# Trigger action event

Report a client action event that occurs in an SDK session

Endpoint: POST /action/trigger-action
Security: risk_access_token

## Query parameters:

  - `get_recommendation` (boolean)
    A flag for getting the recommendation for the triggered action (for saving another recommendation backend call)

## Request fields (application/json):

  - `body` (object, required) — one of:
    - Using regular session token:
      - `session_token` (string, required)
        A token returned by the SDK for the device session established upon SDK initialization.
      - `action_type` (string, required)
        The action type
        Example: "transaction"
      - `claimed_user_id_type` (string)
        Specifies the type of value provided in the claimed_user_id field. This field is especially important when claimed_user_id contains a hashed value, as it clarifies the original data type used.
        Enum: "email", "phone_number", "account_id", "ssn", "national_id", "passport_number", "drivers_license_number", "other"
      - `claimed_user_id` (string)
        User identifier of the not yet authenticated user, used to enhance risk and trust assessments. This field should not contain sensitive data in plain text. Once the user has authenticated, to set the user, report the action result via API call or call 'setAuthenticatedUser' from the client SDK.
      - `correlation_id` (string)
        Any ID that could help relate the action with external context or session
      - `transaction_data` (object)
        Transaction data-points given in the relevant action
      - `transaction_data.type` (string)
        Type of transaction
        Enum: "purchase", "bill_payment", "mobile_recharge", "money_transfer", "credit_transfer", "credit_redemption", "top_up", "withdrawal", "investment", "loan", "refund", "other"
      - `transaction_data.method` (string)
        Method used for the transaction
        Enum: "bank_account", "wire", "card", "p2p", "wallet"
      - `transaction_data.reason` (string)
        The reason for the transaction
        Example: "Monthly subscription payment"
      - `transaction_data.amount` (number)
        The monetary amount of the transaction. The backend sanitizes this value with parseFloat; it must be strictly positive and ≤ 999,999,999.99
        Example: 1500.75
      - `transaction_data.currency` (string)
        The transaction currency (ISO-4217)
        Example: "USD"
      - `transaction_data.payer` (object)
        The provided data points for the transaction payer
      - `transaction_data.payer.name` (string)
        Payer/Payee name
        Example: "John Doe"
      - `transaction_data.payer.bankIdentifier` (string)
        Bank identifier
        Example: "CHASEUS33"
      - `transaction_data.payer.branchIdentifier` (string)
        Branch identifier
        Example: "123456"
      - `transaction_data.payer.accountNumber` (string)
        Account number
        Example: "1234567890123456"
      - `transaction_data.payer.accountId` (string)
        Unique identifier for the account
        Example: "USER_983245"
      - `transaction_data.payer.accountCountryCode` (string)
        Country code of the account (ISO-3166-1 alpha-2)
        Example: "US"
      - `transaction_data.payer.card` (object)
        Credit card details if applicable
      - `transaction_data.payer.card.holderName` (string)
        Name of the card holder
        Example: "John Doe"
      - `transaction_data.payer.card.bin` (string)
        Bank Identification Number (first 6 digits of card)
        Example: "411111"
      - `transaction_data.payer.card.last4` (string)
        Last 4 digits of the credit card number
        Example: "1234"
      - `transaction_data.payer.billingInfo` (object)
        Billing address details
      - `transaction_data.payer.billingInfo.name` (string)
        Full name
        Example: "John Doe"
      - `transaction_data.payer.billingInfo.addressLine1` (string)
        Address line 1
        Example: "123 Main St"
      - `transaction_data.payer.billingInfo.addressLine2` (string)
        Address line 2
        Example: "Apt 4B"
      - `transaction_data.payer.billingInfo.city` (string)
        City
        Example: "New York"
      - `transaction_data.payer.billingInfo.state` (string)
        State/Province/Region
        Example: "NY"
      - `transaction_data.payer.billingInfo.zipPostalCode` (string)
        ZIP or postal code
        Example: "10001"
      - `transaction_data.payer.billingInfo.country` (string)
        Country code (ISO-3166-1 alpha-2)
        Example: "US"
      - `transaction_data.payer.billingInfo.email` (string)
        Email address
        Example: "john.doe@example.com"
      - `transaction_data.payer.billingInfo.phone` (string)
        Phone number
        Example: "+1234567890"
      - `transaction_data.payer.customerTier` (string)
        Customer tier
        Example: "premium"
      - `transaction_data.payee` (object)
        The provided data points for the transaction payee
      - `transaction_data.payee.name` (string)
        Payer/Payee name
        Example: "John Doe"
      - `transaction_data.payee.bankIdentifier` (string)
        Bank identifier
        Example: "CHASEUS33"
      - `transaction_data.payee.branchIdentifier` (string)
        Branch identifier
        Example: "123456"
      - `transaction_data.payee.accountNumber` (string)
        Account number
        Example: "1234567890123456"
      - `transaction_data.payee.accountId` (string)
        Unique identifier for the account
        Example: "USER_983245"
      - `transaction_data.payee.accountCountryCode` (string)
        Country code of the account (ISO-3166-1 alpha-2)
        Example: "US"
      - `transaction_data.payee.card` (object)
        Credit card details if applicable
      - `transaction_data.payee.card.holderName` (string)
        Name of the card holder
        Example: "John Doe"
      - `transaction_data.payee.card.bin` (string)
        Bank Identification Number (first 6 digits of card)
        Example: "411111"
      - `transaction_data.payee.card.last4` (string)
        Last 4 digits of the credit card number
        Example: "1234"
      - `transaction_data.channelId` (string)
        Identifier for the channel used for the transaction
        Example: "MOBILE_APP"
      - `transaction_data.transactionDate` (number)
        The transaction timestamp (Unix epoch in milliseconds or seconds). Must be a non-negative integer.
        Example: 1712594340000
      - `transaction_data.purchase` (object)
        Details about the purchase, if applicable
      - `transaction_data.purchase.totalItems` (number)
        Total number of items in the purchase
        Example: 3
      - `transaction_data.purchase.products` (array)
        List of products in the purchase
      - `transaction_data.purchase.products.id` (string)
        Unique identifier for the product
        Example: "PROD_12345"
      - `transaction_data.purchase.products.name` (string)
        Name of the product
        Example: "iPhone 15"
      - `transaction_data.purchase.products.amount` (number)
        Amount of the product
        Example: 1
      - `transaction_data.purchase.products.price` (number)
        Price of the product
        Example: 999.99
      - `transaction_data.purchase.shippingInfo` (object)
        Shipping address details
      - `transaction_data.purchase.shippingInfo.name` (string)
        Full name
        Example: "John Doe"
      - `transaction_data.purchase.shippingInfo.addressLine1` (string)
        Address line 1
        Example: "123 Main St"
      - `transaction_data.purchase.shippingInfo.addressLine2` (string)
        Address line 2
        Example: "Apt 4B"
      - `transaction_data.purchase.shippingInfo.city` (string)
        City
        Example: "New York"
      - `transaction_data.purchase.shippingInfo.state` (string)
        State/Province/Region
        Example: "NY"
      - `transaction_data.purchase.shippingInfo.zipPostalCode` (string)
        ZIP or postal code
        Example: "10001"
      - `transaction_data.purchase.shippingInfo.country` (string)
        Country code (ISO-3166-1 alpha-2)
        Example: "US"
      - `transaction_data.purchase.shippingInfo.email` (string)
        Email address
        Example: "john.doe@example.com"
      - `transaction_data.purchase.shippingInfo.phone` (string)
        Phone number
        Example: "+1234567890"
      - `transaction_data.avs` (object)
        Address Verification System (AVS) results
      - `transaction_data.avs.code` (string)
        AVS response code
        Example: "Y"
      - `transaction_data.avs.provider` (string)
        AVS provider name
        Example: "Stripe"
      - `transaction_data.avs.matchLevel` (string)
        AVS match level
        Enum: "none", "postal", "street", "full", "unknown"
      - `custom_attributes` (object)
        Custom attributes add context to an action but must match the schema defined in the Portal. Invalid attributes are ignored.
      - `user_id` (string)
        Opaque identifier of the authenticated user in your system.
    - Using secure session token:
      - `secured_session_token` (string, required)
        A cryptographically signed token returned by the SDK's getSecureSessionToken() method. Provides enhanced security through device binding and anti-replay protection. Recommended for high-risk actions. Make sure to use the secure session token that matches the action type. Otherwise, the request will fail with 403 "Action type mismatch" error.
      - `action_type` (string, required)
        The action type
        Example: "transaction"
      - `claimed_user_id_type` (string)
        Specifies the type of value provided in the claimed_user_id field. This field is especially important when claimed_user_id contains a hashed value, as it clarifies the original data type used.
        Enum: same as `claimed_user_id_type` in "Using regular session token" (8 values)
      - `claimed_user_id` (string)
        User identifier of the not yet authenticated user, used to enhance risk and trust assessments. This field should not contain sensitive data in plain text. Once the user has authenticated, to set the user, report the action result via API call or call 'setAuthenticatedUser' from the client SDK.
      - `correlation_id` (string)
        Any ID that could help relate the action with external context or session
      - `transaction_data` (object)
        Transaction data-points given in the relevant action
      - `transaction_data.type` (string)
        Type of transaction
        Enum: same as `transaction_data.type` in "Using regular session token" (12 values)
      - `transaction_data.method` (string)
        Method used for the transaction
        Enum: same as `transaction_data.method` in "Using regular session token" (5 values)
      - `transaction_data.reason` (string)
        The reason for the transaction
        Example: "Monthly subscription payment"
      - `transaction_data.amount` (number)
        The monetary amount of the transaction. The backend sanitizes this value with parseFloat; it must be strictly positive and ≤ 999,999,999.99
        Example: 1500.75
      - `transaction_data.currency` (string)
        The transaction currency (ISO-4217)
        Example: "USD"
      - `transaction_data.payer` (object)
        The provided data points for the transaction payer
      - `transaction_data.payer.name` (string)
        Payer/Payee name
        Example: "John Doe"
      - `transaction_data.payer.bankIdentifier` (string)
        Bank identifier
        Example: "CHASEUS33"
      - `transaction_data.payer.branchIdentifier` (string)
        Branch identifier
        Example: "123456"
      - `transaction_data.payer.accountNumber` (string)
        Account number
        Example: "1234567890123456"
      - `transaction_data.payer.accountId` (string)
        Unique identifier for the account
        Example: "USER_983245"
      - `transaction_data.payer.accountCountryCode` (string)
        Country code of the account (ISO-3166-1 alpha-2)
        Example: "US"
      - `transaction_data.payer.card` (object)
        Credit card details if applicable
      - `transaction_data.payer.card.holderName` (string)
        Name of the card holder
        Example: "John Doe"
      - `transaction_data.payer.card.bin` (string)
        Bank Identification Number (first 6 digits of card)
        Example: "411111"
      - `transaction_data.payer.card.last4` (string)
        Last 4 digits of the credit card number
        Example: "1234"
      - `transaction_data.payer.billingInfo` (object)
        Billing address details
      - `transaction_data.payer.billingInfo.name` (string)
        Full name
        Example: "John Doe"
      - `transaction_data.payer.billingInfo.addressLine1` (string)
        Address line 1
        Example: "123 Main St"
      - `transaction_data.payer.billingInfo.addressLine2` (string)
        Address line 2
        Example: "Apt 4B"
      - `transaction_data.payer.billingInfo.city` (string)
        City
        Example: "New York"
      - `transaction_data.payer.billingInfo.state` (string)
        State/Province/Region
        Example: "NY"
      - `transaction_data.payer.billingInfo.zipPostalCode` (string)
        ZIP or postal code
        Example: "10001"
      - `transaction_data.payer.billingInfo.country` (string)
        Country code (ISO-3166-1 alpha-2)
        Example: "US"
      - `transaction_data.payer.billingInfo.email` (string)
        Email address
        Example: "john.doe@example.com"
      - `transaction_data.payer.billingInfo.phone` (string)
        Phone number
        Example: "+1234567890"
      - `transaction_data.payer.customerTier` (string)
        Customer tier
        Example: "premium"
      - `transaction_data.payee` (object)
        The provided data points for the transaction payee
      - `transaction_data.payee.name` (string)
        Payer/Payee name
        Example: "John Doe"
      - `transaction_data.payee.bankIdentifier` (string)
        Bank identifier
        Example: "CHASEUS33"
      - `transaction_data.payee.branchIdentifier` (string)
        Branch identifier
        Example: "123456"
      - `transaction_data.payee.accountNumber` (string)
        Account number
        Example: "1234567890123456"
      - `transaction_data.payee.accountId` (string)
        Unique identifier for the account
        Example: "USER_983245"
      - `transaction_data.payee.accountCountryCode` (string)
        Country code of the account (ISO-3166-1 alpha-2)
        Example: "US"
      - `transaction_data.payee.card` (object)
        Credit card details if applicable
      - `transaction_data.payee.card.holderName` (string)
        Name of the card holder
        Example: "John Doe"
      - `transaction_data.payee.card.bin` (string)
        Bank Identification Number (first 6 digits of card)
        Example: "411111"
      - `transaction_data.payee.card.last4` (string)
        Last 4 digits of the credit card number
        Example: "1234"
      - `transaction_data.channelId` (string)
        Identifier for the channel used for the transaction
        Example: "MOBILE_APP"
      - `transaction_data.transactionDate` (number)
        The transaction timestamp (Unix epoch in milliseconds or seconds). Must be a non-negative integer.
        Example: 1712594340000
      - `transaction_data.purchase` (object)
        Details about the purchase, if applicable
      - `transaction_data.purchase.totalItems` (number)
        Total number of items in the purchase
        Example: 3
      - `transaction_data.purchase.products` (array)
        List of products in the purchase
      - `transaction_data.purchase.products.id` (string)
        Unique identifier for the product
        Example: "PROD_12345"
      - `transaction_data.purchase.products.name` (string)
        Name of the product
        Example: "iPhone 15"
      - `transaction_data.purchase.products.amount` (number)
        Amount of the product
        Example: 1
      - `transaction_data.purchase.products.price` (number)
        Price of the product
        Example: 999.99
      - `transaction_data.purchase.shippingInfo` (object)
        Shipping address details
      - `transaction_data.purchase.shippingInfo.name` (string)
        Full name
        Example: "John Doe"
      - `transaction_data.purchase.shippingInfo.addressLine1` (string)
        Address line 1
        Example: "123 Main St"
      - `transaction_data.purchase.shippingInfo.addressLine2` (string)
        Address line 2
        Example: "Apt 4B"
      - `transaction_data.purchase.shippingInfo.city` (string)
        City
        Example: "New York"
      - `transaction_data.purchase.shippingInfo.state` (string)
        State/Province/Region
        Example: "NY"
      - `transaction_data.purchase.shippingInfo.zipPostalCode` (string)
        ZIP or postal code
        Example: "10001"
      - `transaction_data.purchase.shippingInfo.country` (string)
        Country code (ISO-3166-1 alpha-2)
        Example: "US"
      - `transaction_data.purchase.shippingInfo.email` (string)
        Email address
        Example: "john.doe@example.com"
      - `transaction_data.purchase.shippingInfo.phone` (string)
        Phone number
        Example: "+1234567890"
      - `transaction_data.avs` (object)
        Address Verification System (AVS) results
      - `transaction_data.avs.code` (string)
        AVS response code
        Example: "Y"
      - `transaction_data.avs.provider` (string)
        AVS provider name
        Example: "Stripe"
      - `transaction_data.avs.matchLevel` (string)
        AVS match level
        Enum: same as `transaction_data.avs.matchLevel` in "Using regular session token" (5 values)
      - `custom_attributes` (object)
        Custom attributes add context to an action but must match the schema defined in the Portal. Invalid attributes are ignored.
      - `user_id` (string)
        Opaque identifier of the authenticated user in your system.

## Response 201 fields (application/json):

  - `action_token` (string, required)

  - `recommendation` (object)
    Recommendation

  - `recommendation.id` (string, required)
    Recommendation identifier
    Example: "385cd06b527a974982e0560b67123fe2b1b5a39fd98d8d32cdbaca8ec16fd62d"

  - `recommendation.issued_at` (number, required)
    Unix epoch time in milliseconds this recommendation was issued at
    Example: 1648028118123

  - `recommendation.recommendation` (object, required)
    Decision the engine produced for the action.

  - `recommendation.recommendation.type` (string, required)
    Recommendation type.
    Enum: "ALLOW", "CHALLENGE", "DENY", "TRUST"

  - `recommendation.recommendation.result` (string,null)
    The outcome of the action.
    Enum: "success", "failure", "incomplete"

  - `recommendation.recommendation.challenge_type` (string)
    The type of challenge enforced for the reported action.
    Enum: "sms_otp", "email_otp", "totp", "push_otp", "voice_otp", "idv", "captcha", "invisible_captcha", "password", "passkey"

  - `recommendation.risk_score` (number, required)
    Used to assess the risk level of the action.

  - `recommendation.context` (object, required)
    Identifies the context in which the action occurred.

  - `recommendation.context.action_id` (string, required)
    Identifier of the client action.
    Example: "885cd06b527a97498200560b67123fe221b5a39fd98d8d22cdb7ca8ec16ed62d"

  - `recommendation.context.action_type` (string, required)
    Type of client action this recommendation was issued for.

  - `recommendation.context.action_performed_at` (integer, required)
    Unix epoch time in milliseconds the action event was reported.
    Example: 1648028118123

  - `recommendation.context.device_timestamp` (integer)
    Unix epoch timestamp (ms) from the device clock when the action is triggered via triggerActionEvent(). For backend-triggered actions, uses the server time. Used to correlate client and server events.
    Example: 1648028107819

  - `recommendation.context.client_id` (string)
    Identifies the client associated with the action.
    Example: "d152ddd.ece93f4.c2a3d12.riskid.security"

  - `recommendation.context.application_id` (string, required)
    Identifies the application associated with the action.
    Example: "ece93f4"

  - `recommendation.context.tenant_id` (string)
    Identifies your tenant within Transmit.
    Example: "c2a3d12"

  - `recommendation.context.device_id` (string, required)
    Unique device identifier generated by Transmit Security and stored by the SDK. On web, stored in the cookie. On mobile, uses platform-provided identifiers such as Android ID (hex string) or iOS identifierForVendor (alphanumeric). Not derived from IMEI or other hardware identifiers.
    Example: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIwZGE4ZmZjYy01NmE1LTRmMjgtYThkZi04NDY5MmYwYThmYTAiLCJ2ZXJzaW9uIjoxLCJpYXQiOjE2NTU3OTYzODQ1MzF9.TeGoqlCe_6eWzl9a3-vAumG4Xap8WjwsgcO2-DzGtLg"

  - `recommendation.context.correlation_id` (string)
    Any ID that could help relate the action with external context or session (if set via triggerActionEvent() SDK calls).
    Example: "bcb934d8-89cb-433b-a4c7-b7d94299586b"

  - `recommendation.context.device_fingerprint` (string, required)
    Hash value on all the device data collected from the browser.
    Example: "a3c8f5ea75cb65fcdc3d0452b985f957a46e24afdc912e93dac1e115ecf408e5"

  - `recommendation.context.device_public_key` (string)
    A unique and persistent identifier derived from cryptographic binding.
    Example: "625ad815e47a1a05318c98185ff8cfb35fd706d836a1ad7459842f381929a8e3"

  - `recommendation.context.user_id` (string)
    Opaque identifier of the user in your system (if set via setAuthenticatedUser() or init() SDK calls).
    Example: "5c4afa75c"

  - `recommendation.context.claimed_user_id` (string)
    User ID of the not-yet-authenticated user, used to enhance risk and trust assessments. Once the user is authenticated, setAuthenticatedUser() should be called.
    Example: "5c4afa75c"

  - `recommendation.context.location` (string)
    The place in the application in which the action was performed (such as the page URL).
    Example: "https://www.amazingapp.com/shops?target=1"

  - `recommendation.context.ip` (string)
    IP address.
    Example: "160.221.187.219"

  - `recommendation.context.ip_country` (string)
    Country code, specified in a two-letter format (ISO 3166-1 alpha-2).
    Example: "US"

  - `recommendation.context.ip_location_region` (string)
    Location region identified by IP address.
    Example: "California"

  - `recommendation.context.ip_domain` (string)
    Domain name resolved from IP address.
    Example: "example.com"

  - `recommendation.context.ip_location_city` (string)
    Location city identified by IP address.
    Example: "Los Angeles"

  - `recommendation.context.ip_location_zip` (string)
    Location ZIP code identified by IP address.
    Example: "92131"

  - `recommendation.context.ip_location_longitude` (string)
    Geolocation longitude identified by IP address.
    Example: "-117.0903"

  - `recommendation.context.ip_location_latitude` (string)
    Geolocation latitude identified by IP address.
    Example: "32.9167"

  - `recommendation.context.ip_asn_id` (string)
    Globally unique identifier that defines a group of one or more IP prefixes.
    Example: "AS174"

  - `recommendation.context.ip_asn_name` (string)
    ASN name of the IP address.
    Example: "AS174 Cogent Communications"

  - `recommendation.context.ip_organization_name` (string)
    IP organization name.
    Example: "Cogent Communications"

  - `recommendation.context.ip_organization_type` (string)
    Type of IP connection (for example, isp, hosting, business).
    Example: "isp"

  - `recommendation.context.ip_location_timezone` (string)
    Timezone location identified by IP address.
    Example: "America/Los_Angeles"

  - `recommendation.context.device_timezone` (string)
    Timezone on device.
    Example: "America/Los_Angeles"

  - `recommendation.context.device_languages` (array)
    Languages on device.
    Example: ["en-US","en"]

  - `recommendation.context.device_platform` (string)
    Type of device platform.
    Example: "desktop"

  - `recommendation.context.os_name` (string)
    Name of the operating system.
    Example: "macOS"

  - `recommendation.context.os_version` (string)
    Operating system version.
    Example: "14.1.0"

  - `recommendation.context.browser_name` (string)
    Name of the browser.
    Example: "Chrome"

  - `recommendation.context.browser_version` (string)
    Browser major version.
    Example: "113"

  - `recommendation.context.user_agent` (string)
    User agent string.
    Example: "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36"

  - `recommendation.risk_signals` (object)
    Additional informative signals derived from the action.

  - `recommendation.risk_signals.device` (object)
    Device-relevant signals.

  - `recommendation.risk_signals.device.ram` (number)
    Device memory, a floating-point number.

  - `recommendation.risk_signals.device.total_storage` (number)
    Device total storage, as received from the mobile native platform.

  - `recommendation.risk_signals.device.available_storage` (number)
    Device available storage, as received from the mobile native platform.

  - `recommendation.risk_signals.device.battery_level` (number)
    Device battery level, a floating-point number.

  - `recommendation.risk_signals.device.device_power_state` (string)
    Indicates if the device is currently plugged into a power source.

  - `recommendation.risk_signals.device.core_number` (number)
    Device core number.

  - `recommendation.risk_signals.device.graphic_card` (string)
    Device graphics card, as received from the web platform.

  - `recommendation.risk_signals.device.model` (string)
    Device model.

  - `recommendation.risk_signals.device.screen_width` (number)
    Device screen width in pixels.

  - `recommendation.risk_signals.device.screen_height` (number)
    Device screen height in pixels.

  - `recommendation.risk_signals.device.screen_pixel_depth` (number)
    Pixel depth of the device screen.

  - `recommendation.risk_signals.device.screen_color_depth` (number)
    Color depth of the device screen.

  - `recommendation.risk_signals.device.screen_avail_width` (number)
    Available width of the screen.

  - `recommendation.risk_signals.device.screen_avail_height` (number)
    Available height of the screen.

  - `recommendation.risk_signals.device.incognito` (boolean)
    Whether the event was performed using incognito browsing.

  - `recommendation.risk_signals.device.tampered` (boolean)
    Whether the device is tampered (root or jailbreak).

  - `recommendation.risk_signals.device.emulated` (boolean)
    Whether the device is emulated.

  - `recommendation.risk_signals.device.spoofed` (boolean)
    Whether the device is spoofed.

  - `recommendation.risk_signals.device.tz_mismatch` (boolean)
    Whether the event was performed on a device with a timezone mismatching expected.

  - `recommendation.risk_signals.device.esim_usage` (boolean)
    Whether the event was performed using eSIM.

  - `recommendation.risk_signals.device.accept_languages` (string)
    Value of the accept-language header at the action request.

  - `recommendation.risk_signals.device.mobile_network_code` (string)
    String representation of the device's mobile carrier MCC and MNC.

  - `recommendation.risk_signals.device.font_count` (number)
    Number of fonts available on the device.

  - `recommendation.risk_signals.device.cpu_arch` (string)
    Device CPU architecture.

  - `recommendation.risk_signals.device.navigator_useragent` (string)
    User agent string from the device's browser navigator.

  - `recommendation.risk_signals.device.true_useragent` (string)
    User agent string reconstructed by the SDK, providing details about the browser, OS, and device.

  - `recommendation.risk_signals.device.device_timezone_offset` (number)
    Timezone offset of the device, in minutes from UTC.

  - `recommendation.risk_signals.device.summer_timezone_offset` (number)
    Device's timezone offset in minutes from UTC during daylight saving time.

  - `recommendation.risk_signals.device.winter_timezone_offset` (number)
    Device's timezone offset in minutes from UTC during standard time.

  - `recommendation.risk_signals.device.device_name` (string)
    Device's name as recorded on iOS, reflecting the user-set name.

  - `recommendation.risk_signals.network` (object)
    Network-relevant signals.

  - `recommendation.risk_signals.network.vpn` (boolean)
    Whether the event was performed using a VPN connection.

  - `recommendation.risk_signals.network.tor` (boolean)
    Whether the event was performed using a Tor connection.

  - `recommendation.risk_signals.network.hosting` (boolean)
    Whether the event was performed from a hosting provider.

  - `recommendation.risk_signals.network.proxy` (boolean)
    Whether the event was performed via a proxy.

  - `recommendation.risk_signals.network.anonymizer` (boolean)
    Whether the event was performed via an anonymizer.

  - `recommendation.risk_signals.network.x_forwarded_for` (array)
    The X-Forwarded-For header value, indicating the chain of intermediate proxies.
    Example: ["160.221.187.219","52.23.177.192","172.70.34.26"]

  - `recommendation.risk_signals.behavior` (object)
    User-behavior-relevant signals.

  - `recommendation.risk_signals.behavior.typing_velocity` (number)
    Percentile of user typing speed.
    Example: 0.867

  - `recommendation.risk_signals.behavior.movement_velocity` (number)
    Number of input events per second.
    Example: 10

  - `recommendation.risk_signals.behavior.input_method` (array)
    A list of used input methods.

| Value | Description | Platform |
|---|---|---|
| is_typing | Standard character-by-character keyboard text entry. | Web, Mobile |
| is_paste | Content inserted via paste (e.g. Ctrl/Cmd+V or context-menu paste). | Web, Mobile |
| is_autocomplete | Value entered via an OS/keyboard autocomplete or autofill suggestion. | Mobile |
| is_password_manager | Value populated by a password manager / browser autofill. | Web |
| is_insert_replacement_text | Existing text replaced with a suggested value (e.g. spell-check/autocorrect or autofill replacement). | Web |
| is_insert_composition | Text inserted from an in-progress IME composition (e.g. while composing CJK characters). | Web |
| is_insert_from_composition | Text committed (finalized) from an IME composition. | Web |
| is_insert_line_break | A line break was inserted (e.g. Shift+Enter). | Web |
| is_insert_from_drop | Text inserted by dragging and dropping content into the field. | Web |
| is_delete | A deletion occurred (generic). | Mobile |
| is_delete_content_backward | Deletion of the character before the cursor (Backspace). | Web |
| is_delete_content_forward | Deletion of the character after the cursor (Delete key). | Web |
| is_delete_content | Generic content deletion where direction is unspecified. | Web |
| is_delete_word_backward | Deletion of the word before the cursor (e.g. Ctrl/Alt+Backspace). | Web |
| is_delete_softline_backward | Deletion to the start of the current soft-wrapped line. | Web |
| is_delete_hardline_backward | Deletion to the start of the current line/block (hard line boundary). | Web |
| is_delete_by_cut | Content removed via Cut (e.g. Ctrl/Cmd+X). | Web |
| is_delete_by_drag | Content removed by dragging it out of the field. | Web |
| is_delete_composition_text | Deletion of in-progress IME composition text. | Web |
| is_history_undo | An undo action (e.g. Ctrl/Cmd+Z). | Web |
| is_history_redo | A redo action (e.g. Ctrl/Cmd+Y or Shift+Ctrl/Cmd+Z). | Web |
    Example: ["is_typing","is_paste"]

  - `recommendation.risk_signals.behavior.no_user_interaction` (boolean)
    Whether there was any user interaction before clicks.

  - `recommendation.risk_signals.behavior.straight_line_ratio` (number)
    Ratio of straight-line movements out of all movements in the action's context.

  - `recommendation.risk_signals.behavior.right_angels_ratio` (number)
    Ratio of right-angle movements out of all movements in the action's context.

  - `recommendation.risk_signals.behavior.minor_angels_ratio` (number)
    Ratio of minor-angle movements out of all movements in the action's context.

  - `recommendation.risk_signals.behavior.movement_latency` (number)
    Median delay of mouse or touchscreen movements (ms) within the action's context.

  - `recommendation.risk_signals.behavior.corner_click` (boolean)
    Whether there were multiple clicks on the corner of a button in the action's context.

  - `recommendation.risk_signals.history` (object)
    User-history-relevant signals.

  - `recommendation.risk_signals.history.ip_action_rate_60_sec` (integer)
    Number of actions originating from the same client IP within 60 seconds prior to this action.
    Example: 7

  - `recommendation.risk_signals.history.user_action_rate_60_sec` (integer)
    Number of actions with the same user_id within 60 seconds prior to this action.

  - `recommendation.risk_signals.history.device_action_rate_60_sec` (integer)
    Number of actions originating from the same device_id within 60 seconds prior to this action.

  - `recommendation.risk_signals.history.ip_user_count_last_hour` (integer)
    Number of distinct user_ids associated with the IP address within the previous hour.

  - `recommendation.risk_signals.history.ip_device_count_last_hour` (integer)
    Number of distinct device_ids associated with the IP address within the previous hour.

  - `recommendation.risk_signals.history.linking_device_to_users_count` (integer)
    Number of distinct user_ids associated with this device_id.

  - `recommendation.risk_signals.history.linking_user_to_device_count` (integer)
    Number of distinct device_ids associated with this user_id.

  - `recommendation.reasons` (array, required)
    Reasons that contributed to the recommendation.

  - `recommendation.transaction_data` (object)
    Transaction data-points provided with the action via the SDK.

  - `recommendation.transaction_data.amount` (number)
    Monetary amount of the transaction. Sanitized server-side with parseFloat; must be strictly positive and at most 999,999,999.99.
    Example: 1500.75

  - `recommendation.transaction_data.currency` (string)
    Currency code for the transaction (ISO-4217).
    Example: "USD"

  - `recommendation.transaction_data.type` (string)
    Transaction type.
    Enum: same as `transaction_data.type` in "Using regular session token" (12 values)

  - `recommendation.transaction_data.method` (string)
    Transaction method.
    Enum: same as `transaction_data.method` in "Using regular session token" (5 values)

  - `recommendation.transaction_data.channelId` (string)
    Identifier for the channel used for the transaction.
    Example: "MOBILE_APP"

  - `recommendation.transaction_data.reason` (string)
    Reason for the transaction.
    Example: "Monthly subscription payment"

  - `recommendation.transaction_data.transactionDate` (integer)
    Transaction timestamp (Unix epoch, milliseconds or seconds).
    Example: 1712594340000

  - `recommendation.transaction_data.payer` (object)
    Payer party of the transaction. Adds customer-tier and billing-info fields on top of the shared party shape.

  - `recommendation.transaction_data.payer.customerTier` (string)
    Payer's customer tier.
    Example: "premium"

  - `recommendation.transaction_data.payer.billingInfo` (object)
    Address and contact information (used by billingInfo and shippingInfo).

  - `recommendation.transaction_data.payer.billingInfo.name` (string)
    Full name.
    Example: "John Doe"

  - `recommendation.transaction_data.payer.billingInfo.addressLine1` (string)
    Address line 1.
    Example: "123 Main St"

  - `recommendation.transaction_data.payer.billingInfo.addressLine2` (string)
    Address line 2.
    Example: "Apt 4B"

  - `recommendation.transaction_data.payer.billingInfo.city` (string)
    City.
    Example: "New York"

  - `recommendation.transaction_data.payer.billingInfo.state` (string)
    State, province, or region.
    Example: "NY"

  - `recommendation.transaction_data.payer.billingInfo.zipPostalCode` (string)
    ZIP or postal code.
    Example: "10001"

  - `recommendation.transaction_data.payer.billingInfo.country` (string)
    Country code (ISO-3166-1 alpha-2).
    Example: "US"

  - `recommendation.transaction_data.payer.billingInfo.email` (string)
    Email address.
    Example: "john.doe@example.com"

  - `recommendation.transaction_data.payer.billingInfo.phone` (string)
    Phone number.
    Example: "+1234567890"

  - `recommendation.transaction_data.payer.name` (string)
    Party's name.
    Example: "John Doe"

  - `recommendation.transaction_data.payer.accountNumber` (string)
    Party's account number.
    Example: "1234567890123456"

  - `recommendation.transaction_data.payer.accountId` (string)
    Unique identifier for the party's account.
    Example: "USER_983245"

  - `recommendation.transaction_data.payer.accountCountryCode` (string)
    Country code of the account (ISO-3166-1 alpha-2).
    Example: "US"

  - `recommendation.transaction_data.payer.bankIdentifier` (string)
    Party's bank identifier.
    Example: "CHASEUS33"

  - `recommendation.transaction_data.payer.branchIdentifier` (string)
    Party's branch identifier.
    Example: "123456"

  - `recommendation.transaction_data.payer.card` (object)
    Card-level identifiers for the party.

  - `recommendation.transaction_data.payer.card.holderName` (string)
    Name of the card holder.
    Example: "John Doe"

  - `recommendation.transaction_data.payer.card.bin` (string)
    Bank Identification Number (first 6 digits of the card).
    Example: "411111"

  - `recommendation.transaction_data.payer.card.last4` (string)
    Last 4 digits of the credit card number.
    Example: "1234"

  - `recommendation.transaction_data.payee` (object)
    Payee party of the transaction.

  - `recommendation.transaction_data.payee.name` (string)
    Party's name.
    Example: "John Doe"

  - `recommendation.transaction_data.payee.accountNumber` (string)
    Party's account number.
    Example: "1234567890123456"

  - `recommendation.transaction_data.payee.accountId` (string)
    Unique identifier for the party's account.
    Example: "USER_983245"

  - `recommendation.transaction_data.payee.accountCountryCode` (string)
    Country code of the account (ISO-3166-1 alpha-2).
    Example: "US"

  - `recommendation.transaction_data.payee.bankIdentifier` (string)
    Party's bank identifier.
    Example: "CHASEUS33"

  - `recommendation.transaction_data.payee.branchIdentifier` (string)
    Party's branch identifier.
    Example: "123456"

  - `recommendation.transaction_data.payee.card` (object)
    Card-level identifiers for the party.

  - `recommendation.transaction_data.purchase` (object)
    Purchase details for the transaction.

  - `recommendation.transaction_data.purchase.totalItems` (integer)
    Total number of items in the purchase.
    Example: 3

  - `recommendation.transaction_data.purchase.products` (array)
    Line items in the purchase.

  - `recommendation.transaction_data.purchase.products.id` (string)
    Unique identifier for the product.
    Example: "PROD_12345"

  - `recommendation.transaction_data.purchase.products.name` (string)
    Name of the product.
    Example: "iPhone 15"

  - `recommendation.transaction_data.purchase.products.amount` (integer)
    Quantity of this product line item.
    Example: 1

  - `recommendation.transaction_data.purchase.products.price` (number)
    Price per unit of the product.
    Example: 999.99

  - `recommendation.transaction_data.purchase.shippingInfo` (object)
    Address and contact information (used by billingInfo and shippingInfo).

  - `recommendation.transaction_data.avs` (object)
    Address Verification Service result for the transaction.

  - `recommendation.transaction_data.avs.code` (string)
    AVS response code.
    Example: "Y"

  - `recommendation.transaction_data.avs.provider` (string)
    AVS provider name.
    Example: "Stripe"

  - `recommendation.transaction_data.avs.matchLevel` (string)
    AVS match level.
    Enum: same as `transaction_data.avs.matchLevel` in "Using regular session token" (5 values)

  - `recommendation.custom_attributes` (object)
    Tenant-defined custom attributes attached to the action. These add context to an action but must match the schema defined in the Admin Portal. Invalid attributes are ignored and not included in the response.

  - `recommendation.threats` (array)
    List of all detected threats.

  - `recommendation.preview_rule` (object)
    Rule configured in preview mode that would have determined this action's recommendation if all enabled rules were in production. Useful for impact analysis without changing live behavior.

  - `recommendation.preview_rule.rule_name` (string)
    Name of the preview rule.

  - `recommendation.preview_rule.recommendation` (string)
    Recommendation the preview rule would have applied.
    Enum: same as `recommendation.recommendation.type` (4 values)

  - `recommendation.preview_rule.risk_score` (number)
    Risk score the preview rule would have applied.


## Response 400 fields

## Response 401 fields

## Response 403 fields

## Response 429 fields

## Response 463 fields

## Response 500 fields