Stytch Fraud API

openapi: 3.2.0
info:
  title: Stytch Consumer Authentication Fraud API
  version: 2.0.0
  description: Stytch's Consumer API for passwordless and password-based authentication. Supports Magic Links, SMS/email/WhatsApp OTP, OAuth social login, TOTP, WebAuthn/Passkeys, Crypto Wallets, Sessions, Users, M2M tokens, Fraud / Device Fingerprinting, Connected Apps (OAuth provider / MCP), Impersonation, IDP, and Consumer RBAC.
  contact:
    name: Stytch
    url: https://stytch.com/docs
  license:
    name: Proprietary
servers:
- url: https://api.stytch.com
  description: Production
- url: https://test.stytch.com
  description: Test
tags:
- name: Fraud
paths:
  /v1/fingerprint/lookup:
    servers:
    - url: https://telemetry.stytch.com
    post:
      summary: Lookup
      operationId: api_fraud_v1_fraud_fingerprint_Lookup
      tags:
      - Fraud
      description: 'Lookup the associated fingerprint for the `telemetry_id` returned from the `GetTelemetryID()` function.

        Learn more about the different fingerprint types and verdicts in our [DFP guide](https://stytch.com/docs/fraud/guides/device-fingerprinting/overview).


        You can make a decision based on the recommended `verdict` in the response:

        * `ALLOW` - This is a known valid device grouping or device profile that is part of the default `ALLOW` listed set of known devices by Stytch. This grouping is made up of  verified device profiles that match the characteristics of known/authentic traffic origins.

        * `BLOCK` - This is a known bad or malicious device profile that is undesirable and should be blocked from completing the privileged action in question.

        * `CHALLENGE` - This is an unknown or potentially malicious device that should be put through increased friction such as 2FA or other forms of extended user verification before allowing the privileged action to proceed.


        If the `telemetry_id` is expired or not found, this endpoint returns a 404 `telemetry_id_not_found` [error](https://stytch.com/docs/fraud/api/errors/404#telemetry_id_not_found).

        We recommend treating 404 errors as a `BLOCK`, since it could be a sign of an attacker trying to bypass DFP protections.

        See [Attacker-controlled telemetry IDs](https://stytch.com/docs/fraud/guides/device-fingerprinting/integration-steps/test-your-integration#attacker-controlled-telemetry-ids) for more information.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/api_fraud_v1_fraud_fingerprint_LookupRequest'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api_fraud_v1_fraud_fingerprint_LookupResponse'
        '400':
          description: Bad request
        '401':
          description: Unauthorized
          content:
            application/json:
              example:
                status_code: 401
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: unauthorized_credentials
                error_message: Unauthorized credentials.
                error_url: https://stytch.com/docs/api/errors/401
        '429':
          description: Too Many Requests
          content:
            application/json:
              example:
                status_code: 429
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: too_many_requests
                error_message: Too many requests have been made.
                error_url: https://stytch.com/docs/api/errors/429
        '500':
          description: Internal server error
          content:
            application/json:
              example:
                status_code: 500
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: internal_server_error
                error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
                error_url: https://stytch.com/docs/api/errors/500
      x-code-samples:
      - lang: csharp
        label: C#
        source: "// POST /v1/fingerprint/lookup\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  telemetry_id: \"${exampleTelemetryId}\",\n};\n\nclient.Fraud.Fingerprint.Lookup(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: go
        label: Go
        source: "// POST /v1/fingerprint/lookup\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/consumer/fraud/fingerprint\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/consumer/stytchapi\"\n)\n\nfunc main() {\n\tclient, err := stytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &fingerprint.LookupParams{\n\t\tTelemetryID: \"${exampleTelemetryId}\",\n\t}\n\n\tresp, err := client.Fraud.Fingerprint.Lookup(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
      - lang: java
        label: Java
        source: "// POST /v1/fingerprint/lookup\npackage com.example;\n\nimport com.stytch.java.common.StytchResult;\nimport com.stytch.java.consumer.models.fraudfingerprint.LookupRequest;\nimport com.stytch.java.consumer.StytchClient;\n\npublic class Main {\n    public static void main(String[] args) {\n        StytchClient.configure(\"${projectId}\", \"${secret}\");\n\n        LookupRequest params = new LookupRequest();\n        params.setTelemetryId(\"${exampleTelemetryId}\");\n\n        Object result = StytchClient.getFraud().getFingerprint().lookup(params);\n        if (result instanceof StytchResult.Success) {\n          System.out.println(((StytchResult.Success) result).getValue());\n        } else {\n          System.out.println(((StytchResult.Error) result).getException());\n        }\n    }\n}"
      - lang: kotlin
        label: Kotlin
        source: "// POST /v1/fingerprint/lookup\npackage com.example\n\nimport com.stytch.java.consumer.StytchClient\nimport com.stytch.java.consumer.models.fraudfingerprint.LookupRequest\n\nfun main() {\n    StytchClient.configure(\n        projectId = \"${projectId}\",\n        secret = \"${secret}\",\n    )\n\n    when (\n        val result =\n            StytchClient.fraud.fingerprint.lookup(\n                LookupRequest(\n                    telemetryId = \"${exampleTelemetryId}\",\n                ),\n            )\n    ) {\n        is StytchResult.Success -> println(result.value)\n        is StytchResult.Error -> println(result.exception)\n    }\n}\n"
      - lang: javascript
        label: Node.js
        source: "// POST /v1/fingerprint/lookup\nconst stytch = require('stytch');\n\nconst client = new stytch.Client({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  telemetry_id: \"${exampleTelemetryId}\",\n};\n\nclient.fraud.fingerprint.lookup(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: php
        label: PHP
        source: "$response = $client->fraud->fingerprint->lookup([\n    'telemetry_id' => '${exampleTelemetryId}',\n]);"
      - lang: python
        label: Python
        source: "# POST /v1/fingerprint/lookup\nfrom stytch import Client\n\nclient = Client(\n    project_id=\"${projectId}\",\n    secret=\"${secret}\",\n)\n\nresp = client.fraud.fingerprint.lookup(\n    telemetry_id=\"${exampleTelemetryId}\",\n)\n\nprint(resp)\n"
      - lang: ruby
        label: Ruby
        source: "# POST /v1/fingerprint/lookup\nrequire 'stytch'\n\nclient = Stytch::Client.new(\n  project_id: \"${projectId}\",\n  secret: \"${secret}\"\n)\n\nresp = client.fraud.fingerprint.lookup(\n  telemetry_id: \"${exampleTelemetryId}\"\n  \n)\n\nputs resp"
      - lang: rust
        label: Rust
        source: "// POST /v1/fingerprint/lookup\nuse stytch::consumer::client::Client;\nuse stytch::consumer::fraud_fingerprint::LookupRequest;\n\nfn main() {\n    let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n    let resp = client.fraud.fingerprint.lookup(\n        LookupRequest{\n            telemetry_id: \"${exampleTelemetryId}\",\n            ..Default::default()\n        }\n    ).await;\n    println!(\"The response is {:?}\", resp);\n}"
      - lang: bash
        label: cURL
        source: "# POST /v1/fingerprint/lookup\ncurl --request POST \\\n  --url https://telemetry.stytch.com/v1/fingerprint/lookup \\\n  -u '${projectId}:${secret}' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n    \"telemetry_id\": \"${exampleTelemetryId}\"\n  }'"
  /v1/rules/set:
    servers:
    - url: https://telemetry.stytch.com
    post:
      summary: Set
      operationId: api_fraud_v1_fraud_rules_Set
      tags:
      - Fraud
      description: 'Set a rule for a particular `visitor_id`, `browser_id`, `visitor_fingerprint`, `browser_fingerprint`, `hardware_fingerprint`, `network_fingerprint`, `cidr_block`, `asn`, or `country_code`. This is helpful in cases where you want to allow or block a specific user or fingerprint. You should be careful when setting rules for `browser_fingerprint`, `hardware_fingerprint`, or `network_fingerprint` as they can be shared across multiple users, and you could affect more users than intended.


        You may not set an `ALLOW` rule for a `country_code`.


        Rules are applied in the order specified above. For example, if an end user has an `ALLOW` rule set for their `visitor_id` but a `BLOCK` rule set for their `hardware_fingerprint`, they will receive an `ALLOW` verdict because the `visitor_id` rule takes precedence.


        If there are conflicts between multiple `cidr_block` rules (for example, if the `ip_address` of the end user overlaps with multiple CIDR blocks that have rules set), the conflicts are resolved as follows:

        - The smallest block size takes precedence. For example, if an `ip_address` overlaps with a `cidr_block` rule of `ALLOW` for a block with a prefix of `/32` and a `cidr_block` rule of `BLOCK` with a prefix of `/24`, the rule match verdict will be `ALLOW`.

        - Among equivalent size blocks, `BLOCK` takes precedence over `CHALLENGE`, which takes precedence over `ALLOW`. For example, if an `ip_address` overlaps with two `cidr_block` rules with blocks of the same size that return `CHALLENGE` and `ALLOW`, the rule match verdict will be `CHALLENGE`.'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/api_fraud_v1_fraud_rules_SetRequest'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api_fraud_v1_fraud_rules_SetResponse'
        '400':
          description: Bad request
        '401':
          description: Unauthorized
          content:
            application/json:
              example:
                status_code: 401
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: unauthorized_credentials
                error_message: Unauthorized credentials.
                error_url: https://stytch.com/docs/api/errors/401
        '429':
          description: Too Many Requests
          content:
            application/json:
              example:
                status_code: 429
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: too_many_requests
                error_message: Too many requests have been made.
                error_url: https://stytch.com/docs/api/errors/429
        '500':
          description: Internal server error
          content:
            application/json:
              example:
                status_code: 500
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: internal_server_error
                error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
                error_url: https://stytch.com/docs/api/errors/500
      x-code-samples:
      - lang: csharp
        label: C#
        source: "// POST /v1/rules/set\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  action: CHALLENGE,\n  visitor_id: \"visitor-6139cbcc-4dda-4b1f-b1c0-13c08ec64d72\",\n  expires_in_minutes: 120,\n};\n\nclient.Fraud.Rules.Set(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: go
        label: Go
        source: "// POST /v1/rules/set\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/consumer/fraud\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/consumer/fraud/rules\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/consumer/stytchapi\"\n)\n\nfunc main() {\n\tclient, err := stytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &rules.SetParams{\n\t\tAction:           fraud.RuleActionCHALLENGE,\n\t\tVisitorID:        \"visitor-6139cbcc-4dda-4b1f-b1c0-13c08ec64d72\",\n\t\tExpiresInMinutes: 120,\n\t}\n\n\tresp, err := client.Fraud.Rules.Set(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
      - lang: java
        label: Java
        source: "// POST /v1/rules/set\npackage com.example;\n\nimport com.stytch.java.common.StytchResult;\nimport com.stytch.java.consumer.models.fraud.RuleAction;\nimport com.stytch.java.consumer.models.fraudrules.SetRequest;\nimport com.stytch.java.consumer.StytchClient;\n\npublic class Main {\n    public static void main(String[] args) {\n        StytchClient.configure(\"${projectId}\", \"${secret}\");\n\n        SetRequest params = new SetRequest();\n        params.setAction(RuleAction.CHALLENGE);\n        params.setVisitorId(\"visitor-6139cbcc-4dda-4b1f-b1c0-13c08ec64d72\");\n        params.setExpiresInMinutes(120);\n\n        Object result = StytchClient.getFraud().getRules().set(params);\n        if (result instanceof StytchResult.Success) {\n          System.out.println(((StytchResult.Success) result).getValue());\n        } else {\n          System.out.println(((StytchResult.Error) result).getException());\n        }\n    }\n}"
      - lang: kotlin
        label: Kotlin
        source: "// POST /v1/rules/set\npackage com.example\n\nimport com.stytch.java.consumer.StytchClient\nimport com.stytch.java.consumer.models.fraud.RuleAction\nimport com.stytch.java.consumer.models.fraudrules.SetRequest\n\nfun main() {\n    StytchClient.configure(\n        projectId = \"${projectId}\",\n        secret = \"${secret}\",\n    )\n\n    when (\n        val result =\n            StytchClient.fraud.rules.set(\n                SetRequest(\n                    action = RuleAction.CHALLENGE,\n                    visitorId = \"visitor-6139cbcc-4dda-4b1f-b1c0-13c08ec64d72\",\n                    expiresInMinutes = 120,\n                ),\n            )\n    ) {\n        is StytchResult.Success -> println(result.value)\n        is StytchResult.Error -> println(result.exception)\n    }\n}\n"
      - lang: javascript
        label: Node.js
        source: "// POST /v1/rules/set\nconst stytch = require('stytch');\n\nconst client = new stytch.Client({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  action: \"CHALLENGE\",\n  visitor_id: \"visitor-6139cbcc-4dda-4b1f-b1c0-13c08ec64d72\",\n  expires_in_minutes: 120,\n};\n\nclient.fraud.rules.set(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: php
        label: PHP
        source: "$response = $client->fraud->rules->set([\n    'action' => 'CHALLENGE',\n    'visitor_id' => 'visitor-6139cbcc-4dda-4b1f-b1c0-13c08ec64d72',\n    'expires_in_minutes' => 120,\n]);"
      - lang: python
        label: Python
        source: "# POST /v1/rules/set\nfrom stytch import Client\nfrom stytch.consumer.models.fraud import RuleAction\n\nclient = Client(\n    project_id=\"${projectId}\",\n    secret=\"${secret}\",\n)\n\nresp = client.fraud.rules.set(\n    action=RuleAction.CHALLENGE,\n    visitor_id=\"visitor-6139cbcc-4dda-4b1f-b1c0-13c08ec64d72\",\n    expires_in_minutes=120,\n)\n\nprint(resp)\n"
      - lang: ruby
        label: Ruby
        source: "# POST /v1/rules/set\nrequire 'stytch'\n\nclient = Stytch::Client.new(\n  project_id: \"${projectId}\",\n  secret: \"${secret}\"\n)\n\nresp = client.fraud.rules.set(\n  action: \"CHALLENGE\",\n  visitor_id: \"visitor-6139cbcc-4dda-4b1f-b1c0-13c08ec64d72\",\n  expires_in_minutes: 120\n  \n)\n\nputs resp"
      - lang: rust
        label: Rust
        source: "// POST /v1/rules/set\nuse stytch::consumer::client::Client;\nuse stytch::consumer::fraud_rules::SetRequest;\nuse stytch::consumer::fraud::RuleAction;\n\nfn main() {\n    let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n    let resp = client.fraud.rules.set(\n        SetRequest{\n            action: RuleAction::CHALLENGE,\n            visitor_id: Some(String::from(\"visitor-6139cbcc-4dda-4b1f-b1c0-13c08ec64d72\")),\n            expires_in_minutes: 120,\n            ..Default::default()\n        }\n    ).await;\n    println!(\"The response is {:?}\", resp);\n}"
      - lang: bash
        label: cURL
        source: "# POST /v1/rules/set\ncurl --request POST \\\n  --url https://telemetry.stytch.com/v1/rules/set \\\n  -u '${projectId}:${secret}' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n    \"action\": \"CHALLENGE\",\n    \"visitor_id\": \"visitor-6139cbcc-4dda-4b1f-b1c0-13c08ec64d72\",\n    \"expires_in_minutes\": 120\n  }'"
  /v1/rules/list:
    servers:
    - url: https://telemetry.stytch.com
    post:
      summary: List
      operationId: api_fraud_v1_fraud_rules_List
      tags:
      - Fraud
      description: Get all rules that have been set for your project.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/api_fraud_v1_fraud_rules_ListRequest'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api_fraud_v1_fraud_rules_ListResponse'
        '400':
          description: Bad request
        '401':
          description: Unauthorized
          content:
            application/json:
              example:
                status_code: 401
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: unauthorized_credentials
                error_message: Unauthorized credentials.
                error_url: https://stytch.com/docs/api/errors/401
        '429':
          description: Too Many Requests
          content:
            application/json:
              example:
                status_code: 429
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: too_many_requests
                error_message: Too many requests have been made.
                error_url: https://stytch.com/docs/api/errors/429
        '500':
          description: Internal server error
          content:
            application/json:
              example:
                status_code: 500
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: internal_server_error
                error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
                error_url: https://stytch.com/docs/api/errors/500
      x-code-samples:
      - lang: csharp
        label: C#
        source: "// POST /v1/rules/list\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  limit: 10,\n};\n\nclient.Fraud.Rules.List(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: go
        label: Go
        source: "// POST /v1/rules/list\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/consumer/fraud/rules\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/consumer/stytchapi\"\n)\n\nfunc main() {\n\tclient, err := stytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &rules.ListParams{\n\t\tLimit: 10,\n\t}\n\n\tresp, err := client.Fraud.Rules.List(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
      - lang: java
        label: Java
        source: "// POST /v1/rules/list\npackage com.example;\n\nimport com.stytch.java.common.StytchResult;\nimport com.stytch.java.consumer.models.fraudrules.ListRequest;\nimport com.stytch.java.consumer.StytchClient;\n\npublic class Main {\n    public static void main(String[] args) {\n        StytchClient.configure(\"${projectId}\", \"${secret}\");\n\n        ListRequest params = new ListRequest();\n        params.setLimit(10);\n\n        Object result = StytchClient.getFraud().getRules().list(params);\n        if (result instanceof StytchResult.Success) {\n          System.out.println(((StytchResult.Success) result).getValue());\n        } else {\n          System.out.println(((StytchResult.Error) result).getException());\n        }\n    }\n}"
      - lang: kotlin
        label: Kotlin
        source: "// POST /v1/rules/list\npackage com.example\n\nimport com.stytch.java.consumer.StytchClient\nimport com.stytch.java.consumer.models.fraudrules.ListRequest\n\nfun main() {\n    StytchClient.configure(\n        projectId = \"${projectId}\",\n        secret = \"${secret}\",\n    )\n\n    when (\n        val result =\n            StytchClient.fraud.rules.list(\n                ListRequest(\n                    limit = 10,\n                ),\n            )\n    ) {\n        is StytchResult.Success -> println(result.value)\n        is StytchResult.Error -> println(result.exception)\n    }\n}\n"
      - lang: javascript
        label: Node.js
        source: "// POST /v1/rules/list\nconst stytch = require('stytch');\n\nconst client = new stytch.Client({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  limit: 10,\n};\n\nclient.fraud.rules.list(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: php
        label: PHP
        source: "$response = $client->fraud->rules->list([\n    'limit' => 10,\n]);"
      - lang: python
        label: Python
        source: "# POST /v1/rules/list\nfrom stytch import Client\n\nclient = Client(\n    project_id=\"${projectId}\",\n    secret=\"${secret}\",\n)\n\nresp = client.fraud.rules.list(\n    limit=10,\n)\n\nprint(resp)\n"
      - lang: ruby
        label: Ruby
        source: "# POST /v1/rules/list\nrequire 'stytch'\n\nclient = Stytch::Client.new(\n  project_id: \"${projectId}\",\n  secret: \"${secret}\"\n)\n\nresp = client.fraud.rules.list(\n  limit: 10\n  \n)\n\nputs resp"
      - lang: rust
        label: Rust
        source: "// POST /v1/rules/list\nuse stytch::consumer::client::Client;\nuse stytch::consumer::fraud_rules::ListRequest;\n\nfn main() {\n    let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n    let resp = client.fraud.rules.list(\n        ListRequest{\n            limit: 10,\n            ..Default::default()\n        }\n    ).await;\n    println!(\"The response is {:?}\", resp);\n}"
      - lang: bash
        label: cURL
        source: "# POST /v1/rules/list\ncurl --request POST \\\n  --url https://telemetry.stytch.com/v1/rules/list \\\n  -u '${projectId}:${secret}' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n    \"limit\": 10\n  }'"
  /v1/verdict_reasons/override:
    servers:
    - url: https://telemetry.stytch.com
    post:
      summary: Override
      operationId: api_fraud_v1_fraud_verdict_reasons_Override
      tags:
      - Fraud
      description: Use this endpoint to override the action returned for a specific verdict reason during a fingerprint lookup. For example, Stytch Device Fingerprinting returns a `CHALLENGE` verdict action by default for the verdict reason `VIRTUAL_MACHINE`. You can use this endpoint to override that reason to return an `ALLOW` verdict instead if you expect many legitimate users to be using a browser that runs in a virtual machine.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/api_fraud_v1_fraud_verdict_reasons_OverrideRequest'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api_fraud_v1_fraud_verdict_reasons_OverrideResponse'
        '400':
          description: Bad request
        '401':
          description: Unauthorized
          content:
            application/json:
              example:
                status_code: 401
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: unauthorized_credentials
                error_message: Unauthorized credentials.
                error_url: https://stytch.com/docs/api/errors/401
        '429':
          description: Too Many Requests
          content:
            application/json:
              example:
                status_code: 429
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: too_many_requests
                error_message: Too many requests have been made.
                error_url: https://stytch.com/docs/api/errors/429
        '500':
          description: Internal server error
          content:
            application/json:
              example:
                status_code: 500
                request_id: request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141
                error_type: internal_server_error
                error_message: Oops, something seems to have gone wrong, please reach out to support@stytch.com to let us know what went wrong.
                error_url: https://stytch.com/docs/api/errors/500
      x-code-samples:
      - lang: csharp
        label: C#
        source: "// POST /v1/verdict_reasons/override\nconst stytch = require('stytch');\n\nconst client = new stytch.B2BClient({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  verdict_reason: \"VIRTUAL_MACHINE\",\n  override_action: ALLOW,\n};\n\nclient.Fraud.VerdictReasons.Override(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: go
        label: Go
        source: "// POST /v1/verdict_reasons/override\npackage main\n\nimport (\n\t\"context\"\n\t\"log\"\n\n\t\"github.com/stytchauth/stytch-go/v17/stytch/consumer/fraud/verdictreasons\"\n\t\"github.com/stytchauth/stytch-go/v17/stytch/consumer/stytchapi\"\n)\n\nfunc main() {\n\tclient, err := stytchapi.NewClient(\n\t\t\"${projectId}\",\n\t\t\"${secret}\",\n\t)\n\tif err != nil {\n\t\tlog.Fatalf(\"error instantiating client: %v\", err)\n\t}\n\n\tparams := &verdictreasons.OverrideParams{\n\t\tVerdictReason:  \"VIRTUAL_MACHINE\",\n\t\tOverrideAction: verdictreasons.OverrideRequestActionALLOW,\n\t}\n\n\tresp, err := client.Fraud.VerdictReasons.Override(context.Background(), params)\n\tif err != nil {\n\t\tlog.Fatalf(\"error in method call: %v\", err)\n\t}\n\n\tlog.Println(resp)\n}\n"
      - lang: java
        label: Java
        source: "// POST /v1/verdict_reasons/override\npackage com.example;\n\nimport com.stytch.java.common.StytchResult;\nimport com.stytch.java.consumer.models.fraudverdictreasons.OverrideRequest;\nimport com.stytch.java.consumer.models.fraudverdictreasons.OverrideRequestAction;\nimport com.stytch.java.consumer.StytchClient;\n\npublic class Main {\n    public static void main(String[] args) {\n        StytchClient.configure(\"${projectId}\", \"${secret}\");\n\n        OverrideRequest params = new OverrideRequest();\n        params.setVerdictReason(\"VIRTUAL_MACHINE\");\n        params.setOverrideAction(OverrideRequestAction.ALLOW);\n\n        Object result = StytchClient.getFraud().getVerdictReasons().override(params);\n        if (result instanceof StytchResult.Success) {\n          System.out.println(((StytchResult.Success) result).getValue());\n        } else {\n          System.out.println(((StytchResult.Error) result).getException());\n        }\n    }\n}"
      - lang: kotlin
        label: Kotlin
        source: "// POST /v1/verdict_reasons/override\npackage com.example\n\nimport com.stytch.java.consumer.StytchClient\nimport com.stytch.java.consumer.models.fraudverdictreasons.OverrideRequest\nimport com.stytch.java.consumer.models.fraudverdictreasons.OverrideRequestAction\n\nfun main() {\n    StytchClient.configure(\n        projectId = \"${projectId}\",\n        secret = \"${secret}\",\n    )\n\n    when (\n        val result =\n            StytchClient.fraud.verdictReasons.override(\n                OverrideRequest(\n                    verdictReason = \"VIRTUAL_MACHINE\",\n                    overrideAction = OverrideRequestAction.ALLOW,\n                ),\n            )\n    ) {\n        is StytchResult.Success -> println(result.value)\n        is StytchResult.Error -> println(result.exception)\n    }\n}\n"
      - lang: javascript
        label: Node.js
        source: "// POST /v1/verdict_reasons/override\nconst stytch = require('stytch');\n\nconst client = new stytch.Client({\n  project_id: '${projectId}',\n  secret: '${secret}',\n});\n\nconst params = {\n  verdict_reason: \"VIRTUAL_MACHINE\",\n  override_action: \"ALLOW\",\n};\n\nclient.fraud.verdictReasons.override(params)\n  .then(resp => { console.log(resp) })\n  .catch(err => { console.log(err) });"
      - lang: php
        label: PHP
        source: "$response = $client->fraud->verdict_reasons->override([\n    'verdict_reason' => 'VIRTUAL_MACHINE',\n    'override_action' => 'ALLOW',\n]);"
      - lang: python
        label: Python
        source: "# POST /v1/verdict_reasons/override\nfrom stytch import Client\nfrom stytch.consumer.models.fraud_verdict_reasons import OverrideRequestAction\n\nclient = Client(\n    project_id=\"${projectId}\",\n    secret=\"${secret}\",\n)\n\nresp = client.fraud.verdict_reasons.override(\n    verdict_reason=\"VIRTUAL_MACHINE\",\n    override_action=OverrideRequestAction.ALLOW,\n)\n\nprint(resp)\n"
      - lang: ruby
        label: Ruby
        source: "# POST /v1/verdict_reasons/override\nrequire 'stytch'\n\nclient = Stytch::Client.new(\n  project_id: \"${projectId}\",\n  secret: \"${secret}\"\n)\n\nresp = client.fraud.verdict_reasons.override(\n  verdict_reason: \"VIRTUAL_MACHINE\",\n  override_action: \"ALLOW\"\n  \n)\n\nputs resp"
      - lang: rust
        label: Rust
        source: "// POST /v1/verdict_reasons/override\nuse stytch::consumer::client::Client;\nuse stytch::consumer::fraud_verdict_reasons::OverrideRequestAction;\nuse stytch::consumer::fraud_verdict_reasons::OverrideRequest;\n\nfn main() {\n    let client = Client::new(\"${projectId}\", \"${secret}\").unwrap();\n    let resp = client.fraud.verdict_reasons.r#override(\n        OverrideRequest{\n            verdict_reason: \"VIRTUAL_MACHINE\",\n            override_action: OverrideRequestAction::ALLOW,\n            ..Default::default()\n        }\n    ).await;\n    println!(\"The response is {:?}\", resp);\n}"
      - lang: bash
        label: cURL
        source: "# POST /v1/verdict_reasons/override\ncurl --request POST \\\n  --url https://telemetry.stytch.com/v1/verdict_reasons/override \\\n  -u '${projectId}:${secret}' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n    \"verdict_reason\": \"VIRTUAL_MACHINE\",\n    \"ove

# --- truncated at 32 KB (73 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/stytch/refs/heads/main/openapi/stytch-fraud-api-openapi.yml