Unified

Score a whole signup in one call

Combines every signal you supply into a single risk score and verdict, with each component returned alongside. This is the endpoint most integrations use at registration or checkout.

post/v1/score/user

Request

  • Base URL: https://www.layercall.com
  • URL: https://www.layercall.com/v1/score/user
  • Auth: one of:
    • API key in header x-api-key
    • HTTP bearer

Query parameters

strictness'lenient' | 'balanced' | 'strict'

Shifts the allow/review/block thresholds. Signals and risk_score are unchanged.

Request body

ipstring
emailstring email
phonestring
phone_countrystring
domainstring
device_idstring

Fingerprint from fp.js.

device_signalsobject

Optional browser characteristics from fp.js.

device_automationobject

Optional automation markers from fp.js.

Example request

{
  "ip": "185.220.101.5",
  "email": "test@mailinator.com",
  "phone": "+14155552671",
  "phone_country": "US",
  "domain": "example.com"
}

Response

Combined score

risk_scoreinteger required

0 = clean, 100 = certain fraud.

verdict'allow' | 'review' | 'block' required

Recommended action. Thresholds move with strictness.

request_idstring
signals_unavailablestring[]

Signals that could not be measured on this request — e.g. ["tor", "vpn_providers"]. Absent entirely when every feed answered, so the happy-path shape is unchanged. Present means the score was built on incomplete data: a "clean" answer and a "we could not check" answer are otherwise identical.

summarystring
components_checkedstring[]
top_signalsstring[]
processing_time_secnumber
billable_lookupsinteger

Example response

{
  "components": {
    "ip": {
      "vpn_provider": "NordVPN",
      "processing_time_sec": 0.261,
      "billable_lookups": 1
    },
    "email": {
      "domain": "gmail.com",
      "mx_provider": "Google Workspace",
      "mx_records": [
        "gmail-smtp-in.l.google.com."
      ],
      "times_seen": 1,
      "processing_time_sec": 0.097,
      "billable_lookups": 1
    },
    "phone": {
      "processing_time_sec": 0.116,
      "times_seen": 1,
      "billable_lookups": 1
    },
    "domain": {
      "processing_time_sec": 0.094,
      "times_seen": 1,
      "billable_lookups": 1
    },
    "device": {
      "request_id": "req_9319c108-cc66-4cbf-af64-37729a17c855",
      "processing_time_sec": 0.031,
      "billable_lookups": 1
    }
  },
  "summary": "Allowed (34/100) — Datacenter ASN and machine-generated handle, not enough to hold it.",
  "components_checked": [
    "email"
  ],
  "linkage": {
    "email_ip_count": 1,
    "subnet_rate_1h": 17,
    "domain_rate_1h": 14
  },
  "actor": {
    "type": "unknown",
    "basis": "none",
    "detail": "No signature and no device fingerprint. Drop fp.js on the page, or pass the agent's signed request, to get an answer here."
  },
  "top_signals": [
    "ip: datacenter asn"
  ],
  "processing_time_sec": 0.033
}

Changes

No recorded changes to this operation across all 1 revision of this API.