Verdicts
allow, challenge, shadow, block — plus score, reasons, and what you should enforce.
Every successful check and evaluate returns:
- score — 0–100 overall risk (
scores.overallmirrors it) - verdict —
allow|challenge|shadow|block - reasons — plain-language why the score moved
- risk / riskSignals / flags — facet rollups
- tls — always present (JA3/JA4 + capture status)
- network — always present (
kind+ optional channel) - requestId — also on
X-Request-Id
What to enforce
| Verdict | Typical action |
|---|---|
allow | Continue the auth flow |
challenge | Step-up (MFA, extra proof) then continue |
shadow | Allow, but queue for review / tighten later |
block | Stop account creation or session |
AbuseGraph does not terminate requests. Your app (or worker) applies the verdict.
Errors
Failures use application/problem+json (RFC 9457). Rate headers: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, Retry-After.