Trigger action event

Request

Report a client action event that occurs in an SDK session.

Security

risk_access_token

Query

get_recommendationboolean

A flag for getting the recommendation for the triggered action (for saving another recommendation backend call)

Default:false

Bodyapplication/jsonrequired

One of:

session_tokenstringrequired

A token returned by the SDK for the device session established upon SDK initialization.

action_typestringrequired

The action type

Example:"transaction"

claimed_user_id_typestring

Specifies the type of value provided in the claimed_user_id field. This field is especially important when claimed_user_id contains a hashed value, as it clarifies the original data type used.

Enum:"email""phone_number""account_id""ssn""national_id""passport_number""drivers_license_number""other"

claimed_user_idstring

User identifier of the not yet authenticated user, used to enhance risk and trust assessments. This field should not contain sensitive data in plain text. Once the user has authenticated, to set the user, report the action result via API call or call 'setAuthenticatedUser' from the client SDK. Rejected (400) if provided as "null", "undefined", "none", or empty/whitespace-only; leading/trailing whitespace is otherwise trimmed.

auth_contextobject

Adds authentication context for users who were already authenticated outside the current Fraud Prevention flow before this action was triggered (for example, on another site or through an external identity provider). Providing auth_context sets the user for this action and uses the same user for all subsequent events in the device session, just as reporting a successful login with user_id via Report action result does. The auth_context.user_id takes precedence over both the user already associated with the device session and the deprecated top-level user_id. An empty object ({}) is treated as if auth_context was not provided.

correlation_idstring

Any ID that could help relate the action with external context or session

transaction_dataobject

Transaction data-points given in the relevant action

custom_attributesobject

Custom attributes add context to an action but must match the schema defined in the Portal. Invalid attributes are ignored.

user_idstringdeprecated

*Deprecated – Opaque identifier of the authenticated user in your system. Use claimed_user_id if the user isn't authenticated yet, or auth_context.user_id if the user was already authenticated outside the current Fraud Prevention flow.

curl -i -X POST \
  'https://api.sbx.transmitsecurity.io/risk/v1/action/trigger-action?get_recommendation=false' \
  -H 'Authorization: Bearer <YOUR_JWT_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "session_token": "string",
    "action_type": "transaction",
    "user_id": "string",
    "claimed_user_id_type": "email",
    "claimed_user_id": "string",
    "auth_context": {
      "user_id": "user_8a72c1f0",
      "login_timestamp": 1767225600000,
      "challenge_type": "sms_otp",
      "failed_attempts": 1,
      "auth_method": "password",
      "login_origin": "https://example.com/login"
    },
    "correlation_id": "string",
    "transaction_data": {
      "type": "purchase",
      "method": "card",
      "reason": "Monthly subscription payment",
      "amount": 1500.75,
      "currency": "USD",
      "payer": {
        "name": "John Doe",
        "bankIdentifier": "CHASEUS33",
        "branchIdentifier": "123456",
        "accountNumber": "1234567890123456",
        "accountId": "USER_983245",
        "accountCountryCode": "US",
        "card": {
          "holderName": "John Doe",
          "bin": "411111",
          "last4": "1234"
        },
        "billingInfo": {
          "name": "John Doe",
          "addressLine1": "123 Main St",
          "addressLine2": "Apt 4B",
          "city": "New York",
          "state": "NY",
          "zipPostalCode": "10001",
          "country": "US",
          "email": "john.doe@example.com",
          "phone": "+1234567890"
        },
        "customerTier": "premium"
      },
      "payee": {
        "name": "John Doe",
        "bankIdentifier": "CHASEUS33",
        "branchIdentifier": "123456",
        "accountNumber": "1234567890123456",
        "accountId": "USER_983245",
        "accountCountryCode": "US",
        "card": {
          "holderName": "John Doe",
          "bin": "411111",
          "last4": "1234"
        }
      },
      "channelId": "MOBILE_APP",
      "transactionDate": 1712594340000,
      "purchase": {
        "totalItems": 3,
        "products": [
          {
            "id": "PROD_12345",
            "name": "iPhone 15",
            "amount": 1,
            "price": 999.99
          }
        ],
        "shippingInfo": {
          "name": "John Doe",
          "addressLine1": "123 Main St",
          "addressLine2": "Apt 4B",
          "city": "New York",
          "state": "NY",
          "zipPostalCode": "10001",
          "country": "US",
          "email": "john.doe@example.com",
          "phone": "+1234567890"
        }
      },
      "avs": {
        "code": "Y",
        "provider": "Stripe",
        "matchLevel": "full"
      }
    },
    "custom_attributes": {
      "property1": "string",
      "property2": "string"
    }
  }'

Responses

Trigger action has been received and stored successfully. The response also contains a recommendation, if requested.

Bodyapplication/json

action_tokenstringrequired

recommendationobject

Recommendation

Response

{
  "action_token": "string",
  "recommendation": {
    "id": "385cd06b527a974982e0560b67123fe2b1b5a39fd98d8d32cdbaca8ec16fd62d",
    "issued_at": 1648028118123,
    "recommendation": { … },
    "risk_score": 73.2,
    "context": { … },
    "risk_signals": { … },
    "reasons": [ … ],
    "transaction_data": { … },
    "custom_attributes": { … },
    "threats": [ … ],
    "preview_rule": { … }
  }
}