Skip to main content
AntifraudAI exposes a REST API that accepts JSON request bodies and returns JSON responses. Every request must be authenticated with a Bearer token passed in the Authorization header. The API is stateless — each call carries all the information needed to process it, with no session or cookie management required on your side.

​
Base URLs

All API requests are sent to one of two base URLs depending on the environment. The sandbox and production environments are functionally identical; the only difference is the domain and the API key prefix you use.
Sandbox requests are processed by the same fraud models as production, but they never affect live data or billing. Use sandbox keys (sk_test_) for all development and integration testing.

​
Request Format

For POST and PUT requests, set the Content-Type header to application/json and include a JSON-encoded body:
GET and DELETE requests do not have a body. Pass filtering or pagination options as URL query parameters instead:

​
Response Format

All responses — including errors — are returned as JSON. Successful responses contain a top-level resource object (or an array wrapped in a named key for list endpoints):
Error responses always contain an error object with a machine-readable code and a human-readable message:

​
API Versioning

All endpoints are prefixed with /v1. Breaking changes — such as removing fields or altering response shapes — will be released under a new version prefix (e.g., /v2). Non-breaking additions, such as new optional fields, may be added to the current version at any time. To pin your integration to a specific API version independent of the URL prefix, pass the X-Api-Version header:
We recommend setting X-Api-Version in your HTTP client’s default headers so every request in your codebase is pinned to the same version, making upgrades an explicit, controlled step.

​
Available Endpoints

Transactions

Submit transactions for real-time fraud screening and retrieve screening results via POST /transactions/screen and GET /transactions/{id}.

Users

Query the aggregated risk profile AntifraudAI has built for any user in your system via GET /users/{user_id}/risk-profile.

Events

Screen non-transaction user actions such as logins, signups, and password resets via POST /events.

Decisions

Retrieve fraud decisions and submit manual review overrides via GET /decisions/{id} and POST /decisions/{id}/review.

Cases

List, inspect, and resolve fraud review cases that were automatically created for review decisions.

Webhooks

Register, list, and delete webhook endpoints to receive real-time HTTP notifications for fraud events.