> ## Documentation Index > Fetch the complete documentation index at: https://docs.baselayer.com/llms.txt > Use this file to discover all available pages before exploring further. # What baselayer.js Reports > Know exactly what baselayer.js sends from your pages, what it never sends, and what happens to a human visit. For your web, privacy and security teams. Lists what [baselayer.js](https://docs.baselayer.com/docs/kya-acceptance-quickstart.md) sends from your pages to Baselayer. ## For Security Review | Item | Detail | | - | - | | `js.baselayer.com` | Serves baselayer.js | | `.collect.baselayer.com` | Serves the detection script and receives what it collects | | `api.baselayer.com` | Receives the page records | | Cookie | One first-party cookie, `baselayer_visit`. See [The Visit Cookie](#the-visit-cookie). | | Size | At most 6.6 KB gzipped | | Loading | An ES module, so the browser loads it without blocking the page from rendering | | Sending | Every 5 seconds, sooner at 50 records, and when the page is hidden or closed | For the Content Security Policy entries, see [Set Up baselayer.js](https://docs.baselayer.com/docs/kya-acceptance-quickstart.md#content-security-policy). ## Record Kinds baselayer.js sends four kinds of record. Each carries a record ID, when it happened, the visit's cookie value and the page's path template. | Kind | When | What else it carries | | - | - | - | | `page_view` | A page opens, a single-page app changes route, or you call `track("page_view")` | On the landing page, the referrer's scheme and host | | `page_exit` | A page closes or the app leaves it | `dwell_ms` (time open), `visible_ms` (time visible) and `max_scroll_pct` (furthest scroll, 0 to 100) | | `navigation` | A single-page app changes route | The page left and the page opened, as templates, and `navigation_type` | | `interaction` | A click, a repeated click burst (`rage_click`), a click that does nothing (`dead_click`), scrolling past 25, 50, 75 and 100 %, a copy or a paste | `interaction_kind`, the target's role (such as `button` or `link`), and a hash of its `data-bl-id` attribute when it has one | At most 200 records are sent for one page. A `page_exit` always goes, and carries the number dropped past that limit as `dropped_count`. ## Path Templates A record carries a path template, never the URL. The query string and fragment are removed, and each segment shaped like an identifier becomes `{id}`: a UUID, a number of 4 or more digits, a long hex or mixed-case token, or anything holding `@`. `/orders/8812/items` is sent as `/orders/{id}/items`. Other segments are sent as they are. If your paths can hold a name or another personal value in a lowercase segment, pass your route templates in `routes` or exclude those pages with `excludePaths`. See [Options](https://docs.baselayer.com/docs/kya-acceptance-quickstart.md#options). ## What Is Never Sent * Typed text, form values, query strings and fragments. * The text, value or `href` of an element anyone clicks. * Anything on a copy or paste in a password field or a card field (`autocomplete="cc-*"`). * Anything at all from a page that matches `excludePaths`. * Anything at all when `init` gets `consent: false`. ## The Visit Cookie The snippet keeps one first-party cookie, `baselayer_visit`: 32 random hex characters, `SameSite=Lax`, `Secure` on https pages, 30 minutes from the last record. It is not `HttpOnly`, because your KYA SDK reads it to join your server's requests to the same visit. Its value travels inside the records, never as a cookie sent to Baselayer. ## Detection The snippet loads a detection script from your application's collect host, `https://.collect.baselayer.com`, and Baselayer reviews every version of that script before it is served. The detection result stays with Baselayer: the snippet only gets the token that `token()` returns, which your KYA SDK checks. The snippet never receives a verdict about a visitor. It cannot block, challenge or change anything on your page. Decisions are made by your KYA SDK, on your server. ## Humans Are Never Stored KYA records agent traffic only. The snippet can't tell a person from an agent, so it sends the same records for every visit. Baselayer holds a visit's records for up to 2 minutes while detection decides, and drops them unwritten when the verdict is a person or when no agent verdict arrives in time. To see browser records while you set up, test on [staging](https://docs.baselayer.com/docs/kya-acceptance-quickstart.md#test-against-staging). ## Delivery Records are sent to the API origin you passed as `apiOrigin` every 5 seconds, sooner when 50 are queued, and when the page is hidden or closed. A failed send is retried with backoff. A record carries a unique ID, so a retried record is never counted twice. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.