enabling zero-downtime key rotation and per-integration secrets on Enterprise plans.

    └──▷ HOW TO FIND IT
    When rotating a compromised or expiring key, create a new one in the dashboard, label it by purpose, migrate traffic gradually, then delete the old key — all without downtime.
    📍In the Castle console, go to Settings › API Keys, click Create new key, enter a label (e.g. Production Web), copy the new Publishable API Key and API Secret, update your integration, then delete the old key once traffic has migrated.
    • Create multiple Publishable API Keys and API Secrets within a single Castle account.
    • Rotate or revoke individual keys without disrupting other active integrations.
    • Label each key by purpose (e.g., Production Web, Mobile iOS) for clear per-integration tracking.
    • Supports gradual traffic migration: create a new key, shift traffic incrementally, then delete the old one.

    4 details in Everything

17. Phone call detection seen Jul 23, 2026 · issue 023

    Castle adds phone call detection to catch social engineering attacks during login and transactions.

    ⤢
    • Detects when a user is on a phone call during sensitive actions (e.g., login, transactions) to identify potential social engineering attacks.
    • Exposes three new fields for phone call state in Castle events.

    2 details in Everything

18. Webhook API Key selection seen Jul 23, 2026 · issue 023

    Castle lets you choose which API Secret signs each webhook, enabling independent secret rotation per integration.

    └──▷ HOW TO FIND IT
    Assign a specific API Secret to a webhook endpoint to isolate it from other integrations and rotate its secret without affecting others.
    📍In the Castle dashboard, navigate to your Webhook configuration, select the endpoint, and choose the desired API Secret from the signing key selector.
    • Enables per-webhook API Secret selection for signing, so integrations can be isolated and secrets rotated independently (Enterprise plans).

    1 detail in Everything

19. Detect VPN traffic with new IP intelligence Jun 18, 2026 · release notes

    Castle extends IP intelligence to detect VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. traffic alongside residential proxy detection.

20. Export team members to CSV Jun 5, 2026 · release notes

    Castle adds CSV export for team members directly from Team settings page.

    └──▷ HOW TO FIND IT
    Export an offline record of current access for compliance audits or access reviews.
    📍Navigate to Team settings › Export team members › Select CSV format
    • Adds the ability to export team member data to a CSV file via the Team settings page in the UI.

    1 detail in Everything

21. New event field: `email.registered_domain` Jun 2, 2026 · release notes

    Castle adds email.registered_domain event field to collapse subdomains for fraud detection

    └──▷ TRY IT
    Detect if multiple suspicious sign-ups are using subdomains of the same disposable provider by grouping on email.registered_domain.
    copy

    $ GET /v1/events?filter[email.registered_domain]=example.com

    • Adds new event field email.registered_domain that reduces an email's full domain to its registered part using the public suffix list

    1 detail in Everything

22. Detect residential proxies with new IP intelligence May 28, 2026 · release notes

    Castle detects residential proxies with new IP signal and richer tunnel intelligence.

    • Adds Residential Proxy IP signal to flag suspicious activity routed through consumer ISPs
    • Enriches existing proxy/Tor signals with broader IP tunnel intelligence

    2 details in Everything

23. CSV export for Lists Apr 1, 2026 · release notes

    Adds UI-driven CSV export for Lists with background processing and email notification.

    └──▷ HOW TO FIND IT
    Export a large list of entries to CSV for offline analysis without blocking the UI.
    📍In the Castle console, navigate to your List view. Click Export in the list toolbar and wait for the email with the download link.
    • Adds the Export button in the list toolbar to download List entries as CSV
    • Enables background execution for large List exports with email delivery of a download link

    2 details in Everything