---
title: "Set authenticated user"
method: POST
path: "/action/authenticated-user"
deprecated: true
---

# Set authenticated user

`POST /action/authenticated-user`

> **Deprecated.**

Sets the user context for a client action reported to the SDK. It should be set only after you've fully authenticated the user (including, for example, any 2FA that was required). This call is **deprecated**, set the user with [Report action result API](/openapi/risk/client-actions.openapi/other/reportactionresult).

## Request body

- Authuser
  - `user_id` string, required — Opaque identifier of the user in your system. Rejected (400) if provided as "null", "undefined", "none", or empty/whitespace-only; leading/trailing whitespace is otherwise trimmed.
  - `action_token` string, required — The token return by the SDK when the action was reported.

## Response `201`

User Auth has been received and stored successfully.

## Other responses

- `400` — Bad request
- `401` — Invalid authentication
- `403` — Invalid authorization
- `429` — Rate limit reached
- `463` — Blacklisted token—Returned when Fraud Prevention detects repeated or abusive token/payload misuse within a short time window (e.g., reuse of expired tokens, token caching/automation, or repeated invalid requests, including highly repetitive invalid request values). The response body contains the underlying error code (e.g., expired session token). Clients should identify and stop the source of invalid requests. Other authorization failures that do not trigger blacklisting return 403 Forbidden.
- `500` — Internal error

---

[API](https://skmtc.dev/transmitsecurity/apis/client-actions.md) · [All operations](https://skmtc.dev/transmitsecurity/apis/client-actions/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/transmitsecurity/client-actions/revisions/8adcc6e67945/schema)