Documentation
Captured data
The complete list of what the SDK records, when it sends it and what depends on the browser.
When it is captured and when it is sent
- While the person uses your app, the SDK keeps the last 2 minutes (
bufferMs) of replay, console and network in browser memory. Older data is continuously discarded. None of this is written to disk or sent. - When the form opens, the SDK freezes that window, takes the visible screenshot and queries the device data.
- On submit, the report is uploaded to Wutbug. If the person closes the form without submitting, nothing is uploaded.
- Auto-capture (only if you enable it): the SDK can send a report when it detects an error, depending on the configured mode. See Auto-capture.
What the person writes
| Field | Notes |
|---|---|
| Description | Required. Can be pre-filled with open({ description }). |
Optional. If they don't type one, user.email from setUser() is used. | |
| Annotated screenshot | Taken when the form opens. They can annotate it, retake it or remove it. |
| Screen recording | Optional, up to 2 minutes, no audio. Requires the person to start it and accept the browser permission. |
Replay
DOM recording with rrweb: page changes, mouse movements (sampled), scroll, clicks and focus. Input values are masked. It doesn't record canvases, doesn't embed images or fonts, and doesn't capture audio. The user's steps (clicks, fields typed in and navigation) are reconstructed from the replay.
Console
Each entry stores the time, level, source and serialized arguments (maximum 5,000 characters per argument), with the stack trace when there is an Error.
| Source | What it records |
|---|---|
console | console.log, info, warn, error and debug. |
exception | Uncaught errors (window's error event). |
unhandledrejection | Promises rejected without a catch. |
resource | Images, scripts or styles that failed to load. |
Network
Every fetch and XMLHttpRequest (except ignoreUrls URLs and Wutbug's own): method, URL, status, duration, request and response headers, bodies (masked and truncated to 10,000 characters), sizes and the network error if there was one (CORS, DNS, aborted). WebSockets, sendBeacon and resources loaded by the HTML are not recorded.
Environment
| Field | Example |
|---|---|
| Page URL (masked) | https://app.acme.com/checkout?token=[REDACTED] |
| Referrer (masked) | https://acme.com/ |
| User agent | Mozilla/5.0 … |
| Language | en-US |
| Time zone | America/New_York |
| Viewport and pixel density | 1440×900 @2x |
| Screen size | 1512×982 |
SDK version and release | 0.1.0 · 2026.11.3 |
Device
Queried when the form opens. Each piece of data is detected separately and has a 400 ms limit: if the browser doesn't expose it, the field stays empty and the report goes through anyway.
| Group | Fields | Availability |
|---|---|---|
| Type | desktop, mobile or tablet | All |
| System | Name and version (Windows 10/11, macOS, iOS, iPadOS, Android, ChromeOS, Linux) | All (exact Windows and macOS version only in Chromium) |
| Model | For example Pixel 8 or SM-S918B | Android. On iOS only "iPhone" or "iPad" |
| Browser | Brands and versions, vendor, CPU architecture | Full detail in Chromium |
| Screen | Available area, color depth, orientation | All |
| Input | Touch points, fine or coarse pointer, hover | All |
| Hardware | CPU cores, approximate memory (GB) | Cores in all; memory only Chromium |
| Battery | Level %, whether charging, estimated time | Chromium only (Safari and Firefox don't expose it) |
| Network | Online, type, effective type (4g…), estimated bandwidth, latency, data saver | Online in all; the rest only Chromium |
| Preferences | Light/dark theme, reduced motion, high contrast, languages | All |
| Storage | Site usage and quota (MB) | Most |
| Performance | Time on page, load time, JS memory used | JS memory only Chromium |
| Page | Visible or hidden, installed as an app (PWA), inside an iframe, cookies enabled | All |
What your app provides
| Data | How |
|---|---|
| User | setUser({ id, email, name, … }) |
| Metadata | setMetadata({ … }) |
| Release | init({ release }) |
What the server adds
When it receives a report, the API stores the received date, infers browser and OS from the user agent, computes an error signature to group duplicates and sets the deletion date according to the project's retention.
The API uses the sender's IP address only for abuse protection: rate limits, duplicate-submission detection and the blocklists you configure. Those counters are temporary (they expire in minutes, 10 at most). The IP is not stored in the report or in the database.
Behavior signals and origin
Every report includes the behavior signals from the captured window (rage clicks, dead clicks, slow requests, long tasks and Web Vitals) and its origin: submitted by the person, After prompt (the person accepted the auto-capture prompt) or Automatic.