CyberSource Decision Manager API
REST API for the Decision Manager Service
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/cybersource-decision-manager-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
description: All CyberSource API specs merged together. These are available at https://developer.cybersource.com/api/reference/api-reference.html
version: 0.0.1
title: CyberSource Merged Spec bankAccountValidation Decision Manager API
servers:
- url: https://apitest.cybersource.com/
tags:
- name: Decision Manager
description: REST API for the Decision Manager Service
paths:
/risk/v1/decisions:
post:
summary: Create Decision Manager
description: Decision Manager can help you automate and streamline your fraud operations. Decision Manager will return a decision based on the request values.
operationId: createBundledDecisionManagerCase
tags:
- Decision Manager
x-devcenter-metaData:
categoryTag: Risk_Management
disableDefaultMerchantCreds: 'true'
disabledReason: DM API response is a mock response, Please integrate with DM API to test the real-time response from the server.
responses:
'201':
description: Successful response
content:
application/hal+json;charset=utf-8:
schema:
title: riskV1DecisionsPost201Response
type: object
properties:
_links:
type: object
properties:
self:
type: object
properties:
href:
type: string
description: This is the endpoint of the resource that was created by the successful request.
method:
type: string
description: '`method` refers to the HTTP method that you can send to the `self` endpoint to retrieve details of the resource.'
reversal:
type: object
properties:
href:
type: string
description: This is the endpoint of the resource that was created by the successful request.
method:
type: string
description: '`method` refers to the HTTP method that you can send to the `self` endpoint to retrieve details of the resource.'
capture:
type: object
properties:
href:
type: string
description: This is the endpoint of the resource that was created by the successful request.
method:
type: string
description: '`method` refers to the HTTP method that you can send to the `self` endpoint to retrieve details of the resource.'
customer:
type: object
properties:
href:
type: string
description: This is the endpoint of the resource that was created by the successful request.
method:
type: string
description: '`method` refers to the HTTP method that you can send to the `self` endpoint to retrieve details of the resource.'
paymentInstrument:
type: object
properties:
href:
type: string
description: This is the endpoint of the resource that was created by the successful request.
method:
type: string
description: '`method` refers to the HTTP method that you can send to the `self` endpoint to retrieve details of the resource.'
shippingAddress:
type: object
properties:
href:
type: string
description: This is the endpoint of the resource that was created by the successful request.
method:
type: string
description: '`method` refers to the HTTP method that you can send to the `self` endpoint to retrieve details of the resource.'
instrumentIdentifier:
type: object
properties:
href:
type: string
description: This is the endpoint of the resource that was created by the successful request.
method:
type: string
description: '`method` refers to the HTTP method that you can send to the `self` endpoint to retrieve details of the resource.'
id:
type: string
maxLength: 26
description: 'An unique identification number generated by Cybersource to identify the submitted request. Returned by all services.
It is also appended to the endpoint of the resource.
On incremental authorizations, this value with be the same as the identification number returned in the original authorization response.
'
submitTimeUtc:
type: string
description: 'Time of request in UTC. Format: `YYYY-MM-DDThh:mm:ssZ`
**Example** `2016-08-11T22:47:57Z` equals August 11, 2016, at 22:47:57 (10:47:57 p.m.).
The `T` separates the date and the time. The `Z` indicates UTC.
Returned by Cybersource for all services.
'
submitTimeLocal:
type: string
description: Time that the transaction was submitted in local time. Generated by Cybersource.
status:
type: string
description: "The status of the submitted transaction.\n\nPossible values:\n - `ACCEPTED`\n - `REJECTED`\n - `PENDING_REVIEW`\n - `DECLINED`\n - `PENDING_AUTHENTICATION`\n - `INVALID_REQUEST`\n - `AUTHENTICATION_FAILED`\n - `CHALLENGE`\n"
riskInformation:
type: object
description: Contains the result of risk assessment.
properties:
profile:
type: object
properties:
name:
type: string
maxLength: 30
description: 'Name of the active profile chosen by the profile selector. If no profile selector exists,
the default active profile is chosen.
**Note** By default, your default profile is the active profile, or the Profile Selector chooses the active profile. Use this field
only if you want to specify the name of a different profile. The passed-in profile will then become the active profile.
'
desinationQueue:
type: string
maxLength: 255
description: 'Name of the queue where orders that are not automatically accepted are sent.
'
selectorRule:
type: string
maxLength: 255
description: 'Name of the profile selector rule that chooses the profile to use for the
transaction. If no profile selector exists, the value is Default Active Profile.
'
rules:
type: array
items:
type: object
properties:
name:
type: string
maxLength: 255
description: Description of the rule as it appears in the Profile Editor.
decision:
type: string
maxLength: 255
description: 'Summarizes the result for the rule according to the setting that you chose in the Profile Editor.
This field can contain one of the following values:
- `IGNORE`
- `REVIEW`
- `REJECT`
- `ACCEPT`
'
infoCodes:
type: object
properties:
velocity:
type: array
description: 'List of information codes triggered by the order. These information codes were generated when you created
the order and product velocity rules and are returned so that you can associate them with the rules.
'
items:
type: string
description: Indicates excessive volume of transactions.
address:
type: array
description: 'Indicates a mismatch between the customer''s billing and shipping addresses.
'
items:
type: string
customerList:
type: array
description: 'Indicates that customer information is associated with transactions that are either on the negative or
the positive list.
'
items:
type: string
deviceBehavior:
type: array
description: 'Indicates the device behavior information code(s) returned from device fingerprinting.
'
items:
type: string
identityChange:
type: array
description: 'Indicates excessive identity changes. The threshold is variable depending on the identity elements being
compared.
'
items:
type: string
internet:
type: array
description: 'Indicates a problem with the customer''s email address, IP address, or billing address.
'
items:
type: string
phone:
type: array
description: 'Indicates a problem with the customer''s phone number.
'
items:
type: string
suspicious:
type: array
description: 'Indicates that the customer provided potentially suspicious information.
'
items:
type: string
globalVelocity:
type: array
description: 'Indicates that the customer has a high purchase frequency.
'
items:
type: string
velocity:
type: object
properties:
morphing:
type: array
description: 'List of information codes triggered by the order. These information codes were generated when you created the order and product velocity rules and are returned so that you can associate them with the rules.
Returned by scoring service.
'
items:
type: object
properties:
count:
type: integer
maxLength: 5
description: 'Morphing count specified by the number #.
**Note** The count is not returned for the initial transaction.
'
fieldName:
type: string
maxLength: 255
description: 'Field name of the morphing element. specified by the setting that you chose in the
Velocity Editor.
For all possible values, see the `decisionReply_morphingElement_#_fieldName` field description in the _Decision Manager Using the SCMP API Developer Guide_ on the [CyberSource Business Center.](https://ebc2.cybersource.com/ebc2/) Click **Decision Manager** > **Documentation** > **Guides** > _Decision Manager Using the SCMP API Developer Guide_ (PDF link).
'
informationCode:
type: string
maxLength: 255
description: "Identifier that CyberSource assigned to the velocity rule specified by the number #.\n\nFor all possible values, see the `decision_velocity_morphing_#_info_code` field description in the _Decision Manager Using the SCMP API Developer Guide_ on the [CyberSource Business Center.](https://ebc2.cybersource.com/ebc2/) Click **Decision Manager** > \n"
address:
type: array
items:
type: string
maxLength: 255
description: 'Indicates a mismatch between the customer''s billing and shipping addresses.
For all possible values, see the `score_address_info` field description in the _Decision Manager Using the SCMP API Developer Guide_ on the [CyberSource Business Center.](https://ebc2.cybersource.com/ebc2/) Click **Decision Manager** > **Documentation** > **Guides** > _Decision Manager Using the SCMP API Developer Guide_ (PDF link).
'
casePriority:
type: integer
maxLength: 1
description: 'You receive this field only if you subscribe to the Enhanced Case Management service. The priority level ranges from 1 (highest) to 5 (lowest); the default value is 3. If you do not assign a priority to your rules or to your profiles, the default value is given to the order.
For all possible values, see the `decision_case_priority` field description in the _Decision Manager Using the SCMP API Developer Guide_ on the [CyberSource Business Center.](https://ebc2.cybersource.com/ebc2/) Click **Decision Manager** > **Documentation** > **Guides** > _Decision Manager Using the SCMP API Developer Guide_ (PDF link).
'
localTime:
type: string
maxLength: 255
description: 'The customer''s local time (`hh:mm:ss`), which is calculated from the transaction request time and the
customer''s billing address.
For details, see the `score_time_local` field description in the _Decision Manager Using the SCMP API Developer Guide_ on the [CyberSource Business Center.](https://ebc2.cybersource.com/ebc2/)
'
score:
type: object
properties:
factorCodes:
type: array
items:
type: string
description: 'This field contains information that affected the score of the order.
This field will contain one or more codes, separated by carets (^).
For all possible values, see the `score_factors` field description in the _Decision Manager Using the SCMP API Developer Guide_ on the [CyberSource Business Center.](https://ebc2.cybersource.com/ebc2/) Click **Decision Manager** > **Documentation** > **Guides** > _Decision Manager Using the SCMP API Developer Guide_ (PDF link).
'
modelUsed:
type: string
maxLength: 255
description: 'Name of the score model used for the transaction. If you did not include a custom model in your request,
this field contains the name of CyberSource''s default model.
For all possible values, see the `score_model_used` field description in the _Decision Manager Using the SCMP API Developer Guide_ on the [CyberSource Business Center.](https://ebc2.cybersource.com/ebc2/) Click **Decision Manager** > **Documentation** > **Guides** > _Decision Manager Using the SCMP API Developer Guide_ (PDF link).
'
result:
type: string
maxLength: 255
description: 'Total score calculated for this order. The value cannot be negative.
For all possible values, see the `score_score_result` field description in the _Decision Manager Using the SCMP API Developer Guide_ on the [CyberSource Business Center.](https://ebc2.cybersource.com/ebc2/) Click **Decision Manager** > **Documentation** > **Guides** > _Decision Manager Using the SCMP API Developer Guide_ (PDF link).
'
ipAddress:
type: object
description: Contains detailed response information about the customer's IP address.
properties:
anonymizerStatus:
type: string
maxLength: 255
description: 'Indicates whether the transaction IP address is associated with a known anonymous proxy.
For all possible values, see the `score_ip_anonymizer_status` field description in the _Decision Manager Using the SCMP API Developer Guide_ on the [CyberSource Business Center.](https://ebc2.cybersource.com/ebc2/) Click **Decision Manager** > **Documentation** > **Guides** > _Decision Manager Using the SCMP API Developer Guide_ (PDF link).
'
locality:
type: string
maxLength: 255
description: 'Name of the city decoded from the IP address used directly or indirectly by the customer to send the order.
For all possible values, see the `score_ip_city` field description in the _Decision Manager Using the SCMP API Developer Guide_ on the [CyberSource Business Center.](https://ebc2.cybersource.com/ebc2/) Click **Decision Manager** > **Documentation** > **Guides** > _Decision Manager Using the SCMP API Developer Guide_ (PDF link).
'
country:
type: string
maxLength: 255
description: 'Name of the country decoded from the IP address used directly or indirectly by the customer to send the order.
For all possible values, see the `score_ip_country` field description in the _Decision Manager Using the SCMP API Developer Guide_ on the [CyberSource Business Center.](https://ebc2.cybersource.com/ebc2/) Click **Decision Manager** > **Documentation** > **Guides** > _Decision Manager Using the SCMP API Developer Guide_ (PDF link).
'
administrativeArea:
type: string
maxLength: 255
description: 'Name of the state decoded from the IP address used directly or indirectly by the customer to send the order.
For all possible values, see the `score_ip_state` field description in the _Decision Manager Using the SCMP API Developer Guide_ on the [CyberSource Business Center.](https://ebc2.cybersource.com/ebc2/) Click **Decision Manager** > **Documentation** > **Guides** > _Decision Manager Using the SCMP API Developer Guide_ (PDF link).
'
routingMethod:
type: string
maxLength: 255
description: 'Routing method decoded from the IP address used directly or indirectly by the customer to send the order.
For all possible values, see the `score_ip_routing_method` field description in the _Decision Manager Using the SCMP API Developer Guide_ on the [CyberSource Business Center.](https://ebc2.cybersource.com/ebc2/) Click **Decision Manager** > **Documentation** > **Guides** > _Decision Manager Using the SCMP API Developer Guide_ (PDF link).
'
carrier:
type: string
maxLength: 255
description: 'Provides the name of the organization that owns the ASN. The carrier is responsible for the traffic carried on the network or set of networks designated as an Autonomous System (AS) and identified by the ASN.
While there are more than 27,000 active ASNs, there are fewer carriers, because a single carrier often manages several ASNs.
'
organization:
type: string
maxLength: 255
description: 'The Registering Organization is the entity responsible for the actions and content associated with a given block of IP addresses. This is in contrast to the carrier, which is responsible for the routing of traffic for network blocks. Registering Organizations include many types of entities, including corporate, government, or educational entities, and ISPs managing the allocation and use of network blocks.
'
providers:
type: object
description: 'Name of the 3rd party provider, for example, Emailage.
For all possible values, see the `decision_provider_#_name` field description in the _Decision Manager Using the SCMP API Developer Guide_ on the [CyberSource Business Center.](https://ebc2.cybersource.com/ebc2/) Click **Decision Manager** > **Documentation** > **Guides** > _Decision Manager Using the SCMP API Developer Guide_ (PDF link).'
additionalProperties:
type: object
description: 'Field name, for example, email address domain name (domain_name).
For all possible values, see the `decision_provider_#_field_#_name` field description in the _Decision Manager Using the SCMP API Developer Guide_ on the [CyberSource Business Center.](https://ebc2.cybersource.com/ebc2/) Click **Decision Manager** > **Documentation** > **Guides** > _Decision Manager Using the SCMP API Developer Guide_ (PDF link).
'
additionalProperties:
type: string
travel:
type: object
properties:
actualFinalDestination:
type: object
properties:
country:
type: string
maxLength: 90
description: Country of actual final destination on the route.
locality:
type: string
maxLength: 90
description: City of actual final destination on the route.
latitude:
type: string
maxLength: 10
description: Latitude of actual final destination on the route.
longitude:
type: string
maxLength: 10
description: Longitude of actual final destination on the route.
firstDeparture:
type: object
properties:
country:
type: string
maxLength: 90
description: Country of first departure on the route.
locality:
type: string
maxLength: 90
description: City of first departure on the route.
latitude:
type: string
maxLength: 10
description: Latitude of first departure on the route.
longitude:
type: string
maxLength: 10
description: Longitude of first departure on the route.
firstDestination:
type: object
properties:
country:
type: string
maxLength: 90
description: Country of first destination on the route.
locality:
type: string
maxLength: 90
description: City of first destination on the route.
latitude:
type: string
maxLength: 10
description: Latitude of first destination on the route.
longitude:
type: string
maxLength: 10
description: Longitude of first destination on the route.
lastDestination:
type: object
properties:
country:
type: string
maxLength: 90
description: Country of last destination on the route.
locality:
type: string
maxLength: 90
description: City of last destination on the route.
latitude:
type: string
maxLength: 10
description: Latitude of last destination on the route.
longitude:
type: string
maxLength: 10
description: Longitude of last destination on the route.
processorResults:
type: object
properties:
fraudDecision:
type: string
maxLength: 60
description: 'Type of filter. Possible values:
- ACCEPT
- PENDING
- DENY
- REPORT
'
fraudDecisionReason:
type: string
maxLength: 60
description: 'possible values
- AVS_NO_MATCH
- AVS_PARTIAL_MATCH
- AVS_UNAVAILABLE_OR_UNSUPPORTED
- CARD_SECURITY_CODE_MISMATCH
- MAXIMUM_TRANSACTION_AMOUNT
- UNCONFIRMED_ADDRESS
- COUNTRY_MONITOR
- LARGE_ORDER_NUMBER
- BILLING_OR_SHIPPING_ADDRESS_MISMATCH
- RISKY_ZIP_CODE
- SUSPECTED_FREIGHT_FORWARDER_CHECK
- TOTAL_PURCHASE_PRICE_MINIMUM
- IP_ADDRESS_VELOCITY
- RISKY_EMAIL_ADDRESS_DOMAIN_CHECK
- RISKY_BANK_IDENTIFICATION_NUMBER_CHECK,
RISKY_IP_ADDRESS_RANGE
- PAYPAL_FRAUD_MODEL
'
paymentInformation:
type: object
description: Contains response information about the payment.
properties:
binCountry:
type: string
maxLength: 255
description: 'Country (two-digit country code) associated with the BIN of the customer''s card used for the payment.
Returned if the information is available. Use this field for additional information when reviewing orders.
This information is also displayed in the details page of the CyberSource Business Center.
'
accountType:
type: string
maxLength: 255
description: 'Type of payment card account. This field can refer to a credit card, debit card, or prepaid card
account type.
'
issuer:
type: string
maxLength: 255
description: 'Name of the bank or entity that issued the card account.
'
scheme:
type: string
maxLength: 255
description: 'Subtype of card account. This field can contain one of the following values:
- Maestro International
- Maestro UK Domestic
- MasterCard Credit
- MasterCard Debit
- Visa Credit
- Visa Debit
- Visa Electron
**Note** Additional values may be present.
'
bin:
# --- truncated at 32 KB (358 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cybersource/refs/heads/main/openapi/cybersource-decision-manager-api-openapi.yml