---
title: "Validate if this login event should be allowed, denied or reviewed."
method: POST
path: "/v1/validate/login"
tags: ["validate"]
---

# Validate if this login event should be allowed, denied or reviewed.

`POST /v1/validate/login`

## Request

- Base URL: `https://account-api.datadome.co`
- URL: `https://account-api.datadome.co/v1/validate/login`
- Auth: API key in header `x-api-key`

Analyzes a login event in real time and returns a recommendation (allow, deny or review) so you can act on it.

## Request body

- LoginPayload: Login payload sent from Customer endpoint to Account Protect server
  - `account` string, required: User account (mail address, username, alias, login, ...)
  - `module` Module, required: Information about module sending this Payload
    - `requestTimeMicros` integer, required: Timestamp of the request, in microseconds
    - `name` string, required: Module name
    - `version` string, required: Module version
  - `header` Header, required: Header sent by the User to the Customer endpoint
    - `addr` string, required: IP address of the originating host making the request (final client's IP address), HTTP_CLIENT_IP
    - `contentType` string, required: Request content-type, CONTENT_TYPE
    - `host` string, required: Request host, HTTP_HOST
    - `port` integer, required: Request port, REMOTE_PORT
    - `xRealIp` string, required: HTTP_X_REAL_IP
    - `xForwardedForIp` string, required: List of client and intermediate proxies/load-balancers IPs, HTTP_X_FORWARDED_FOR
    - `acceptEncoding` string, required: HTTP_ACCEPT_ENCODING
    - `acceptLanguage` string, required: HTTP_ACCEPT_LANGUAGE
    - `accept` string, required: Contents of the Accept: header from the current request, if there is one, HTTP_ACCEPT
    - `method` string, required: HTTP method (GET/POST/OPTION), REQUEST_METHOD
    - `protocol` string, required: Scheme part of the Request-URI (HTTP or HTTPS), SERVER_PROTOCOL
    - `serverHostname` string, required: Virtual host, SERVER_NAME
    - `referer` string, required: HTTP_REFERER
    - `userAgent` string, required: HTTP_USER_AGENT
    - `from` string, required: HTTP_FROM
    - `request` string, required: Path and query part of the Request-URI, REQUEST_URI
    - `origin` string, required: ORIG_PATH_INFO
    - `acceptCharset` string, required: HTTP_ACCEPT_CHARSET
    - `connection` string, required: Check Keep-Alive, from request Header if present, HTTP_CONNECTION
    - `clientID` string, required: The value of the datadome cookie attached to the client request
    - `secCHUA` string: Client hint providing the user-agent's branding and significant version information
    - `secCHUAMobile` string: Client hint for indicating whether the browser is on a mobile device
    - `secCHUAPlatform` string: Client hint for indicating the platform or operating system on which the user agent is running
    - `secCHUAArch` string: Client hint for indicating the user-agent's underlying CPU architecture, such as ARM or x86
    - `secCHUAFullVersionList` string: Client hint for indicating the user-agent's branding and full version information
    - `secCHUAModel` string: Client hint for indicating the device model on which the browser is running
    - `secCHDeviceMemory` string: Client hint for indicating the approximate amount of available RAM on the client device
  - `partnerId` string: For customers who sell their product as white label app, identify the partner using the solution to adapt detection models.
  - `eventDate` string, date-time: Date when the event occurred on your side, if you send it later than it happened (for example from a queue). Format ISO 8601 YYYY-MM-DDThh:mm:ss.sssTZD. DataDome uses it to order the events. If eventDate is absent or has an invalid format, DataDome uses module.requestTimeMicros instead, and the event is still processed.
  - `customFields` CustomField[]: Custom business data fields for additional customer-specific information
    - `name` string, required: The name of the custom data field. Cannot be null or empty.
    - `value` string, required: The value of the custom data field. Can be empty but not null.
    - `type` 'string' | 'phone' | 'email' | 'userId' | 'number' | 'ip': Data type for the custom field. Default is String.
    - `isPii` boolean: Indicates whether this field contains PII (Personally Identifiable Information). Default is false.
  - `session` Session: Information about the user session
    - `id` string: A unique session identifier from your system
    - `createdAt` string, date-time: Creation date of the session, Format ISO 8601 YYYY-MM-DDThh:mm:ssTZD
  - `status` 'failed' | 'succeeded', required: User login authentication status
  - `failReason` 'unknownAccount' | 'wrongPassword' | 'expiredPassword' | 'disabledAccount' | 'blockedAccount' | 'invalidMfa' | 'internalBusinessRule' | 'technicalIssue' | 'other': Reason why the login failed. Helps differentiate different types of fraud patterns.
  - `accountType` 'guest' | 'staff' | 'external' | 'partner' | 'customer' | 'merchant' | 'vip' | 'test' | 'other': Type of the account to adapt detection model on the user type
  - `accountCreationDate` string, date-time: Date when account was created. Help improve detection for account created before Account Protect setup. Format ISO 8601 YYYY-MM-DDThh:mm:ssTZD
  - `user` object
    - `id` string: A unique customer identifier from your system. It has to be the same for all other event sent
  - `authentication` object: Information about how the user authenticated
    - `socialProvider` 'other' | 'amazon' | 'apple' | 'facebook' | 'github' | 'google' | 'linkedin' | 'microsoft' | 'twitter' | 'yahoo': Authentication social provider
    - `type` 'local' | 'other' | 'social': Authentication type
    - `mode` 'other' | 'biometric' | 'mail' | 'mfa' | 'otp' | 'password': Authentication mode

## Response `200`

Login validation response sent from Account Protect server to Customer

- ResponseLogin: Validate response from Account Protect server to Customer endpoint
  - `action` 'deny' | 'review' | 'challenge' | 'allow', required: Action answered to Customer endpoint
  - `reasons` string[]: List of models matching the event
  - `eventId` string, required: Event identifier associated to this validate event (for both registration and login)
  - `score` integer: The level of confidence when identifying a request as coming from a fraudster.
  - `ip` string, required: User IP
  - `location` Location, required: User Location
    - `countryCode` string: Country code, format ISO-3166-1-alpha-2
    - `country` string: Country name
    - `city` string: City

## Other responses

- `400`: Error response when the request is malformed
- `401`: Error response when the apiKey is missing or blank
- `403`: Error response when the apiKey is not valid
- `429`: Error response when the request is rate-limited
- `500`: Internal server error

---

[API](https://skmtc.dev/datadome/apis/account-protect-api.md) - [All operations](https://skmtc.dev/datadome/apis/account-protect-api/llms.txt) - [OpenAPI document](https://skmtc.dev/datadome/apis/account-protect-api/revisions/c25df7aef1f2?raw)