Fraud prevention API (beta)
Stop sign-up farms and card testing before they cost you
Call one endpoint before a sign-up, a login or a payment. Your own openfraud instance answers allow, step up, hold or block, with the rules that fired and why.
Up to 2,000 free checks every month. No card needed.
curl -X POST https://api.openshield.dev/fraud/v1/decide \
-H "Authorization: Bearer $OPENSHIELD_KEY" \
-H "Content-Type: application/json" \
-d '{"type": "account.created", "actor_id": "u_4821",
"email": "farm-0193@example.com", "ip": "203.0.113.50",
"user_agent": "python-requests/2.32", "country": "BE"}'{
"decision": "block",
"reasons": [
{ "rule": "core_blocked_ip", "workflow": "core_blocklists", "mode": "act",
"reason": "The request comes from an address blocked by an administrator" }
],
"shadow": { "reasons": [
{ "rule": "signup_http_client", "workflow": "trial_signup", "score": 40, "mode": "shadow",
"reason": "A sign-up sent by an HTTP library, not by a browser or an app" }
] },
"case_id": 42
}Yours alone
An instance for each customer
openfraud keeps no wall between customers inside one instance, so openshield runs one for you. Your events, accounts and cases never mix with anyone else's.
The same API keys
Add fraud access to a key: the whole fraud API, or decide and events only for a backend that reports.
Pseudonymized from the start
Email addresses, phone numbers, IP addresses and devices are replaced by keyed pseudonyms before any rule sees them. Raw values are not stored.
Kept 90 days
Events, decisions and cases are deleted after 90 days. Export or erase what is kept about one person with one call.
What it checks
A core that acts, and packs that start in shadow
The core blocks what you block by hand, rewards trust earned by paying, and watches for account takeover. Each pack adds rules for one kind of abuse; every pack rule says what it would do, in shadow, until it is promoted to act, by default after 30 days when it has proved reliable.
Core
Blocklists you fill, trust earned by paying, account takeover signals.
Six packs
Free tiers and trials, cards and payments, messaging, marketplaces and payouts, APIs and compute, hosting and content.
Network data
The operator and country of each address, disposable email domains, Tor exits, data centres and VPNs. From your first top-up.
The end user's context
Send the visitor's address, browser, language and country: the gateway passes your body untouched and never fills them from your server's request.
To plan with
Prices and limits
- Decision
- €0.001 per call to /fraud/v1/decide
- Event
- €0.0002 per event reported, each accepted event of a batch
- Free use
- €2.00 each month, shared with moderation checks
- A quiet free instance
- Paused after 30 days without a call, its data kept; the next call or a click resumes it
- Webhooks
- Standard Webhooks, signed with your own secret, sent again for about two days
In the docs
Read how it works
- Fraud prevention Decide and events, the end user's context, prices, webhooks and errors.
- Authentication and keys How to call the API, what a key may do and how to keep it safe.
- Limits and quotas What each plan includes, how fast you may call the API and what happens at a limit.
- Privacy and data What is stored and what never is, where, and for how long.
More
Other ways in
- For your SaaS Moderate posts, comments, avatars and uploads before they go live.
- Image moderation API Nudity, gore, weapons and more, with a score per category.
- Text moderation API Unsafe text, personal data, spam and scams, with the reasons.
- Pricing Free use each month, then a prepaid balance, priced by what each check uses.
Questions
Before you start
- Will it block my real users on day one?
- No. Only the core acts at first, and the core blocks only what you put in your own blocklists. Every pack rule starts in shadow: the answer says what it would have done, so you can watch it on your own traffic. By default, openshield promotes a rule to act after 30 days when it has proved reliable, and emails you each time. You can switch to promoting rules yourself, or limit automatic promotion to rules that hold or review.
- What if the fraud API is slow or down?
- openfraud's SDKs fail open: on a timeout or an error they retry, then answer allow, so an outage never blocks your users. Give them at least 800 ms.
- Is openfraud open source?
- Yes, under the Apache-2.0 licence. openshield hosts it, keeps each customer's instance apart and bills by the call.
- What does it cost?
- €0.001 a decision and €0.0002 an event, from the same prepaid balance as moderation, with €2.00 of free use each month. Cases, accounts and lists are free.
Start with up to 2,000 free checks every month
No card needed. Create a key and send your first request in five minutes.
Prepaid, in euros, excluding VAT