PIpixiebrix
activity

GET /api/activity/address-list/match/

Changed on

Look up on-device address hashes against the caller's organization known-address list. The caller sends one hash per match granularity (exact / building / street, computed on-device); the endpoint returns the finest matched level's entry — its identifier, entry_type (fraud/employee), and matched level — and 404 on a miss. The raw address never leaves the browser; only the hashes are sent. Gated by the activity-tracking flag and scoped to the caller's organization; enablement is driven by the org's activity policy (security.addressFraudRules).

Request

  • Base URL
    https://app.pixiebrix.com
  • Auth
    none declared

Query parameters

organizationstring uuid required

UUID of the organization whose known-address list to look up.

hashstring[] required

On-device HMAC-SHA256 hashes of the normalized entered address, one per match granularity (exact / building / street), each 64-char hex. Repeated (?hash=a&hash=b); the endpoint returns the finest matched level. The raw address is never sent.

Response

identifierstring required

Human reference surfaced in the risk report in place of the raw address (e.g. a fraud-case id or an employee id).

entry_type'fraud' | 'employee' required

Whether the address is a known-fraud address or an employee's own.

level'exact' | 'building' | 'street'

Granularity this hash row represents (exact / building / street). Set on-device at seed/upload time — the server never normalizes, so it cannot derive closeness itself. One seeded address expands into one row per level, sharing an identifier; the match endpoint returns the finest level that hits.

Changes