Skip to main content
The Events API is used for non-transaction user actions. While the Transactions API focuses on payment events, the Events API covers the broader set of user behaviors — logins, account creations, password resets, address changes, and more — that are equally important signals in a comprehensive fraud detection strategy. Like transaction screening, event screening is synchronous and returns a risk score and decision in the response.

​
POST /events

Submit any user action for fraud screening. The event_type field tells AntifraudAI which behavioral model to apply. Use custom for event types not covered by the predefined list.

​
Request Parameters

​
string
required
The type of user action being screened. Accepted values:
  • login — user authentication attempt
  • signup — new account creation
  • password_reset — password reset request or completion
  • address_change — billing or shipping address update
  • withdrawal — funds withdrawal request
  • custom — any other action; pair with metadata to add context
​
string
required
Your internal identifier for the user performing the action. Used to associate this event with the user’s risk profile.
​
string
IPv4 or IPv6 address of the user at the time of the event. Strongly recommended — enables geo-velocity, proxy detection, and IP reputation signals.
​
string
Device fingerprint token from the AntifraudAI JavaScript SDK. Enables device continuity signals that detect when a user suddenly switches to an unrecognized device.
​
string
The email address associated with the user or the action (e.g., the email entered during signup or password reset). Used for email reputation and disposable-domain signals.
​
object
A flat key-value map of custom attributes providing additional context for this event. All values must be strings. For custom event types, use this field to describe the action in detail.

​
Response Fields

​
string
Unique identifier for this event screening result.
​
integer
Risk score from 0 (no risk) to 100 (highest risk) for this specific event.
​
string
Recommended action: allow, review, or block.
​
array of strings
Active risk signals that contributed to the score for this event.
​
string
ISO 8601 UTC timestamp of when the event was screened.
Example request body:
Example response:
Each event you submit is automatically associated with the user’s risk profile and contributes to their overall_risk_score. Screen all meaningful user actions — not just payments — for the most accurate risk scoring.