--- title: "Customer Create" method: POST path: "/customer_create" tags: ["Customer Management"] --- # Customer Create `POST /customer_create` Customer create is a **synchronous POST-method** API call. Riskified receives account data creation events and performs fraud review to block suspicious account as well as blocking multiple account creation attempts. **Response:** `decision` field will be set as one of the following values: `allow`, `block`. block response contains `decision_reason` when `api-version=2` is set in request header. ## Headers - `x-riskified-shop-domain` string, required - `x-riskified-hmac-sha256` string, required - `content_type` 'application/json', required - `accept` 'application/vnd.riskified.com; version=2', required - `api-version` '2' ## Request body - CustomerCreate - `customer_id` string, required — A unique numeric identifier for the customer. - `client_details` ClientDetails, required — An object containing technical information regarding the customer’s browsing session - `user_agent` string, required — The full User-Agent sent from the client. - `accept_language` string, required — List of two-letter language codes sent from the client. - `session_details` SessionDetails, required — An object containing basic information regarding the session. Session data points, such as `cart_token`, `browser_ip`, and `user_agent`, should be those associated with values at the time of user's login request - **before** the authentication result is available. - `cart_token` string, required — The session id at the time that the user is on the login webpage or started password reset, prior to authentication attempt. Must match the `session_details.cart_token` value set by the Beacon JavaScript snippet. For standard integrations, this value is automatically generated by Beacon. For merchants who manage their own sessions, the same session ID must be passed to both the Beacon and this field. Must remain consistent throughout a purchase flow. Max 100 characters. - `browser_ip` string, required — The customer's browser IP address during the session. - `created_at` string, required — The date and time (ISO8601) of the session. - `source` 'desktop_web' | 'mobile_web' | 'web' | 'mobile_app' | 'other', required — The platform that the session originated from. **Possible values:** - `desktop_web`: Session originated on the website, using a desktop device - `mobile_web`: Session originated on the mobile website, using a mobile device - `web`: Session originated on the website, with no available info about the type of device used - `mobile_app`: Session originated on the mobile app, using a mobile device - `other`: The session's origin is unknown - `device_id` string — **(Conditional Requirement)** Required for mobile applications. The mobile device identifier, which corresponds to a value extracted via the Riskified mobile beacon SDK. - `referring_site` string — **(Strongly Recommended)** The webpage from which the customer accessed the shop. Domain level is enough, and usually set the shop_url provided by Riskified. In case you have several sites may be used by different population, set different url per the scenario (e.g. regular ec-site: www.shop-regular.com, employee ec-site: www.shop-employee.com) - `customer` Customer, required - `email` string, required — The customer's email address. - `verified_email` boolean — **(Recommended)** Indicates whether the merchant verified the customer’s email. - `first_name` string, required — The first name of the customer. - `last_name` string, required — The last name of the customer. - `id` string — The customer’s unique ID in the merchant’s system. Required in the case of a registered customer. - `created_at` string, required — The timestamp of the initial registration of the customer's account in the merchant's systems. - `orders_count` integer — The number of orders made by the customer on the site in the past. - `account_type` string — Required if there are multiple account types. The customer’s account type. Recommended values include: * guest * registered * premium * business - `phone` string — The customer’s phone number. - `verified_phone` boolean — Indicates whether the customer's phone number was verified. - `date_of_birth` string, date — Customer’s date of birth. Date part only (ISO8601). - `gender` 'male' | 'female' — The customer's gender. **Possible values:** - `male` - `female` - `user_name` string — Required in case the site user name is not the email address. - `address` Address - `first_name` string, required — The first name of the person associated with the address. - `last_name` string, required — The last name of the person associated with the address. - `address1` string, required — The street name of the address. - `country` string, required — The name of the country address. - `country_code` string, required — The 2 letter country code (ISO 3166-1 alpha-2) of the country address - `phone` string, required — The phone number at the address. - `city` string, required — The city of the address. - `zip` string, required — The zip or postal code of the address. - `address2` string — An optional additional field for the street address. - `company` string — Required if the address is associated to a company. The company of the person associated with the address. - `additional_phone` string — Additional phone number at the address. - `verified_phone` boolean — Indicates whether the provided phone number was verified. - `province` string, required — The name of the state or province of the address. - `province_code` string — The two-letter abbreviation of the state or province of the address. - `neighborhood` string — The district or city division of the address. The neighborhood should be provided if used in a country’s official postal addresses. Examples of this include the Colonia in Mexico or Bairro in Brazil. - `latitude` number, float — The latitude coordinates of the address. - `longitude` number, float — The longitude coordinates of the address. - `id` string — unique ID, is required in case of multiple shipping addresses. - `payment_details` PaymentDetails[] — The payment details associated with this customer. Should be passed as an array of nested payment_details objects. In cases where several payment methods are sent in the array, the first payment method shall correspond to the first billing address, etc. - union - CreditCardPaymentDetailsPreAuth - `payment_type` 'card', required — Indicates the type of payment. - `credit_card_bin` string, required — The issuer identification number (IIN), formerly known as bank identification number (BIN) of the customer's credit card. Made up of the first 6 or 8 digits of the credit card number (per value received from the Payment Service Providers/tokenization response). - `credit_card_company` string — **(Conditional Requirement)** Required for PSD2 Optimization implementation. The company who issued the customer's credit card - `credit_card_number` string, required — The credit card number, with leading digits redacted with Xs (only the last four digits are not hidden) - `credit_card_country` string — **(Conditional Requirement)** Required for PSD2 Optimization implementation. The issuer 2 letter country code. These codes are used to identify the country name - `credit_card_token` string — The token returned from the credit card company - `cardholder_name` string — Name of the cardholder - `mid` string — The merchant account id at the payment gateway - `id` string — A unique identifier of the payment detail object within the array of payment details. When this is not provided, a default running number will be attached to each element in the payment details array. - `stored_payment_created_at` string, date-time — **(Conditional Requirement)** Required for CVV recommendations. Date and time (ISO8601) when the payment method was saved to the customer's account - `stored_payment_updated_at` string, date-time — **(Conditional Requirement)** Required for CVV recommendations. Most recent date and time (ISO8601) when the saved payment method was updated by the customer - `installments` integer — **(Conditional Requirement)** Required for merchants residing in Brazil Number of payment installments - `acquirer_bin` string — The acquirer identification number (IIN), formerly known as bank identification number (BIN) of the merchant's acquirer - `acquirer_region` 'NONEU' | 'EU' — **(Conditional Requirement)** Required for PSD2 Optimization implementation. - `expiry_month` integer — The payment expiration month. - `expiry_year` integer — The payment expiration year; a 4-digit integer formatted as YYYY - `initial_payment_amount` number, float — The initial amount paid. - `payment_frequency` integer — The frequency of payments made. - `billing_address_id` string — **(Conditional Requirement)** Unique ID, is required in case of multiple billing addresses. - PaypalPaymentDetailsDetailsPreAuth - `payment_type` 'paypal', required — Indicates the type of payment. - `payer_email` string, required — The payer email assigned to his paypal account as received from paypal - `mid` string — The merchant account id at the payment gateway - `id` string — A unique identifier of the payment detail object within the array of payment details. When this is not provided, a default running number will be attached to each element in the payment details array. - `acquirer_bin` string — The acquirer identification number (IIN), formerly known as bank identification number (BIN) of the merchant's acquirer - BankWirePaymentDetails - `payment_type` 'bank_transfer', required — Indicates the type of payment. - `account_number` string, required — The full account number - `routing_number` string, required — The routing number (ABA) of the customer's bank - `token` string — **(Conditional Requirement)** Required for Plaid Partner integration. The Plaid processor_token value created by calling /processor/token/create. Please see further documentation for Plaid integration. - `account_balance` AccountBalance — An object containing account balance information as provided by the Payment Service Provider or bank. If provided, this object should contain all required fields. - `available_balance` integer, required — The amount in the customer’s bank account. - `service_name` 'plaid' | 'mx' | 'stripe' | 'truelayer' | 'klarna' | 'visa' | 'mastercard' | 'yodlee', required — The service used to complete the transaction and to request the bank account balance. - `updated_at` string, date-time, required — The date and time (ISO8601) when the account balance was queried. - `currency_code` string, required — The three letter code (ISO 4217) for the currency of the account balance. - `account_identity` AccountIdentity — An object containing identity information about the purchasing customer as provided by the Payment Service Provider or bank. - `names` string[] — A list of names associated with the bank account. - `addresses` AccountIdentityAddress[] — A list of addresses associated with the customer bank account. - `address1` string — The street name of the address. - `city` string — The city of the address. - `province_code` string — The two-letter ISO 3166-2 alpha-2 code for the state or province of the address. - `zip` string — The zip or postal code of the address. - `country_code` string — The 2 letter country code (ISO 3166-1 alpha-2) of the country address. - `phone_numbers` string[] — A list of phone numbers associated with the customer bank account. - `emails` string[] — A list of emails associated with the customer bank account. - DigitalWalletsPaymentDetails - `payment_type` 'apple_pay' | 'google_pay' | 'samsung_pay' | 'wechat_pay' | 'amazon_pay' | 'alipay', required — Indicates the type of payment. - `credit_card_bin` string — The issuer identification number (IIN), formerly known as bank identification number (BIN) of the customer's credit card. Made up of the first 6 or 8 digits of the credit card number (per value received from the Payment Service Providers/tokenization response). - `credit_card_company` string — **(Conditional Requirement)** Required for PSD2 Optimization implementation. The company who issued the customer's credit card - `credit_card_number` string — The credit card number, with leading digits redacted with Xs (only the last four digits are not hidden) - `credit_card_country` string — **(Conditional Requirement)** Required for PSD2 Optimization implementation. The issuer 2 letter country code. These codes are used to identify the country name - `credit_card_token` string — The token returned from the credit card company - `cardholder_name` string — Name of the cardholder - `mid` string — The merchant account id at the payment gateway - `id` string — A unique identifier of the payment detail object within the array of payment details. When this is not provided, a default running number will be attached to each element in the payment details array. - `stored_payment_created_at` string, date-time — **(Conditional Requirement)** Required for CVV recommendations. Date and time (ISO8601) when the payment method was saved to the customer's account - `stored_payment_updated_at` string, date-time — **(Conditional Requirement)** Required for CVV recommendations. Most recent date and time (ISO8601) when the saved payment method was updated by the customer - `installments` integer — **(Conditional Requirement)** Required for merchants residing in Brazil Number of payment installments - `acquirer_bin` string — The acquirer identification number (IIN), formerly known as bank identification number (BIN) of the merchant's acquirer - `acquirer_region` 'NONEU' | 'EU' — **(Conditional Requirement)** Required for PSD2 Optimization implementation. - `expiry_month` integer — The payment expiration month. - `expiry_year` integer — The payment expiration year; a 4-digit integer formatted as YYYY - `initial_payment_amount` number, float — The initial amount paid. - `payment_frequency` integer — The frequency of payments made. - `billing_address_id` string — **(Conditional Requirement)** Unique ID, is required in case of multiple billing addresses. - BuyNowPayLaterPaymentDetails - `payment_type` 'bnpl', required — Indicates the type of payment. - `payment_frequency` integer — Number of days between each payment. - `initial_payment_amount` number, float — Dollar amount of the first installment. - `installments` integer — Number of payment installments. - NonChbPaymentDetails - `payment_type` 'gift_card' | 'store_credit' | 'rewards_points', required — Indicates the type of payment. - `billing_address` Address - `first_name` string, required — The first name of the person associated with the address. - `last_name` string, required — The last name of the person associated with the address. - `address1` string, required — The street name of the address. - `country` string, required — The name of the country address. - `country_code` string, required — The 2 letter country code (ISO 3166-1 alpha-2) of the country address - `phone` string, required — The phone number at the address. - `city` string, required — The city of the address. - `zip` string, required — The zip or postal code of the address. - `address2` string — An optional additional field for the street address. - `company` string — Required if the address is associated to a company. The company of the person associated with the address. - `additional_phone` string — Additional phone number at the address. - `verified_phone` boolean — Indicates whether the provided phone number was verified. - `province` string, required — The name of the state or province of the address. - `province_code` string — The two-letter abbreviation of the state or province of the address. - `neighborhood` string — The district or city division of the address. The neighborhood should be provided if used in a country’s official postal addresses. Examples of this include the Colonia in Mexico or Bairro in Brazil. - `latitude` number, float — The latitude coordinates of the address. - `longitude` number, float — The longitude coordinates of the address. - `id` string — unique ID, is required in case of multiple shipping addresses. - `shipping_address` Address - `first_name` string, required — The first name of the person associated with the address. - `last_name` string, required — The last name of the person associated with the address. - `address1` string, required — The street name of the address. - `country` string, required — The name of the country address. - `country_code` string, required — The 2 letter country code (ISO 3166-1 alpha-2) of the country address - `phone` string, required — The phone number at the address. - `city` string, required — The city of the address. - `zip` string, required — The zip or postal code of the address. - `address2` string — An optional additional field for the street address. - `company` string — Required if the address is associated to a company. The company of the person associated with the address. - `additional_phone` string — Additional phone number at the address. - `verified_phone` boolean — Indicates whether the provided phone number was verified. - `province` string, required — The name of the state or province of the address. - `province_code` string — The two-letter abbreviation of the state or province of the address. - `neighborhood` string — The district or city division of the address. The neighborhood should be provided if used in a country’s official postal addresses. Examples of this include the Colonia in Mexico or Bairro in Brazil. - `latitude` number, float — The latitude coordinates of the address. - `longitude` number, float — The longitude coordinates of the address. - `id` string — unique ID, is required in case of multiple shipping addresses. - `vendor_name` string — The name of the affiliated partner or selling vendor. - `created_at` string, date-time — **(Conditional Requirement)** Required if you need fraud review analysis at account creation. Date and time (ISO8601) when the customer account is created at merchant. Please also set `api-version=2` in a header to enable fraud review analysis. ## Response `200` Successful operation - CustomerCreateResponse — The response to the customer create action request. - `customer_create_id` string, required — Riskified ID of the created customer. - `decision` 'allow' | 'block', required — The decision made by Riskified regarding the customer creation process. **Possible values:** - `allow`: Customer creation is approved - `block`: Customer creation should be blocked **Note:** "allow"/"block" response controlled by threshold set for `/customer_create` (threshold is applied to both sandbox and production). - `decision_reason` 'multiple_accounts' | 'suspicious_account' — The reason of the decision made by Riskified regarding the customer creation process. ## Other responses - `400` — Bad request - `401` — Unauthorized - `404` — Not found - `429` — Too many requests - `500` — Contact Riskified support - `504` — Temporary error, please retry --- [API](https://skmtc.dev/riskified/apis/chargeback-guarantee.md) · [All operations](https://skmtc.dev/riskified/apis/chargeback-guarantee/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/riskified/chargeback-guarantee/revisions/2b7df5bce861/schema)