AbuseGraphDocs

Browser Evaluate

Preliminary browser evaluation used by the AbuseGraph SDK (publishable key).

POST
/v1/risk/evaluate

Called by the AbuseGraph browser SDK with a publishable key. Returns a short-lived verdict token + preliminary score. Includes realtime velocity checks when floods are detected. Do not call this with secret keys. Prefer the hosted SDK: https://abusegraph.com/sdk/abusegraph.min.js.

Authorization

PublishableApiKey
x-api-key<token>

Publishable key (pk_test_… / pk_live_…). Safe in the browser. The SDK sends this automatically; you can also pass publicKey in the JSON body.

In: header

Query Parameters

expand?string

Comma-separated expand flags that change response shaping: tls, linked, all. Compact tls and network are always present on check/evaluate success. expand=tls (or all) deepens ClientHello fields on tls. expand=linked (or all) returns linkedAccounts when neighbors are available. detection / recommendation / compare are emitted when the engine produces them (not gated by expand).

Header Parameters

X-Request-Id?string

Optional client correlation id. Echoed on the response; minted when omitted.

Length8 <= length <= 128

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Browser SDK evaluate body. Prefer the hosted SDK over hand-rolling this. Unknown fields are ignored safely.

Response Body

application/json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

curl -X POST "https://example.com/v1/risk/evaluate" \  -H "Content-Type: application/json" \  -d '{    "fingerprint": "fp_demo_visitor_001",    "fingerprintConfidence": 0.92,    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"  }'
{  "verdictToken": {    "token": "vt_demo_example",    "expiresAt": "2026-07-19T22:05:00.000Z"  },  "score": 18,  "verdict": "allow",  "scores": {    "overall": 18,    "bot": 0,    "network": 0,    "email": 0,    "identity": 0,    "tls": 0,    "multipleAccounts": 0,    "riskSignals": 0  },  "flags": {    "vpn": false,    "tor": false,    "datacenter": false,    "proxy": false,    "abuseIp": false,    "disposableEmail": false,    "bot": false,    "multiAccount": false,    "velocity": false,    "breach": false  },  "riskSignals": [],  "tls": {    "present": true,    "captureStatus": "verified",    "flagged": false,    "reasons": [],    "ja4": "t13d1516h2_8daaf6152771"  },  "network": {    "kind": "clean"  }}
GET
/health

Presence-only check that the API is ready. No secrets are returned.

Response Body

application/json

curl -X GET "https://example.com/health"
{  "status": "ok",  "bindings": {    "property1": true,    "property2": true  }}
GET
/v1/config

Unauthenticated policy for the browser SDK — whether a bot challenge is required. Licensed publishable keys never hard-require a challenge.

Response Body

application/json

curl -X GET "https://example.com/v1/config"
{  "turnstileRequired": true,  "turnstileRequiredUnbound": true}
GET
/v1/visit/context

Public visitor network snapshot for demos. IP is masked (/24 or /48) — never a raw address.

Response Body

application/json

curl -X GET "https://example.com/v1/visit/context"
{  "ip": "string",  "country": "string",  "city": "string",  "region": "string",  "asn": "string",  "asOrganization": "string",  "userAgent": "string"}