Browser Evaluate
Preliminary browser evaluation used by the AbuseGraph SDK (publishable key).
Called by the AbuseGraph browser SDK with a publishable key. Returns a short-lived verdict token + preliminary score. Includes realtime velocity checks when floods are detected. Do not call this with secret keys. Prefer the hosted SDK: https://abusegraph.com/sdk/abusegraph.min.js.
Authorization
PublishableApiKey Publishable key (pk_test_… / pk_live_…). Safe in the browser. The SDK sends this automatically; you can also pass publicKey in the JSON body.
In: header
Query Parameters
Comma-separated expand flags that change response shaping: tls, linked, all. Compact tls and network are always present on check/evaluate success. expand=tls (or all) deepens ClientHello fields on tls. expand=linked (or all) returns linkedAccounts when neighbors are available. detection / recommendation / compare are emitted when the engine produces them (not gated by expand).
Header Parameters
Optional client correlation id. Echoed on the response; minted when omitted.
8 <= length <= 128Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Browser SDK evaluate body. Prefer the hosted SDK over hand-rolling this. Unknown fields are ignored safely.
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X POST "https://example.com/v1/risk/evaluate" \ -H "Content-Type: application/json" \ -d '{ "fingerprint": "fp_demo_visitor_001", "fingerprintConfidence": 0.92, "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36" }'{ "verdictToken": { "token": "vt_demo_example", "expiresAt": "2026-07-19T22:05:00.000Z" }, "score": 18, "verdict": "allow", "scores": { "overall": 18, "bot": 0, "network": 0, "email": 0, "identity": 0, "tls": 0, "multipleAccounts": 0, "riskSignals": 0 }, "flags": { "vpn": false, "tor": false, "datacenter": false, "proxy": false, "abuseIp": false, "disposableEmail": false, "bot": false, "multiAccount": false, "velocity": false, "breach": false }, "riskSignals": [], "tls": { "present": true, "captureStatus": "verified", "flagged": false, "reasons": [], "ja4": "t13d1516h2_8daaf6152771" }, "network": { "kind": "clean" }}curl -X GET "https://example.com/health"{ "status": "ok", "bindings": { "property1": true, "property2": true }}Unauthenticated policy for the browser SDK — whether a bot challenge is required. Licensed publishable keys never hard-require a challenge.
Response Body
application/json
curl -X GET "https://example.com/v1/config"{ "turnstileRequired": true, "turnstileRequiredUnbound": true}Public visitor network snapshot for demos. IP is masked (/24 or /48) — never a raw address.
Response Body
application/json
curl -X GET "https://example.com/v1/visit/context"{ "ip": "string", "country": "string", "city": "string", "region": "string", "asn": "string", "asOrganization": "string", "userAgent": "string"}