Skip to main content
POST
Ingest Risk Signal

Request

string
required
Origin of the signal. One of: verification, login, attestation, external, manual
string
required
Type of risk signal. One of: velocity, geo_anomaly, device_fingerprint, behavior, deepfake, ato, impersonation
string
required
Identifier of the entity being evaluated (user ID, issuer ID, attestation ID, IP address, etc.)
string
required
Type of the subject. One of: user, issuer, attestation, session, ip, device
integer
required
Risk score from 0 (safe) to 100 (high risk). Scores ≥80 trigger automatic review decisions.
object
Arbitrary JSON payload with signal-specific context (device fingerprint, geo coordinates, behavior metrics, etc.)
string
Source IP address associated with this event.
string
User-Agent string associated with this event.

Headers

string
UUID for idempotent signal ingestion. If omitted, a random key is generated. Duplicate signals with the same key are silently ignored.

Response

string
UUID of the created risk signal.
integer
The ingested risk score (0–100).
string
ISO 8601 timestamp of ingestion.

Authorizations

X-API-Key
string
header
required

API key for machine-to-machine authentication

Body

application/json
source
string
required

Origin of the signal (e.g. device_fingerprint, ip_reputation, email_verification, document_analysis, behavioral)

Example:

"device_fingerprint"

signal_type
string
required

Classification of the risk signal

Example:

"velocity_anomaly"

score
number<float>
required

Risk score between 0 (no risk) and 1 (highest risk)

Required range: 0 <= x <= 1
Example:

0.85

entity_type
enum<string>
required

The type of entity this signal relates to

Available options:
user,
device,
ip,
document,
session
Example:

"user"

entity_id
string
required

Identifier of the entity being evaluated

Example:

"usr_8f14e45f"

details
object

Arbitrary metadata to attach to the signal

Example:

Response

Risk signal ingested

id
string<uuid>
tenant_id
string<uuid>
source
string

Origin of the signal (e.g. device_fingerprint, ip_reputation, email_verification, document_analysis, behavioral)

Example:

"device_fingerprint"

signal_type
string

Classification of the risk signal

Example:

"velocity_anomaly"

score
number<float>

Risk score between 0 (no risk) and 1 (highest risk)

Required range: 0 <= x <= 1
Example:

0.85

details
object

Arbitrary metadata associated with the signal

Example:
entity_type
enum<string>

The type of entity this signal relates to

Available options:
user,
device,
ip,
document,
session
Example:

"user"

entity_id
string

Identifier of the entity being evaluated

Example:

"usr_8f14e45f"

created_at
string<date-time>