{ "openapi": "3.0.2", "info": { "title": "Search Actions", "version": "", "description": "The Actions Search API lets you query historical client actions for the authenticated tenant within a bounded time window. Use it to build investigation tools, export historical decisions, or feed downstream fraud-review workflows.\n\nEach returned item shares the nested shape used by the [Recommendations API](/openapi/risk/recommendations.openapi/other/getriskrecommendation) — the same `context`, `risk_signals`, `transaction_data` and `preview_rule` sub-objects — so an integration that already consumes recommendations can read historical actions without learning a second schema.\n\n**Recommended usage.** Always scope a query with a `start_time` and `end_time` that are as narrow as your use case allows; actions outside the window are excluded from the result, which keeps responses fast and pagination predictable. When iterating across multiple paged calls, fix `start_time` and `end_time` once at the start of the iteration and reuse the same values on every subsequent call.\n\n**Rate limit.** Requests are throttled per tenant at 20 per 60 seconds. Exceeding the limit returns `429 Too Many Requests`.\n" }, "servers": [ { "url": "https://api.sbx.transmitsecurity.io/risk/v1", "description": "Sandbox environment" }, { "url": "https://api.transmitsecurity.io/risk/v1", "description": "US production environment" }, { "url": "https://api.eu.transmitsecurity.io/risk/v1", "description": "EU production environment" }, { "url": "https://api.ca.transmitsecurity.io/risk/v1", "description": "CA production environment" }, { "url": "https://api.au.transmitsecurity.io/risk/v1", "description": "AU production environment" }, { "url": "https://api.gasne1-ts01.transmitsecurity.io/risk/v1", "description": "JP production environment" } ], "paths": { "/search/actions": { "get": { "summary": "Search actions", "description": "Returns a paginated list of actions within the requested time window. The response is scoped to the tenant identified by the access token — there is no `tenantId` parameter on this endpoint, and cross-tenant reads are not possible.\n", "operationId": "searchActions", "security": [ { "risk_access_token": [] } ], "parameters": [ { "name": "start_time", "in": "query", "required": true, "schema": { "type": "integer", "minimum": 0, "example": 1779600000000 }, "description": "Start of the time window, Unix epoch time in milliseconds." }, { "name": "end_time", "in": "query", "required": true, "schema": { "type": "integer", "minimum": 0, "example": 1779686400000 }, "description": "End of the time window, Unix epoch time in milliseconds." }, { "name": "skip", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 0, "maximum": 10000, "default": 0 }, "description": "Pagination offset. Maximum 10000." }, { "name": "take", "in": "query", "required": false, "schema": { "type": "integer", "minimum": 1, "maximum": 400, "default": 100 }, "description": "Page size. Maximum 400." }, { "name": "sort_field", "in": "query", "required": false, "schema": { "$ref": "#/components/schemas/sort_field" }, "description": "Field to sort by. Defaults to `issued_at`." }, { "name": "order", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "ASC", "DESC" ], "default": "DESC" }, "description": "Sort direction. Defaults to `DESC`." }, { "name": "filters", "in": "query", "required": false, "schema": { "$ref": "#/components/schemas/filters" }, "description": "URL-encoded JSON describing the filter expression. One of: a single `{ field, operator, value }` condition, an `{ and: [conditions...] }` group, or an `{ or: [conditions...] }` group. One level deep.\n" }, { "name": "fields", "in": "query", "required": false, "schema": { "type": "array", "items": { "$ref": "#/components/schemas/field" } }, "description": "URL-encoded JSON array of field names to include in each item. When omitted, only `id`, `issued_at`, `context.action_id`, and `context.action_performed_at` are populated with real data; all other fields contain empty or zero default values. Specify the fields required by your integration to populate them with meaningful data.\n" } ], "responses": { "200": { "$ref": "#/components/responses/success_search_actions" }, "400": { "$ref": "#/components/responses/bad_request" }, "401": { "$ref": "#/components/responses/unauthorized" }, "403": { "$ref": "#/components/responses/forbidden" }, "429": { "$ref": "#/components/responses/rate_limit_reached" }, "500": { "$ref": "#/components/responses/internal_error" } } } } }, "components": { "schemas": { "paginated_actions_response": { "type": "object", "required": [ "items", "count", "skipped" ], "properties": { "items": { "type": "array", "description": "Page of actions matching the query.", "items": { "$ref": "#/components/schemas/action_item" } }, "count": { "type": "integer", "description": "Number of items in this page.", "example": 100 }, "skipped": { "type": "integer", "description": "Echo of the requested `skip` offset.", "example": 0 } } }, "action_item": { "type": "object", "required": [ "id", "issued_at", "recommendation", "risk_score", "context", "risk_signals", "reasons", "threats" ], "properties": { "id": { "type": "string", "example": "385cd06b527a974982e0560b67123fe2b1b5a39fd98d8d32cdbaca8ec16fd62d", "description": "Action identifier." }, "issued_at": { "type": "integer", "example": 1648028118123, "description": "Unix epoch time in milliseconds the action was issued at." }, "recommendation": { "$ref": "#/components/schemas/recommendation" }, "risk_score": { "$ref": "#/components/schemas/risk_score" }, "context": { "$ref": "#/components/schemas/context" }, "risk_signals": { "$ref": "#/components/schemas/risk_signals" }, "reasons": { "$ref": "#/components/schemas/reasons" }, "threats": { "$ref": "#/components/schemas/threats" }, "transaction_data": { "$ref": "#/components/schemas/transaction_data" }, "preview_rule": { "$ref": "#/components/schemas/preview_rule" }, "custom_attributes": { "$ref": "#/components/schemas/custom_attributes" }, "was_consumed_by_api": { "type": "boolean", "description": "Whether the action was already consumed by a recommendation API call." }, "label": { "$ref": "#/components/schemas/action_label" } } }, "action_label": { "type": "object", "description": "Label applied to this action by a reviewer. Returned only when label fields are requested via the `fields` parameter and the action has been labeled.", "properties": { "type": { "type": "string", "description": "Label type classification." }, "source": { "type": "string", "description": "Source system or workflow that created the label." }, "subject_value": { "type": "string", "description": "Identifier of the labeled subject (user, device, etc.)." }, "use_case": { "type": "string", "description": "Use-case context for the label." }, "sub_category": { "type": "string", "description": "Sub-category within the label type." }, "attack_method": { "type": "string", "description": "Attack method associated with the label." } } }, "filters": { "type": "object", "description": "Filter expression. Exactly one of `and`, `or`, or a single `{ field, operator, value }` condition must be present. One level deep — nested groups are not supported.\n", "properties": { "and": { "type": "array", "description": "All conditions in this group must match.", "minItems": 1, "items": { "$ref": "#/components/schemas/filter_condition" } }, "or": { "type": "array", "description": "At least one condition in this group must match.", "minItems": 1, "items": { "$ref": "#/components/schemas/filter_condition" } }, "field": { "$ref": "#/components/schemas/filter_field" }, "operator": { "$ref": "#/components/schemas/filter_operator" }, "value": { "$ref": "#/components/schemas/filter_value" } } }, "filter_condition": { "type": "object", "required": [ "field", "operator", "value" ], "properties": { "field": { "$ref": "#/components/schemas/filter_field" }, "operator": { "$ref": "#/components/schemas/filter_operator" }, "value": { "$ref": "#/components/schemas/filter_value" } } }, "filter_field": { "type": "string", "description": "Field path to filter on. Must be one of the listed values.", "enum": [ "id", "risk_score", "reasons", "threats", "was_consumed_by_api", "recommendation.type", "recommendation.result", "recommendation.challenge_type", "context.action_id", "context.action_type", "context.application_id", "context.client_id", "context.correlation_id", "context.device_fingerprint", "context.device_public_key", "context.device_id", "context.user_id", "context.claimed_user_id", "context.ip", "context.ip_country", "context.ip_location_city", "context.ip_asn_id", "context.ip_asn_name", "context.ip_domain", "context.ip_location_region", "context.ip_location_timezone", "context.ip_organization_type", "context.os_name", "context.browser_name", "context.user_agent", "context.device_timezone", "risk_signals.device.model", "risk_signals.device.screen_height", "risk_signals.device.screen_width", "risk_signals.device.screen_color_depth", "risk_signals.device.screen_pixel_depth", "risk_signals.device.screen_avail_width", "risk_signals.device.screen_avail_height", "risk_signals.device.tampered", "risk_signals.device.emulated", "risk_signals.device.spoofed", "risk_signals.device.mobile_network_code", "risk_signals.device.device_name", "risk_signals.device.summer_timezone_offset", "risk_signals.device.winter_timezone_offset", "risk_signals.device.device_power_state", "risk_signals.device.tz_mismatch", "risk_signals.device.device_timezone_offset", "risk_signals.network.vpn", "risk_signals.network.tor", "risk_signals.network.proxy", "risk_signals.network.anonymizer", "risk_signals.behavior.typing_velocity", "risk_signals.behavior.movement_velocity", "risk_signals.behavior.input_method", "risk_signals.behavior.no_user_interaction", "risk_signals.behavior.straight_line_ratio", "risk_signals.behavior.right_angels_ratio", "risk_signals.behavior.minor_angels_ratio", "risk_signals.behavior.movement_latency", "risk_signals.behavior.corner_click", "risk_signals.history.linking_device_to_users_count", "risk_signals.history.linking_user_to_device_count", "transaction_data.amount", "transaction_data.currency", "transaction_data.type", "transaction_data.method", "transaction_data.channelId", "transaction_data.reason", "transaction_data.transactionDate", "transaction_data.payee.name", "transaction_data.payee.accountNumber", "transaction_data.payee.accountId", "transaction_data.payee.accountCountryCode", "transaction_data.payee.bankIdentifier", "transaction_data.payee.branchIdentifier", "transaction_data.payee.card.holderName", "transaction_data.payee.card.bin", "transaction_data.payee.card.last4", "transaction_data.payer.name", "transaction_data.payer.accountNumber", "transaction_data.payer.accountId", "transaction_data.payer.accountCountryCode", "transaction_data.payer.bankIdentifier", "transaction_data.payer.branchIdentifier", "transaction_data.payer.customerTier", "transaction_data.payer.card.holderName", "transaction_data.payer.card.bin", "transaction_data.payer.card.last4", "transaction_data.payer.billingInfo.name", "transaction_data.payer.billingInfo.addressLine1", "transaction_data.payer.billingInfo.addressLine2", "transaction_data.payer.billingInfo.city", "transaction_data.payer.billingInfo.state", "transaction_data.payer.billingInfo.zipPostalCode", "transaction_data.payer.billingInfo.country", "transaction_data.payer.billingInfo.email", "transaction_data.payer.billingInfo.phone", "transaction_data.purchase.totalItems", "transaction_data.purchase.shippingInfo.name", "transaction_data.purchase.shippingInfo.addressLine1", "transaction_data.purchase.shippingInfo.addressLine2", "transaction_data.purchase.shippingInfo.city", "transaction_data.purchase.shippingInfo.state", "transaction_data.purchase.shippingInfo.zipPostalCode", "transaction_data.purchase.shippingInfo.country", "transaction_data.purchase.shippingInfo.email", "transaction_data.purchase.shippingInfo.phone", "transaction_data.avs.code", "transaction_data.avs.provider", "transaction_data.avs.matchLevel", "assignee_id", "labeler_id", "fraud_ring_id", "campaign_id", "list_id", "label.type", "label.subject_value", "label.source", "label.use_case", "label.sub_category", "label.attack_method", "preview_rule.rule_name", "preview_rule.recommendation" ] }, "filter_operator": { "type": "string", "description": "Comparison operator. The valid `value` shape depends on the operator chosen — see `filter_value`.\n", "enum": [ "eq", "neq", "lt", "gt", "between", "in", "nin" ], "example": "eq" }, "filter_value": { "description": "Value to compare against. Shape depends on the operator:\n - `eq` / `neq` — string, number, or boolean\n - `lt` / `gt` — number\n - `between` — `[number, number]` tuple\n - `in` / `nin` — array of string, number, or boolean\n", "oneOf": [ { "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "array", "items": { "oneOf": [ { "type": "string" }, { "type": "number" }, { "type": "boolean" } ] } } ] }, "sort_field": { "type": "string", "description": "Field name to sort by. Must be one of the listed values.", "default": "issued_at", "enum": [ "id", "issued_at", "risk_score", "threats", "was_consumed_by_api", "recommendation.type", "recommendation.result", "recommendation.challenge_type", "context.action_id", "context.action_type", "context.action_performed_at", "context.application_id", "context.client_id", "context.correlation_id", "context.device_fingerprint", "context.device_id", "context.device_timestamp", "context.user_id", "context.ip", "context.ip_country", "context.ip_location_city", "context.ip_asn_name", "context.ip_location_timezone", "context.os_name", "context.os_version", "context.browser_name", "context.browser_version", "context.user_agent", "context.device_timezone", "risk_signals.device.tampered", "risk_signals.device.emulated", "risk_signals.device.spoofed", "risk_signals.device.true_useragent", "risk_signals.device.summer_timezone_offset", "risk_signals.device.winter_timezone_offset", "risk_signals.device.device_power_state", "risk_signals.network.vpn", "risk_signals.network.tor", "risk_signals.network.proxy", "risk_signals.network.anonymizer", "risk_signals.behavior.typing_velocity", "risk_signals.behavior.movement_velocity", "risk_signals.behavior.no_user_interaction", "risk_signals.history.ip_action_rate_60_sec", "risk_signals.history.user_action_rate_60_sec", "risk_signals.history.device_action_rate_60_sec", "risk_signals.history.ip_user_count_last_hour", "risk_signals.history.ip_device_count_last_hour", "risk_signals.history.linking_device_to_users_count", "risk_signals.history.linking_user_to_device_count", "assignee_id", "labeler_id", "fraud_ring_id", "label.type", "label.subject_value", "label.source", "label.use_case", "label.sub_category", "label.attack_method", "preview_rule.rule_name", "preview_rule.recommendation" ] }, "field": { "type": "string", "description": "Field name to include in each item.", "enum": [ "id", "issued_at", "risk_score", "reasons", "threats", "custom_attributes", "was_consumed_by_api", "recommendation.type", "recommendation.result", "recommendation.challenge_type", "context.action_id", "context.action_type", "context.action_performed_at", "context.application_id", "context.client_id", "context.correlation_id", "context.device_fingerprint", "context.device_public_key", "context.device_id", "context.device_timestamp", "context.user_id", "context.claimed_user_id", "context.ip", "context.ip_country", "context.ip_location_city", "context.ip_asn_id", "context.ip_asn_name", "context.ip_domain", "context.ip_location_region", "context.ip_location_zip", "context.ip_location_longitude", "context.ip_location_latitude", "context.ip_location_timezone", "context.ip_organization_name", "context.ip_organization_type", "context.os_name", "context.os_version", "context.browser_name", "context.browser_version", "context.user_agent", "context.device_timezone", "context.device_languages", "context.device_platform", "risk_signals.device.ram", "risk_signals.device.total_storage", "risk_signals.device.available_storage", "risk_signals.device.battery_level", "risk_signals.device.core_number", "risk_signals.device.graphic_card", "risk_signals.device.model", "risk_signals.device.screen_height", "risk_signals.device.screen_width", "risk_signals.device.screen_color_depth", "risk_signals.device.screen_pixel_depth", "risk_signals.device.screen_avail_width", "risk_signals.device.screen_avail_height", "risk_signals.device.incognito", "risk_signals.device.tampered", "risk_signals.device.emulated", "risk_signals.device.spoofed", "risk_signals.device.esim_usage", "risk_signals.device.true_useragent", "risk_signals.device.mobile_network_code", "risk_signals.device.font_count", "risk_signals.device.cpu_arch", "risk_signals.device.device_name", "risk_signals.device.summer_timezone_offset", "risk_signals.device.winter_timezone_offset", "risk_signals.device.device_power_state", "risk_signals.device.tz_mismatch", "risk_signals.device.device_timezone_offset", "risk_signals.device.accept_languages", "risk_signals.device.navigator_useragent", "risk_signals.network.vpn", "risk_signals.network.tor", "risk_signals.network.hosting", "risk_signals.network.proxy", "risk_signals.network.anonymizer", "risk_signals.network.x_forwarded_for", "risk_signals.behavior.typing_velocity", "risk_signals.behavior.movement_velocity", "risk_signals.behavior.input_method", "risk_signals.behavior.no_user_interaction", "risk_signals.behavior.straight_line_ratio", "risk_signals.behavior.right_angels_ratio", "risk_signals.behavior.minor_angels_ratio", "risk_signals.behavior.movement_latency", "risk_signals.behavior.corner_click", "risk_signals.history.ip_action_rate_60_sec", "risk_signals.history.user_action_rate_60_sec", "risk_signals.history.device_action_rate_60_sec", "risk_signals.history.ip_user_count_last_hour", "risk_signals.history.ip_device_count_last_hour", "risk_signals.history.linking_device_to_users_count", "risk_signals.history.linking_user_to_device_count", "transaction_data.amount", "transaction_data.currency", "transaction_data.type", "transaction_data.method", "transaction_data.channelId", "transaction_data.reason", "transaction_data.transactionDate", "transaction_data.payee.name", "transaction_data.payee.accountNumber", "transaction_data.payee.accountId", "transaction_data.payee.accountCountryCode", "transaction_data.payee.bankIdentifier", "transaction_data.payee.branchIdentifier", "transaction_data.payee.card.holderName", "transaction_data.payee.card.bin", "transaction_data.payee.card.last4", "transaction_data.payer.name", "transaction_data.payer.accountNumber", "transaction_data.payer.accountId", "transaction_data.payer.accountCountryCode", "transaction_data.payer.bankIdentifier", "transaction_data.payer.branchIdentifier", "transaction_data.payer.customerTier", "transaction_data.payer.card.holderName", "transaction_data.payer.card.bin", "transaction_data.payer.card.last4", "transaction_data.payer.billingInfo.name", "transaction_data.payer.billingInfo.addressLine1", "transaction_data.payer.billingInfo.addressLine2", "transaction_data.payer.billingInfo.city", "transaction_data.payer.billingInfo.state", "transaction_data.payer.billingInfo.zipPostalCode", "transaction_data.payer.billingInfo.country", "transaction_data.payer.billingInfo.email", "transaction_data.payer.billingInfo.phone", "transaction_data.purchase.totalItems", "transaction_data.purchase.products", "transaction_data.purchase.shippingInfo.name", "transaction_data.purchase.shippingInfo.addressLine1", "transaction_data.purchase.shippingInfo.addressLine2", "transaction_data.purchase.shippingInfo.city", "transaction_data.purchase.shippingInfo.state", "transaction_data.purchase.shippingInfo.zipPostalCode", "transaction_data.purchase.shippingInfo.country", "transaction_data.purchase.shippingInfo.email", "transaction_data.purchase.shippingInfo.phone", "transaction_data.avs.code", "transaction_data.avs.provider", "transaction_data.avs.matchLevel", "label.type", "label.subject_value", "label.source", "label.use_case", "label.sub_category", "label.attack_method", "preview_rule.rule_name", "preview_rule.recommendation" ] }, "recommendation_type": { "type": "string", "description": "Recommendation type.", "enum": [ "ALLOW", "CHALLENGE", "DENY", "TRUST" ], "example": "CHALLENGE" }, "result_type": { "type": "string", "description": "The outcome of the action.", "enum": [ "success", "failure", "incomplete" ], "example": "success" }, "challenge_type": { "type": "string", "description": "The type of challenge enforced for the reported action.", "enum": [ "sms_otp", "email_otp", "totp", "push_otp", "voice_otp", "idv", "captcha", "invisible_captcha", "password", "passkey" ], "example": "email_otp" }, "recommendation": { "type": "object", "description": "Decision the engine produced for the action.", "required": [ "type" ], "properties": { "type": { "$ref": "#/components/schemas/recommendation_type" }, "result": { "allOf": [ { "$ref": "#/components/schemas/result_type" } ], "nullable": true }, "challenge_type": { "$ref": "#/components/schemas/challenge_type" } } }, "risk_score": { "type": "number", "description": "Used to assess the risk level of the action.", "minimum": 0, "maximum": 100, "example": 73.2 }, "action_type": { "type": "string", "example": "login", "description": "Type of client action this recommendation was issued for." }, "context": { "type": "object", "description": "Identifies the context in which the action occurred.", "properties": { "action_id": { "type": "string", "example": "885cd06b527a97498200560b67123fe221b5a39fd98d8d22cdb7ca8ec16ed62d", "description": "Identifier of the client action." }, "action_type": { "$ref": "#/components/schemas/action_type" }, "action_performed_at": { "type": "integer", "example": 1648028118123, "description": "Unix epoch time in milliseconds the action event was reported." }, "device_timestamp": { "type": "integer", "example": 1648028107819, "description": "Unix epoch timestamp (ms) from the device clock when the action is triggered via `triggerActionEvent()`. For backend-triggered actions, uses the server time. Used to correlate client and server events.\n" }, "client_id": { "type": "string", "example": "d152ddd.ece93f4.c2a3d12.riskid.security", "description": "Identifies the client associated with the action." }, "application_id": { "type": "string", "example": "ece93f4", "description": "Identifies the application associated with the action." }, "tenant_id": { "type": "string", "example": "c2a3d12", "description": "Identifies your tenant within Transmit." }, "device_id": { "type": "string", "example": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIwZGE4ZmZjYy01NmE1LTRmMjgtYThkZi04NDY5MmYwYThmYTAiLCJ2ZXJzaW9uIjoxLCJpYXQiOjE2NTU3OTYzODQ1MzF9.TeGoqlCe_6eWzl9a3-vAumG4Xap8WjwsgcO2-DzGtLg", "description": "Unique device identifier generated by Transmit Security and stored by the SDK. On web, stored in the cookie. On mobile, uses platform-provided identifiers such as Android ID (hex string) or iOS `identifierForVendor` (alphanumeric). Not derived from IMEI or other hardware identifiers.\n" }, "correlation_id": { "type": "string", "example": "bcb934d8-89cb-433b-a4c7-b7d94299586b", "description": "Any ID that could help relate the action with external context or session (if set via `triggerActionEvent()` SDK calls)." }, "device_fingerprint": { "type": "string", "example": "a3c8f5ea75cb65fcdc3d0452b985f957a46e24afdc912e93dac1e115ecf408e5", "description": "Hash value on all the device data collected from the browser." }, "device_public_key": { "type": "string", "example": "625ad815e47a1a05318c98185ff8cfb35fd706d836a1ad7459842f381929a8e3", "description": "A unique and persistent identifier derived from cryptographic binding." }, "user_id": { "type": "string", "example": "5c4afa75c", "description": "Opaque identifier of the user in your system (if set via `setAuthenticatedUser()` or `init()` SDK calls)." }, "claimed_user_id": { "type": "string", "example": "5c4afa75c", "description": "User ID of the not-yet-authenticated user, used to enhance risk and trust assessments. Once the user is authenticated, `setAuthenticatedUser()` should be called." }, "location": { "type": "string", "example": "https://www.amazingapp.com/shops?target=1", "description": "The place in the application in which the action was performed (such as the page URL)." }, "ip": { "type": "string", "format": "ipv4", "example": "160.221.187.219", "description": "IP address." }, "ip_country": { "type": "string", "example": "US", "description": "Country code, specified in a two-letter format (ISO 3166-1 alpha-2)." }, "ip_location_region": { "type": "string", "example": "California", "description": "Location region identified by IP address." }, "ip_domain": { "type": "string", "example": "example.com", "description": "Domain name resolved from IP address." }, "ip_location_city": { "type": "string", "example": "Los Angeles", "description": "Location city identified by IP address." }, "ip_location_zip": { "type": "string", "example": "92131", "description": "Location ZIP code identified by IP address." }, "ip_location_longitude": { "type": "string", "example": "-117.0903", "description": "Geolocation longitude identified by IP address." }, "ip_location_latitude": { "type": "string", "example": "32.9167", "description": "Geolocation latitude identified by IP address." }, "ip_asn_id": { "type": "string", "example": "AS174", "description": "Globally unique identifier that defines a group of one or more IP prefixes." }, "ip_asn_name": { "type": "string", "example": "AS174 Cogent Communications", "description": "ASN name of the IP address." }, "ip_organization_name": { "type": "string", "example": "Cogent Communications", "description": "IP organization name." }, "ip_organization_type": { "type": "string", "example": "isp", "description": "Type of IP connection (for example, `isp`, `hosting`, `business`)." }, "ip_location_timezone": { "type": "string", "example": "America/Los_Angeles", "description": "Timezone location identified by IP address." }, "device_timezone": { "type": "string", "example": "America/Los_Angeles", "description": "Timezone on device." }, "device_languages": { "type": "array", "items": { "type": "string" }, "example": [ "en-US", "en" ], "description": "Languages on device." }, "device_platform": { "type": "string", "example": "desktop", "description": "Type of device platform." }, "os_name": { "type": "string", "example": "macOS", "description": "Name of the operating system." }, "os_version": { "type": "string", "example": "14.1.0", "description": "Operating system version." }, "browser_name": { "type": "string", "example": "Chrome", "description": "Name of the browser." }, "browser_version": { "type": "string", "example": "113", "description": "Browser major version." }, "user_agent": { "type": "string", "example": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36", "description": "User agent string." } } }, "risk_signals": { "type": "object", "description": "Additional informative signals derived from the action.", "properties": { "device": { "type": "object", "description": "Device-relevant signals.", "properties": { "ram": { "type": "number", "description": "Device memory, a floating-point number." }, "total_storage": { "type": "number", "description": "Device total storage, as received from the mobile native platform." }, "available_storage": { "type": "number", "description": "Device available storage, as received from the mobile native platform." }, "battery_level": { "type": "number", "description": "Device battery level, a floating-point number." }, "device_power_state": { "type": "string", "description": "Indicates if the device is currently plugged into a power source." }, "core_number": { "type": "number", "description": "Device core number." }, "graphic_card": { "type": "string", "description": "Device graphics card, as received from the web platform." }, "model": { "type": "string", "description": "Device model." }, "screen_width": { "type": "number", "description": "Device screen width in pixels." }, "screen_height": { "type": "number", "description": "Device screen height in pixels." }, "screen_pixel_depth": { "type": "number", "description": "Pixel depth of the device screen." }, "screen_color_depth": { "type": "number", "description": "Color depth of the device screen." }, "screen_avail_width": { "type": "number", "description": "Available width of the screen." }, "screen_avail_height": { "type": "number", "description": "Available height of the screen." }, "incognito": { "type": "boolean", "description": "Whether the event was performed using incognito browsing." }, "tampered": { "type": "boolean", "description": "Whether the device is tampered (root or jailbreak)." }, "emulated": { "type": "boolean", "description": "Whether the device is emulated." }, "spoofed": { "type": "boolean", "description": "Whether the device is spoofed." }, "tz_mismatch": { "type": "boolean", "description": "Whether the event was performed on a device with a timezone mismatching expected." }, "esim_usage": { "type": "boolean", "description": "Whether the event was performed using eSIM." }, "accept_languages": { "type": "string", "description": "Value of the `accept-language` header at the action request." }, "mobile_network_code": { "type": "string", "description": "String representation of the device's mobile carrier MCC and MNC." }, "font_count": { "type": "number", "description": "Number of fonts available on the device." }, "cpu_arch": { "type": "string", "description": "Device CPU architecture." }, "navigator_useragent": { "type": "string", "description": "User agent string from the device's browser navigator." }, "true_useragent": { "type": "string", "description": "User agent string reconstructed by the SDK, providing details about the browser, OS, and device." }, "device_timezone_offset": { "type": "number", "description": "Timezone offset of the device, in minutes from UTC." }, "summer_timezone_offset": { "type": "number", "description": "Device's timezone offset in minutes from UTC during daylight saving time." }, "winter_timezone_offset": { "type": "number", "description": "Device's timezone offset in minutes from UTC during standard time." }, "device_name": { "type": "string", "description": "Device's name as recorded on iOS, reflecting the user-set name." } } }, "network": { "type": "object", "description": "Network-relevant signals.", "properties": { "vpn": { "type": "boolean", "description": "Whether the event was performed using a VPN connection." }, "tor": { "type": "boolean", "description": "Whether the event was performed using a Tor connection." }, "hosting": { "type": "boolean", "description": "Whether the event was performed from a hosting provider." }, "proxy": { "type": "boolean", "description": "Whether the event was performed via a proxy." }, "anonymizer": { "type": "boolean", "description": "Whether the event was performed via an anonymizer." }, "x_forwarded_for": { "type": "array", "items": { "type": "string" }, "description": "The `X-Forwarded-For` header value, indicating the chain of intermediate proxies.", "example": [ "160.221.187.219", "52.23.177.192", "172.70.34.26" ] } } }, "behavior": { "type": "object", "description": "User-behavior-relevant signals.", "properties": { "typing_velocity": { "type": "number", "example": 0.867, "description": "Percentile of user typing speed." }, "movement_velocity": { "type": "number", "example": 10, "description": "Number of input events per second." }, "input_method": { "description": "A list of used input methods.\n\n| Value | Description | Platform |\n|---|---|---|\n| `is_typing` | Standard character-by-character keyboard text entry. | Web, Mobile |\n| `is_paste` | Content inserted via paste (e.g. Ctrl/Cmd+V or context-menu paste). | Web, Mobile |\n| `is_autocomplete` | Value entered via an OS/keyboard autocomplete or autofill suggestion. | Mobile |\n| `is_password_manager` | Value populated by a password manager / browser autofill. | Web |\n| `is_insert_replacement_text` | Existing text replaced with a suggested value (e.g. spell-check/autocorrect or autofill replacement). | Web |\n| `is_insert_composition` | Text inserted from an in-progress IME composition (e.g. while composing CJK characters). | Web |\n| `is_insert_from_composition` | Text committed (finalized) from an IME composition. | Web |\n| `is_insert_line_break` | A line break was inserted (e.g. Shift+Enter). | Web |\n| `is_insert_from_drop` | Text inserted by dragging and dropping content into the field. | Web |\n| `is_delete` | A deletion occurred (generic). | Mobile |\n| `is_delete_content_backward` | Deletion of the character before the cursor (Backspace). | Web |\n| `is_delete_content_forward` | Deletion of the character after the cursor (Delete key). | Web |\n| `is_delete_content` | Generic content deletion where direction is unspecified. | Web |\n| `is_delete_word_backward` | Deletion of the word before the cursor (e.g. Ctrl/Alt+Backspace). | Web |\n| `is_delete_softline_backward` | Deletion to the start of the current soft-wrapped line. | Web |\n| `is_delete_hardline_backward` | Deletion to the start of the current line/block (hard line boundary). | Web |\n| `is_delete_by_cut` | Content removed via Cut (e.g. Ctrl/Cmd+X). | Web |\n| `is_delete_by_drag` | Content removed by dragging it out of the field. | Web |\n| `is_delete_composition_text` | Deletion of in-progress IME composition text. | Web |\n| `is_history_undo` | An undo action (e.g. Ctrl/Cmd+Z). | Web |\n| `is_history_redo` | A redo action (e.g. Ctrl/Cmd+Y or Shift+Ctrl/Cmd+Z). | Web |", "example": [ "is_typing", "is_paste" ], "type": "array", "items": { "type": "string" } }, "no_user_interaction": { "type": "boolean", "description": "Whether there was any user interaction before clicks." }, "straight_line_ratio": { "type": "number", "description": "Ratio of straight-line movements out of all movements in the action's context." }, "right_angels_ratio": { "type": "number", "description": "Ratio of right-angle movements out of all movements in the action's context." }, "minor_angels_ratio": { "type": "number", "description": "Ratio of minor-angle movements out of all movements in the action's context." }, "movement_latency": { "type": "number", "description": "Median delay of mouse or touchscreen movements (ms) within the action's context." }, "corner_click": { "type": "boolean", "description": "Whether there were multiple clicks on the corner of a button in the action's context." } } }, "history": { "type": "object", "description": "User-history-relevant signals.", "properties": { "ip_action_rate_60_sec": { "type": "integer", "example": 7, "description": "Number of actions originating from the same client IP within 60 seconds prior to this action." }, "user_action_rate_60_sec": { "type": "integer", "description": "Number of actions with the same `user_id` within 60 seconds prior to this action." }, "device_action_rate_60_sec": { "type": "integer", "description": "Number of actions originating from the same `device_id` within 60 seconds prior to this action." }, "ip_user_count_last_hour": { "type": "integer", "description": "Number of distinct `user_id`s associated with the IP address within the previous hour." }, "ip_device_count_last_hour": { "type": "integer", "description": "Number of distinct `device_id`s associated with the IP address within the previous hour." }, "linking_device_to_users_count": { "type": "integer", "description": "Number of distinct `user_id`s associated with this `device_id`." }, "linking_user_to_device_count": { "type": "integer", "description": "Number of distinct `device_id`s associated with this `user_id`." } } } } }, "reasons": { "type": "array", "description": "Reasons that contributed to the recommendation.", "items": { "type": "string" }, "example": [ "BEHAVIOR_BOT", "IP_RISKY_REPUTATION", "DEVICE_SUSPICIOUS_ATTRIBUTE", "PROFILE_DEVICE_NEW" ] }, "threats": { "type": "array", "description": "List of all detected threats.", "items": { "type": "string" }, "example": [ "ACCOUNT_TAKEOVER", "NEW_FRAUD_ACCOUNT" ] }, "transaction_type": { "type": "string", "description": "Transaction type.", "enum": [ "purchase", "bill_payment", "mobile_recharge", "money_transfer", "credit_transfer", "credit_redemption", "top_up", "withdrawal", "investment", "loan", "refund", "other" ], "example": "purchase" }, "transaction_method": { "type": "string", "description": "Transaction method.", "enum": [ "bank_account", "wire", "card", "p2p", "wallet" ], "example": "card" }, "transaction_card": { "type": "object", "description": "Card-level identifiers for the party.", "properties": { "holderName": { "type": "string", "minLength": 1, "maxLength": 100, "example": "John Doe", "description": "Name of the card holder." }, "bin": { "type": "string", "minLength": 6, "maxLength": 8, "example": "411111", "description": "Bank Identification Number (first 6 digits of the card)." }, "last4": { "type": "string", "minLength": 4, "maxLength": 4, "example": "1234", "description": "Last 4 digits of the credit card number." } } }, "transaction_party": { "type": "object", "description": "Shared shape for a transaction party (payee or payer).", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 100, "example": "John Doe", "description": "Party's name." }, "accountNumber": { "type": "string", "minLength": 1, "maxLength": 100, "example": "1234567890123456", "description": "Party's account number." }, "accountId": { "type": "string", "minLength": 1, "maxLength": 100, "example": "USER_983245", "description": "Unique identifier for the party's account." }, "accountCountryCode": { "type": "string", "minLength": 2, "maxLength": 2, "pattern": "^[A-Z]{2}$", "example": "US", "description": "Country code of the account (ISO-3166-1 alpha-2)." }, "bankIdentifier": { "type": "string", "minLength": 1, "maxLength": 40, "example": "CHASEUS33", "description": "Party's bank identifier." }, "branchIdentifier": { "type": "string", "minLength": 1, "maxLength": 40, "example": "123456", "description": "Party's branch identifier." }, "card": { "$ref": "#/components/schemas/transaction_card" } } }, "transaction_address": { "type": "object", "description": "Address and contact information (used by `billingInfo` and `shippingInfo`).", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 100, "example": "John Doe", "description": "Full name." }, "addressLine1": { "type": "string", "minLength": 1, "maxLength": 255, "example": "123 Main St", "description": "Address line 1." }, "addressLine2": { "type": "string", "minLength": 1, "maxLength": 255, "example": "Apt 4B", "description": "Address line 2." }, "city": { "type": "string", "minLength": 1, "maxLength": 100, "example": "New York", "description": "City." }, "state": { "type": "string", "minLength": 1, "maxLength": 100, "example": "NY", "description": "State, province, or region." }, "zipPostalCode": { "type": "string", "minLength": 1, "maxLength": 20, "example": "10001", "description": "ZIP or postal code." }, "country": { "type": "string", "minLength": 2, "maxLength": 2, "pattern": "^[A-Z]{2}$", "example": "US", "description": "Country code (ISO-3166-1 alpha-2)." }, "email": { "type": "string", "minLength": 3, "maxLength": 255, "example": "john.doe@example.com", "description": "Email address." }, "phone": { "type": "string", "minLength": 1, "maxLength": 30, "example": "+1234567890", "description": "Phone number." } } }, "transaction_payer": { "allOf": [ { "$ref": "#/components/schemas/transaction_party" } ], "type": "object", "description": "Payer party of the transaction. Adds customer-tier and billing-info fields on top of the shared party shape.", "properties": { "customerTier": { "type": "string", "minLength": 1, "maxLength": 50, "example": "premium", "description": "Payer's customer tier." }, "billingInfo": { "$ref": "#/components/schemas/transaction_address" } } }, "transaction_payee": { "allOf": [ { "$ref": "#/components/schemas/transaction_party" } ], "description": "Payee party of the transaction." }, "transaction_product": { "type": "object", "description": "A single product line item.", "properties": { "id": { "type": "string", "minLength": 1, "maxLength": 100, "example": "PROD_12345", "description": "Unique identifier for the product." }, "name": { "type": "string", "minLength": 1, "maxLength": 255, "example": "iPhone 15", "description": "Name of the product." }, "amount": { "type": "integer", "minimum": 1, "example": 1, "description": "Quantity of this product line item." }, "price": { "type": "number", "minimum": 0, "example": 999.99, "description": "Price per unit of the product." } } }, "transaction_purchase": { "type": "object", "description": "Purchase details for the transaction.", "properties": { "totalItems": { "type": "integer", "minimum": 1, "example": 3, "description": "Total number of items in the purchase." }, "products": { "type": "array", "description": "Line items in the purchase.", "items": { "$ref": "#/components/schemas/transaction_product" } }, "shippingInfo": { "$ref": "#/components/schemas/transaction_address" } } }, "avs_match_level": { "type": "string", "description": "AVS match level.", "enum": [ "none", "postal", "street", "full", "unknown" ], "example": "full" }, "transaction_avs": { "type": "object", "description": "Address Verification Service result for the transaction.", "properties": { "code": { "type": "string", "minLength": 1, "maxLength": 10, "example": "Y", "description": "AVS response code." }, "provider": { "type": "string", "minLength": 1, "maxLength": 50, "example": "Stripe", "description": "AVS provider name." }, "matchLevel": { "$ref": "#/components/schemas/avs_match_level" } } }, "transaction_data": { "type": "object", "description": "Transaction data-points provided with the action via the SDK.", "properties": { "amount": { "type": "number", "description": "Monetary amount of the transaction. Sanitized server-side with `parseFloat`; must be strictly positive and at most 999,999,999.99.\n", "exclusiveMinimum": 0, "maximum": 999999999.99, "example": 1500.75 }, "currency": { "type": "string", "example": "USD", "description": "Currency code for the transaction (ISO-4217)." }, "type": { "$ref": "#/components/schemas/transaction_type" }, "method": { "$ref": "#/components/schemas/transaction_method" }, "channelId": { "type": "string", "minLength": 1, "maxLength": 100, "example": "MOBILE_APP", "description": "Identifier for the channel used for the transaction." }, "reason": { "type": "string", "minLength": 1, "maxLength": 200, "example": "Monthly subscription payment", "description": "Reason for the transaction." }, "transactionDate": { "type": "integer", "minimum": 0, "example": 1712594340000, "description": "Transaction timestamp (Unix epoch, milliseconds or seconds)." }, "payer": { "$ref": "#/components/schemas/transaction_payer" }, "payee": { "$ref": "#/components/schemas/transaction_payee" }, "purchase": { "$ref": "#/components/schemas/transaction_purchase" }, "avs": { "$ref": "#/components/schemas/transaction_avs" } } }, "preview_rule": { "type": "object", "description": "Rule configured in preview mode that would have determined this action's recommendation if all enabled rules were in production. Useful for impact analysis without changing live behavior.\n", "properties": { "rule_name": { "type": "string", "description": "Name of the preview rule." }, "recommendation": { "type": "string", "description": "Recommendation the preview rule would have applied.", "enum": [ "ALLOW", "CHALLENGE", "DENY", "TRUST" ] }, "risk_score": { "type": "number", "description": "Risk score the preview rule would have applied." } } }, "custom_attributes": { "type": "object", "description": "Tenant-defined custom attributes attached to the action. These add context to an action but must match the schema defined in the Admin Portal. Invalid attributes are ignored and not included in the response.\n", "additionalProperties": { "oneOf": [ { "type": "string" }, { "type": "number" }, { "type": "boolean" } ] } } }, "responses": { "success_search_actions": { "description": "Paginated list of actions for the requested window.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/paginated_actions_response" }, "examples": { "with_results": { "summary": "A single denied login returned", "value": { "items": [ { "id": "389794501", "issued_at": 1779610009366, "recommendation": { "type": "DENY", "result": null }, "risk_score": 94.9, "context": { "action_id": "bc87c5a4917788a61dce629f5ecb29c6005857f92dffe4ad221f2a14f5dac9e6", "action_type": "login", "action_performed_at": 1779610009366, "device_timestamp": 1779610009366, "client_id": "9hjXVhAMxIhzuJ5gcEma6", "application_id": "z6mz4DHclxVDL9sxTNBz_", "tenant_id": "511tursnebc5ldzlx7z6r", "device_id": "b8109c57-3bda-4ed4-acdc-ee7c9498a4c6", "device_public_key": "5867c4c8-71b0-4d09-9be1-a393051888b0", "ip": "160.221.187.219", "ip_country": "US", "ip_location_region": "Washington", "ip_location_city": "Seattle", "ip_location_zip": "98108", "ip_asn_id": "AS16509", "ip_asn_name": "Amazon.com, Inc.", "ip_organization_name": "Amazon.com, Inc.", "ip_organization_type": "hosting", "ip_location_timezone": "America/Los_Angeles", "user_agent": "PostmanRuntime/7.53.0" }, "risk_signals": { "device": { "true_useragent": "PostmanRuntime/7.53.0" }, "network": { "hosting": true, "x_forwarded_for": [ "160.221.187.219", "52.23.177.192", "172.70.34.26" ] }, "history": { "device_action_rate_60_sec": 7, "linking_device_to_users_count": 10 } }, "reasons": [ "DEVICE_SPOOFED_BY_USERAGENT", "DEVICE_PROFILE_VELOCITY", "IP_RISKY_REPUTATION", "DEVICE_IMPOSSIBLE_TRAVEL", "DEVICE_NEW" ], "threats": [], "transaction_data": {}, "custom_attributes": {} } ], "count": 1, "skipped": 0 } }, "empty_page": { "summary": "No actions in the requested window", "value": { "items": [], "count": 0, "skipped": 0 } } } } } }, "unauthorized": { "description": "Invalid authentication." }, "forbidden": { "description": "Invalid authorization." }, "rate_limit_reached": { "description": "Rate limit reached. Requests are throttled per tenant at 20 per 60 seconds.\n" }, "internal_error": { "description": "Internal error." }, "bad_request": { "description": "Bad request. Returned when a query parameter fails validation — for example, `take` outside `[1, 400]`, `skip` outside `[0, 10000]`, `start_time`/`end_time` missing or non-numeric, an unknown `sort_field`/`field`/`filter_field`/`filter_operator`, or a malformed `filters` JSON expression.\n" } }, "securitySchemes": { "risk_access_token": { "type": "http", "scheme": "bearer", "description": "An access token generated by the [token endpoint](/openapi/token.openapi/other/getaccesstoken)", "bearerFormat": "JWT" } } } }