Ingest Risk Signal

Ingest a raw risk signal event. Risk signals are the foundation of the Anti-Fraud Identity Firewall — they represent a single suspicious observation about a subject.

Request

signal_source · string · required

Origin of the signal. One of: verification, login, attestation, external, manual

signal_type · string · required

Type of risk signal. One of: velocity, geo_anomaly, device_fingerprint, behavior, deepfake, ato, impersonation

subject_id · string · required

Identifier of the entity being evaluated (user ID, issuer ID, attestation ID, IP address, etc.)

subject_type · string · required

Type of the subject. One of: user, issuer, attestation, session, ip, device

risk_score · integer · required

Risk score from 0 (safe) to 100 (high risk). Scores ≥80 trigger automatic review decisions.

payload · object

Arbitrary JSON payload with signal-specific context (device fingerprint, geo coordinates, behavior metrics, etc.)

ip_address · string

Source IP address associated with this event.

user_agent · string

User-Agent string associated with this event.

Headers

Idempotency-Key · string

UUID for idempotent signal ingestion. If omitted, a random key is generated. Duplicate signals with the same key are silently ignored.

Response

signal_id · string

UUID of the created risk signal.

risk_score · integer

The ingested risk score (0–100).

created_at · string

ISO 8601 timestamp of ingestion.