Risk evaluate
curl --request POST \
--url https://api.truthlocks.com/v1/risk/evaluate \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"subject_id": "<string>",
"risk_score": 50
}
'const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({subject_id: '<string>', risk_score: 50})
};
fetch('https://api.truthlocks.com/v1/risk/evaluate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.truthlocks.com/v1/risk/evaluate"
payload = {
"subject_id": "<string>",
"risk_score": 50
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.truthlocks.com/v1/risk/evaluate"
payload := strings.NewReader("{\n \"subject_id\": \"<string>\",\n \"risk_score\": 50\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"decision_id": "<string>",
"signal_id": "<string>",
"decision": "allow",
"policy_id": "<string>",
"receipt_id": "<string>"
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}Risk Evaluation
Risk Evaluate
Unified risk evaluation endpoint. Ingests a signal, evaluates it against your tenant policies, creates a signed risk decision, and optionally mints a fraud_decision_receipt for non-repudiation.
POST
/
v1
/
risk
/
evaluate
Risk evaluate
curl --request POST \
--url https://api.truthlocks.com/v1/risk/evaluate \
--header 'Content-Type: application/json' \
--header 'X-API-Key: <api-key>' \
--data '
{
"subject_id": "<string>",
"risk_score": 50
}
'const options = {
method: 'POST',
headers: {'X-API-Key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({subject_id: '<string>', risk_score: 50})
};
fetch('https://api.truthlocks.com/v1/risk/evaluate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.truthlocks.com/v1/risk/evaluate"
payload = {
"subject_id": "<string>",
"risk_score": 50
}
headers = {
"X-API-Key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.truthlocks.com/v1/risk/evaluate"
payload := strings.NewReader("{\n \"subject_id\": \"<string>\",\n \"risk_score\": 50\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("X-API-Key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"decision_id": "<string>",
"signal_id": "<string>",
"decision": "allow",
"policy_id": "<string>",
"receipt_id": "<string>"
}{
"code": "AUTH_REQUIRED",
"message": "Authentication required",
"http_status": 401
}How Evaluation Works
- The signal is ingested into
risk_signals - Your active policy rules are evaluated (highest priority match wins)
- A
risk_decisionrecord is created with the outcome - If
mint_receipt: trueandissuer_id/kidare provided, afraud_decision_receiptis minted via the attestation service
Decision Outcomes
| Action | Meaning |
|---|---|
allow | No policy matched or score below all thresholds |
challenge | MFA or step-up authentication required |
block | Reject the action entirely |
review | Route to manual fraud review queue |
Built-in receipt types
| Receipt Type | Purpose |
|---|---|
fraud_decision_receipt | Records allow/challenge/block/review decision |
ato_alert_receipt | Records ATO alert events |
risk_block_receipt | Proves an action was blocked |
deepfake_detection_receipt | Records deepfake scan results |
Response
string
allow | challenge | block | reviewstring
UUID of the risk decision record.
string
UUID of the ingested risk signal.
string
UUID of the matching policy rule (if any).
string
UUID of the minted receipt (only if
mint_receipt: true and succeeded).Authorizations
API key for machine-to-machine authentication
Body
application/json

