Skip to content

Client Actions

This backend API is used to report client actions, add the user context and report action results, allowing Fraud Prevention reporting and user profiling.

Download OpenAPI description
client-actions.openapi.json
client-actions.openapi.yaml
Languages
Servers
Sandbox environment
https://api.sbx.transmitsecurity.io/risk/v1/
Production environment (US)
https://api.transmitsecurity.io/risk/v1/
Production environment (EU)
https://api.eu.transmitsecurity.io/risk/v1/
Production environment (CA)
https://api.ca.transmitsecurity.io/risk/v1/
Production environment (AU)
https://api.au.transmitsecurity.io/risk/v1/

Trigger action event

Request

Report a client action event that occurs in an SDK session

Security
risk_access_token
Query
get_recommendationboolean

A flag for getting the recommendation for the triggered action (for saving another recommendation backend call)

Default false
Bodyapplication/jsonrequired
session_tokenstringrequired

A token returned by the SDK for the device session established upon SDK initialization.

action_typestringrequired

The action type

Example: "transaction"
user_idstring

Opaque identifier of the authenticated user in your system.

claimed_user_id_typestring

Specifies the type of value provided in the claimed_user_id field. This field is especially important when claimed_user_id contains a hashed value, as it clarifies the original data type used.

Enum"email""phone_number""account_id""ssn""national_id""passport_number""drivers_license_number""other"
claimed_user_idstring

User identifier of the not yet authenticated user, used to enhance risk and trust assessments. This field should not contain sensitive data in plain text. Once the user has authenticated, to set the user, report the action result via API call or call 'setAuthenticatedUser' from the client SDK.

correlation_idstring

Any ID that could help relate the action with external context or session

transaction_dataobject

Transaction data-points given in the relevant action

custom_attributesobject

Custom attributes add context to an action but must match the schema defined in the Portal. Invalid attributes are ignored.

curl -i -X POST \
  'https://api.sbx.transmitsecurity.io/risk/v1/action/trigger-action?get_recommendation=false' \
  -H 'Authorization: Bearer <YOUR_JWT_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "session_token": "string",
    "action_type": "transaction",
    "user_id": "string",
    "claimed_user_id_type": "email",
    "claimed_user_id": "string",
    "correlation_id": "string",
    "transaction_data": {
      "amount": 999999999.99,
      "currency": "USD",
      "reason": "string",
      "transactionDate": 0,
      "payer": {
        "name": "string",
        "bankIdentifier": "string",
        "branchIdentifier": "string",
        "accountNumber": "string"
      },
      "payee": {
        "name": "string",
        "bankIdentifier": "string",
        "branchIdentifier": "string",
        "accountNumber": "string"
      }
    },
    "custom_attributes": {
      "property1": "string",
      "property2": "string"
    }
  }'

Responses

Trigger action has been received and stored successfully. The response also contains a recommendation, if requested.

Bodyapplication/json
action_tokenstringrequired
recommendationobject
Response
application/json
{
  "action_token": "string",
  "recommendation": {
    "id": "385cd06b527a974982e0560b67123fe2b1b5a39fd98d8d32cdbaca8ec16fd62d",
    "issued_at": 1648028118123,
    "recommendation": { … },
    "risk_score": 73.2,
    "context": { … },
    "risk_signals": { … },
    "reasons": [ … ],
    "transaction_data": { … },
    "threats": [ … ],
    "preview_rule": { … }
  }
}

Report action result

Request

Reports the result of an action that a recommendation was issued for. This includes whether the user successfully completed the action, and what type of challenge was given to the user (if any).

Security
risk_access_token
Bodyapplication/jsonrequired
action_tokenstringrequired

The token return when the action event was reported

resultstringrequired

The action result.

Enum"success""failure""incomplete"
user_idstring

Opaque identifier of the user in your system.

private_user_identifierstring

Identifier containing sensitive user data. Mosaic will encrypt and securely store this data.

challenge_typestring

Type of challenge used, in case a challenge was recommended for this action event

Enum"sms_otp""email_otp""totp""push_otp""voice_otp""idv""captcha""password""passkey"
curl -i -X POST \
  https://api.sbx.transmitsecurity.io/risk/v1/action/result \
  -H 'Authorization: Bearer <YOUR_JWT_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "action_token": "string",
    "result": "success",
    "user_id": "string",
    "private_user_identifier": "string",
    "challenge_type": "sms_otp"
  }'

Responses

Action result has been received and stored successfully.

Assign actions

Request

Set assignee for a list of actions.

Security
risk_access_token
Bodyapplication/jsonrequired
action_idsArray of strings
Example: ["ea49707f023f48d64a7a817a2e7a5ff4277281a8f8ac1848ccac407967d9d2ce"]
assigneestring

The email of the user to assign the actions to.

curl -i -X PUT \
  https://api.sbx.transmitsecurity.io/risk/v1/action/assignee \
  -H 'Authorization: Bearer <YOUR_JWT_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "action_ids": [
      "ea49707f023f48d64a7a817a2e7a5ff4277281a8f8ac1848ccac407967d9d2ce"
    ],
    "assignee": "string"
  }'

Responses

Assignee was updated for all requested actions.

Bodyapplication/json
successboolean

Defines if the operation was successful.

affectedActionsCountnumber

The number of assigned actions.

Example: 4
Response
application/json
{
  "success": true,
  "affectedActionsCount": 4
}

Set authenticated userDeprecated

Request

Sets the user context for a client action reported to the SDK. It should be set only after you've fully authenticated the user (including, for example, any 2FA that was required). This call is deprecated, set the user with Report action result API.

Security
risk_access_token
Bodyapplication/jsonrequired
user_idstringrequired

Opaque identifier of the user in your system.

action_tokenstringrequired

The token return by the SDK when the action was reported.

curl -i -X POST \
  https://api.sbx.transmitsecurity.io/risk/v1/action/authenticated-user \
  -H 'Authorization: Bearer <YOUR_JWT_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "user_id": "string",
    "action_token": "string"
  }'

Responses

User Auth has been received and stored successfully.