# Set authenticated user (deprecated)

Sets the user context for a client action reported to the SDK. It should be set only after you've fully authenticated the user (including, for example, any 2FA that was required). This call is **deprecated**, set the user with [Report action result API](/openapi/risk/client-actions.openapi/other/reportactionresult).

Endpoint: POST /action/authenticated-user
Security: risk_access_token

## Security:

  - `risk_access_token` (unknown)
    http bearer JWT

## Request fields (application/json):

  - `user_id` (string, required)
    Opaque identifier of the user in your system.

  - `action_token` (string, required)
    The token return by the SDK when the action was reported.

## Response 201:

  - `201` (unknown)
    User Auth has been received and stored successfully.

## Response 400:

  - `400` (unknown)
    Bad request

## Response 401:

  - `401` (unknown)
    Invalid authentication

## Response 403:

  - `403` (unknown)
    Invalid authorization

## Response 429:

  - `429` (unknown)
    Rate limit reached

## Response 463:

  - `463` (unknown)
    Blacklisted token—Returned when Fraud Prevention detects repeated or abusive token/payload misuse within a short time window (e.g., reuse of expired tokens, token caching/automation, or repeated invalid requests, including highly repetitive invalid request values). The response body contains the underlying error code (e.g., expired session token). Clients should identify and stop the source of invalid requests. Other authorization failures that do not trigger blacklisting return 403 Forbidden.

## Response 500:

  - `500` (unknown)
    Internal error