Records an action against any entity (IP, email, phone, device, account, cookie, or a custom type) and evaluates velocity across 4 rolling windows, account age, and — for entity_type=cookie — cross-session cookie consistency.

Parameters

Field	Type	Optional	Description
`entity_type`	string	Required	ip, email, phone, device, account, cookie, or a custom type.
`entity_value`	string	Required	—
`action`	string	Required	e.g. login, signup, checkout.
`account_created_at`	string	Optional	Enables the is_new_account signal.
`device_hash`	string	Optional	Required for entity_type=cookie checks.

Example Request

curl -X POST http://localhost/api/v1/behavior/check \
  -H "Authorization: Bearer wsk_xxx_xxx" \
  -d "entity_type=email&entity_value=user%40example.com&action=login"

<?php
$ch = curl_init('http://localhost/api/v1/behavior/check');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Authorization: Bearer wsk_xxx_xxx']);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(['entity_type' => 'email', 'entity_value' => '[email protected]', 'action' => 'login']));
$response = curl_exec($ch);
curl_close($ch);

$data = json_decode($response, true);

import requests

response = requests.post("http://localhost/api/v1/behavior/check",
    headers={"Authorization": "Bearer wsk_xxx_xxx"},
    data={"entity_type": "email", "entity_value": "[email protected]", "action": "login"},
)

data = response.json()

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	client := &http.Client{}
	body := strings.NewReader("entity_type=email&entity_value=user%40example.com&action=login")
	req, _ := http.NewRequest("POST", "http://localhost/api/v1/behavior/check", body)
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.Header.Set("Authorization", "Bearer wsk_xxx_xxx")

	resp, err := client.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	respBody, _ := io.ReadAll(resp.Body)
	fmt.Println(string(respBody))
}

Example Response

{
  "data": {
    "entity_type": "email", "entity_value": "[email protected]", "action": "login",
    "counts": {"60s": 1, "300s": 1, "3600s": 1, "86400s": 1},
    "velocity_exceeded": false, "exceeded_window": null,
    "account_age_seconds": null, "is_new_account": false,
    "cookie_consistency": null,
    "fraud_score": 0, "risk_score": 0,
    "reasons": ["No risk signals detected"]
  }
}

← Device Fingerprinting Interaction Telemetry Check →