Fraud Risk Scoring for Backends, APIs, and Mobile Apps.
Send submission data from your backend and receive a complete fraud risk assessment in a single synchronous API call. Email, IP, content, velocity, and geographic signals scored in parallel. Your team decides what to do with the result.
14-day free trial. No credit card required.
{
"email": "john.doe@example.com",
"phone1": "+14155551234",
"phone2": "+14155559876",
"userIp": "203.0.113.42",
"firstName": "John",
"lastName": "Doe",
"fullName": "John Doe",
"username": "johndoe_92",
"companyName": "Acme Corp",
"website": "https://acme.example.com",
"subject": "Partnership inquiry",
"message": "Hello, I am interested in your services...",
"address1": "123 Main St",
"address2": "Suite 400",
"city": "San Francisco",
"region": "CA",
"country": "US",
"postalCode": "94105",
"origin": "www.example.com",
"submissionType": "registration",
"formData": {
"referral_code": "ABC123",
"newsletter_opt_in": "true"
},
"opportifyToken": "opptok_v1.YWJjMTIz.ZGVmNDU2.Z2hpNzg5",
"opportifyFormUUID": "f47ac10b-58cc-4372-a567-0e02b2c3d479"
}Integrate in 4 Steps
One endpoint. Synchronous response. Your backend stays in control.
Generate Your API Key
Create a private API key from your dashboard. Pass it in the x-opportify-token header on every request. All fields are transmitted in the request body to prevent PII from appearing in access logs.
Send Submission Data
POST to /intel/v1/fraud/analyze with the submission fields your backend already captures. At minimum, provide email or userIp. Add phone, name, IP, and content fields for stronger signal coverage.
Receive the Risk Assessment
The API responds synchronously with a complete risk report: score, level, reason codes, and per-source breakdowns for email, IP, phone, content, velocity, and geographic signals.
Apply Your Business Logic
The risk assessment is advisory. Accept, flag, queue for review, or route based on the score and reason codes. Your backend owns the decision. No automatic blocking or gating occurs on our side.
Signal Coverage
Six intelligence sources evaluated in parallel on every API call. Behavioral signals are added in hybrid mode.
| Signal Category | API Only | Client-Side (JS) Only | Hybrid (API + JS Client) |
|---|---|---|---|
Email Intelligence
| ✓ | ✓ | ✓ |
IP Intelligence
| ✓ | ✓ | ✓ |
Content Analysis
| ✓ | ✓ | ✓ |
Velocity Analysis
| ✓ | ✓ | ✓ |
Geographic Cross-Referencing
| ✓ | ✓ | ✓ |
Behavioral & Session Intelligence
Available automatically with the JS client; added to API scoring in hybrid mode | — | ✓ | ✓ |
All signals are bundled into a single analysis. Billing is per completed analysis, not per signal.
Add Behavioral Signals to Your API Calls
Deploy the JS client alongside the API to incorporate behavioral telemetry into your synchronous risk assessment. Typing patterns, automation detection, device fingerprinting, and honeypot triggers become part of the score.
How Hybrid Mode Works
- 1
Add the JS client to your page
Same snippet as Form Fraud Protection. The client collects behavioral telemetry and device signals in the background.
- 2
JS client injects opportifyToken into the form
After the session initializes, the client automatically adds hidden opportifyToken and opportifyFormUUID fields to your form.
- 3
Your backend extracts both tokens from the payload
Read opportifyToken and opportifyFormUUID from the submitted form data. Both are required for full session resolution.
- 4
Include tokens in your API request
Pass opportifyToken, opportifyFormUUID, and origin in your POST to /intel/v1/fraud/analyze. The API resolves the session and incorporates all behavioral signals into the risk assessment.
Behavioral Signals Added in Hybrid Mode
Typing cadence
Keystroke timing patterns across all fields, compared to human baseline distributions
Automation detection
Headless browser flags, scripted interaction patterns, and missing micro-interactions
Honeypot triggers
Hidden field interactions that real users never encounter but bots frequently trigger
Device fingerprint
Stable HMAC-based device identity from browser, OS, screen, viewport, CPU, and preference signals
User agent consistency
Cross-check between the declared UA, client hints, and observed browser behavior
Session origin validation
Verifies that the submission origin matches the session context and allowed domain
Both opportifyToken and opportifyFormUUID are required for full session resolution. Sending only the token without the form UUID results in a lightweight fallback with no behavioral enrichment.
Built for Every Backend Use Case
Score submissions wherever your backend processes them, with no frontend dependency required.
SaaS Registration Flows
Score every sign-up before creating an account. Detect disposable emails, datacenter IPs, and synthetic identities at registration time.
Flag trial abuse and multi-account patterns using velocity analysis across email, IP, and device combinations.
Apply risk-based routing: fast-track low-risk registrations and send high-risk sign-ups to manual review before provisioning.
Mobile Apps and API-First Flows
Score mobile sign-ups and onboarding steps from your backend. No JS client needed for pure API-mode scoring.
Analyze email, phone, IP, and content signals without any frontend instrumentation.
Deploy hybrid mode for maximum coverage: add the JS client to your mobile web view to incorporate behavioral signals into API scoring.
Backend Workflows and Webhooks
Score inbound leads, form submissions, and contact requests received via your own backend before routing to CRM.
Integrate into serverless functions, webhook processors, or middleware to screen submissions at any point in your pipeline.
Receive synchronous risk assessments with no external webhook configuration required.
Pre-KYC Screening
Filter high-risk and synthetic submissions before they enter identity verification workflows, reducing unnecessary KYC spend.
Catch fabricated identities and VOIP numbers using email, phone, and IP risk signals before KYC begins.
Route high-risk applicants to enhanced review while fast-tracking low-risk users through onboarding.
Start scoring submissions from your backend
Integrate the Fraud Protection API in hours. Synchronous risk assessment across six intelligence sources. 14-day free trial.
- Access to Email and IP Insights
- Pre-built workflows and SDKs included
Need a no-code form integration instead? See Form Fraud Protection.
Frequently Asked Questions
What is the Fraud Protection API?
POST /intel/v1/fraud/analyze. Your backend sends submission fields and receives a complete risk assessment in a single HTTP response. No webhook configuration is needed; the risk score, level, and reason codes are returned synchronously.What fields are required?
email or userIp. Adding more fields (name, content, origin, submissionType) activates additional intelligence sources and produces a more complete risk assessment. Phone numbers (phone1, phone2) are accepted and contribute to velocity analysis and geographic cross-referencing. The more signals provided, the richer the risk report.How is the API different from Form Fraud Protection?
The Fraud Protection API is a server-side integration: your backend calls the API directly and receives the risk assessment synchronously in the response. You apply your own business logic before creating accounts, routing data, or processing submissions.
Form Fraud Protection includes behavioral signals (device fingerprint, typing patterns, automation detection) automatically. The API includes behavioral signals only in hybrid mode, when both the JS client and the API are deployed together.
Does the API include behavioral signals?
opportifyToken and opportifyFormUUID in your API request. The API resolves the session and incorporates all behavioral signals into the synchronous risk assessment.In API-only mode (no JS client), behavioral signals are not available. The assessment uses email, IP, phone, content, velocity, and geographic signals.
How do I authenticate API requests?
x-opportify-token request header. Generate your key from the dashboard. All submission fields are passed in the request body, never in query parameters, to prevent PII from appearing in access logs or cached URLs.What does the response look like?
score (200–1000), level (lowest, low, medium, high, highest), factors (reason codes), and a sources object with per-source breakdowns for email, IP, content, session, velocity, and geographic signals.