Risk Check
Server-side risk scoring with your secret API key.
Server-only risk check with your secret API key. Always returns nested risk, flat aliases, and a compact tls block (captureStatus, JA3/JA4 when known). Use ?expand=tls for richer ClientHello fields. For browser SDK flows, create a sessionId or forward collect probes / tlsCapture into this check.
Authorization
SecretApiKey Workspace secret key (sk_test_… / sk_live_…). Prefer test keys in these docs. Create keys in the console — never commit real values.
In: header
Query Parameters
Comma-separated expand flags that change response shaping: tls, linked, all. Compact tls and network are always present on check/evaluate success. expand=tls (or all) deepens ClientHello fields on tls. expand=linked (or all) returns linkedAccounts when neighbors are available. detection / recommendation / compare are emitted when the engine produces them (not gated by expand).
Header Parameters
Optional client correlation id. Echoed on the response; minted when omitted.
8 <= length <= 128Licensed site hostname for live secret-key checks. Leave blank when trying sk_test_… from these docs. Required for sk_live_….
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Server-side risk check body. Unknown SDK fields are ignored safely (passthrough). Prefer sessionId + account fields, or forward collect probes / tlsCapture from the browser SDK.
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X POST "https://example.com/api/v1/check" \ -H "Content-Type: application/json" \ -d '{ "email": "user@example.com", "ip": "203.0.113.10", "event": "signup" }'{ "score": 72, "verdict": "challenge", "summary": "Recommend challenge: this signup showed throwaway or risky email.", "event": "signup", "risk": { "signals": [ { "type": "disposable_email", "label": "Disposable email" } ], "reasons": [ { "code": "disposable_email", "label": "Disposable email", "category": "risky_email" } ], "unusual": [], "summary": "Recommend challenge: this signup showed throwaway or risky email." }, "riskSignals": [ { "type": "disposable_email", "label": "Disposable email" } ], "reasons": [ { "code": "disposable_email", "label": "Disposable email", "category": "risky_email" } ], "unusual": [], "accountsLinked": 0, "scores": { "overall": 72, "bot": 0, "network": 0, "email": 70, "identity": 0, "tls": 0, "multipleAccounts": 0, "riskSignals": 70 }, "flags": { "vpn": false, "tor": false, "datacenter": false, "proxy": false, "abuseIp": false, "disposableEmail": true, "bot": false, "multiAccount": false, "velocity": false, "breach": false }, "network": { "kind": "clean" }, "email": { "disposable": true, "risky": true, "breach": false }, "tls": { "present": false, "captureStatus": "missing", "flagged": false, "reasons": [] }, "recommendation": { "action": "challenge", "title": "Challenge this signup", "detail": "Score 72. Elevated risk signals fired.", "bullets": [ "Disposable email" ] }, "detection": { "version": 1, "summary": "Email risk signals fired.", "categories": [ { "id": "risky_email", "label": "Risky email", "hit": true } ], "compartments": [ { "id": "email", "label": "Email", "severity": "high", "hit": true, "reasons": [ "disposable_email" ], "count": 1 } ], "topReasons": [ { "type": "disposable_email", "label": "Disposable email", "category": "risky_email" } ], "unusual": [], "network": { "kind": "clean" }, "device": { "automation": "none", "confidence": "unknown" } }}