---
title: "ONCE Fraud API — risk score and flags for an email"
method: POST
path: "/fraud/score"
---

# ONCE Fraud API — risk score and flags for an email

`POST /fraud/score`

Returns the overall weighted fraud score, severity, and the individual signal flags for an email. Requires an API key (Personal Access Token) with the once:fraud scope, created in the ONCE dev center. Never returns IPs, other-account data, or any internal detection details — only scores and flags. Free during a limited-time beta.

## Request body

- FraudScoreRequest
  - `email` string, email, required — Email address to check.

## Response `200`

Fraud score and flags

- FraudScoreResponse
  - `email` string, email, required
  - `score` integer, required — Overall weighted risk score, 0..maxScore.
  - `maxScore` integer, required — Scoring ceiling.
  - `severity` 'none' | 'low' | 'medium' | 'high' | 'critical', required
  - `computedAt` string, date-time, nullable — Last time this account was scored, or null if never scored.
  - `flags` FraudFlag[], required
    - `code` string, required — Stable public flag code.
    - `label` string, required
    - `category` 'rights' | 'account_integrity' | 'content' | 'distribution' | 'streaming' | 'behavior' | 'abuse', required
    - `severity` 'low' | 'medium' | 'high' | 'critical', required
    - `triggered` boolean, required
    - `points` integer, required — Points this flag contributed (0 when not triggered).

## Other responses

- `403` — API key missing the once:fraud scope
- `404` — No ONCE account found for the email
- `429` — Rate limit or daily free-tier quota exceeded

---

[API](https://skmtc.dev/once/apis/once-rest-api.md) · [All operations](https://skmtc.dev/once/apis/once-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/once/once-rest-api/revisions/6b7f882e04ff/schema)