AbuseGraph
← Back to guides

AbuseGraph + cURL

Hit /api/v1/check directly with sk_test_… — works from any stack or shell script.

Install the browser SDK

npm install @palisade/sdk

Init early on app load. Call check({ email }) at signup or login — not on every page view.

Quick path

  1. Copy sk_test_… and set ABUSEGRAPH_SITE from the console Keys page.
  2. POST email + event to https://abusegraph.com/api/v1/check.
  3. Inspect verdict and score in the JSON response.

Keys

KeyEnvUse
SecretABUSEGRAPH_SECRET_KEY (sk_test_… / sk_live_…)Server /api/v1/check
PublishableNEXT_PUBLIC_ABUSEGRAPH_PUBLISHABLE_KEY (pk_test_…)Browser SDK
SiteABUSEGRAPH_SITEDNS-verified domain

Free includes 1,000 live API checks / month after DNS verify. Test keys never bill.

Env

bash

export ABUSEGRAPH_SITE=yourdomain.com
export ABUSEGRAPH_SECRET_KEY=sk_test_…

Use sk_live_… in production after DNS verify.

Server check

Direct POST to https://abusegraph.com/api/v1/check. Events: signup | login | password_reset | email_change. Optional sessionId.

Signup

bash

curl -sS -X POST https://abusegraph.com/api/v1/check \
  -H "content-type: application/json" \
  -H "x-api-key: $ABUSEGRAPH_SECRET_KEY" \
  -H "x-abusegraph-site: $ABUSEGRAPH_SITE" \
  -d '{
    "email": "user@example.com",
    "event": "signup",
    "site": "'"$ABUSEGRAPH_SITE"'"
  }'

Login

bash

curl -sS -X POST https://abusegraph.com/api/v1/check \
  -H "content-type: application/json" \
  -H "x-api-key: $ABUSEGRAPH_SECRET_KEY" \
  -H "x-abusegraph-site: $ABUSEGRAPH_SITE" \
  -d '{
    "email": "user@example.com",
    "event": "login",
    "site": "'"$ABUSEGRAPH_SITE"'"
  }'

Response shape:

json

{
  "verdict": "allow",
  "score": 12,
  "summary": "…"
}

Verdicts: allow | challenge | shadow | block.

Browser signals (recommended)

For full scores from a web app, use @palisade/sdk (init + collect + evaluate + toCheckBody) and merge those fields into the POST body above — NEVER rely on browser-only checks alone.

Lifecycle events

  • login — "event": "login".
  • password_reset — "event": "password_reset".
  • email_change — "event": "email_change".

Platform

Lists, rules, and linked accounts apply on every check — configure in the console. Optional session: POST /api/v1/session. Native apps: iOS, Android, React Native.

Verify

Run the curl command with sk_test_…. You should get JSON with verdict and score, and see the row in Activity.