---
title: "Trigger action event"
method: POST
path: "/action/trigger-action"
---

# Trigger action event

`POST /action/trigger-action`

Report a client action event that occurs in an SDK session.

## Query parameters

- `get_recommendation` boolean

## Request body

- union
  - TriggerActionWithSessionToken
    - `session_token` string, required — A token returned by the SDK for the device session established upon SDK initialization.
    - `action_type` string, required — The action type
    - `user_id` string — Opaque identifier of the authenticated user in your system. Rejected (400) if provided as "null", "undefined", "none", or empty/whitespace-only; leading/trailing whitespace is otherwise trimmed.
    - `claimed_user_id_type` 'email' | 'phone_number' | 'account_id' | 'ssn' | 'national_id' | 'passport_number' | 'drivers_license_number' | 'other' — Specifies the type of value provided in the claimed_user_id field. This field is especially important when claimed_user_id contains a hashed value, as it clarifies the original data type used.
    - `claimed_user_id` string — User identifier of the not yet authenticated user, used to enhance risk and trust assessments. This field should not contain sensitive data in plain text. Once the user has authenticated, to set the user, report the action result via API call or call 'setAuthenticatedUser' from the client SDK. Rejected (400) if provided as "null", "undefined", "none", or empty/whitespace-only; leading/trailing whitespace is otherwise trimmed.
    - `auth_context` object — Adds authentication context for users who were already authenticated **outside the current Fraud Prevention flow** before this action was triggered (for example, on another site or through an external identity provider). Providing `auth_context` sets the user for this action and uses the same user for all subsequent events in the device session, just as reporting a successful login with `user_id` via [Report action result](/openapi/risk/client-actions.openapi/other/reportactionresult) does. The `auth_context.user_id` takes precedence over both the user already associated with the device session and the deprecated top-level `user_id`. An empty object (`{}`) is treated as if `auth_context` was not provided.
      - `user_id` string, required — Opaque identifier of the authenticated user in your system. Required whenever `auth_context` is provided, because its presence indicates that the user was already authenticated outside the current Fraud Prevention flow. Before validation, leading and trailing whitespace is trimmed. The value is rejected (400) if it is "null", "undefined", "none", empty, contains only whitespace, or doesn't match the user ID format configured for your tenant.
      - `login_timestamp` number — Unix timestamp (in milliseconds) of when the login happened
      - `challenge_type` 'sms_otp' | 'email_otp' | 'totp' | 'push_otp' | 'voice_otp' | 'idv' | 'captcha' | 'password' | 'passkey' — The challenge type used for the authentication action
      - `failed_attempts` integer — The number of failed attempts for the authentication action
      - `auth_method_type` 'password' | 'webauthn' | 'totp' | 'email_otp' | 'sms_otp' | 'direct_otp' | 'voice_otp' | 'push_otp' | 'idv' | 'email_magic_link' | 'mobile_biometric' | 'face' | 'pin_authenticator' | 'google' | 'facebook' | 'apple' | 'line' | 'saml' | 'oidc' — The authentication method used for the authentication action
      - `login_origin` string — The origin the user logged in from. For web, the URL of the login page (for example, `https://example.com/login`). For mobile, the app bundle or package identifier (for example, `com.example.myapp`).
    - `correlation_id` string — Any ID that could help relate the action with external context or session
    - `transaction_data` object — Transaction data-points given in the relevant action
      - `type` 'purchase' | 'bill_payment' | 'mobile_recharge' | 'money_transfer' | 'credit_transfer' | 'credit_redemption' | 'top_up' | 'withdrawal' | 'investment' | 'loan' | 'refund' | 'other' — Type of transaction
      - `method` 'bank_account' | 'wire' | 'card' | 'p2p' | 'wallet' — Method used for the transaction
      - `reason` string — The reason for the transaction
      - `amount` number — The monetary amount of the transaction. The backend sanitizes this value with parseFloat; it must be strictly positive and ≤ 999,999,999.99
      - `currency` string — The transaction currency (ISO-4217)
      - `payer` object — The provided data points for the transaction payer
        - `name` string — Payer/Payee name
        - `bankIdentifier` string — Bank identifier
        - `branchIdentifier` string — Branch identifier
        - `accountNumber` string — Account number
        - `accountId` string — Unique identifier for the account
        - `accountCountryCode` string — Country code of the account (ISO-3166-1 alpha-2)
        - `card` object — Credit card details if applicable
          - `holderName` string — Name of the card holder
          - `bin` string — Bank Identification Number (first 6 digits of card)
          - `last4` string — Last 4 digits of the credit card number
        - `billingInfo` object — Billing address details
          - `name` string — Full name
          - `addressLine1` string — Address line 1
          - `addressLine2` string — Address line 2
          - `city` string — City
          - `state` string — State/Province/Region
          - `zipPostalCode` string — ZIP or postal code
          - `country` string — Country code (ISO-3166-1 alpha-2)
          - `email` string — Email address
          - `phone` string — Phone number
        - `customerTier` string — Customer tier
      - `payee` object — The provided data points for the transaction payee
        - `name` string — Payer/Payee name
        - `bankIdentifier` string — Bank identifier
        - `branchIdentifier` string — Branch identifier
        - `accountNumber` string — Account number
        - `accountId` string — Unique identifier for the account
        - `accountCountryCode` string — Country code of the account (ISO-3166-1 alpha-2)
        - `card` object — Credit card details if applicable
          - `holderName` string — Name of the card holder
          - `bin` string — Bank Identification Number (first 6 digits of card)
          - `last4` string — Last 4 digits of the credit card number
      - `channelId` string — Identifier for the channel used for the transaction
      - `transactionDate` number — The transaction timestamp (Unix epoch in milliseconds or seconds). Must be a non-negative integer.
      - `purchase` object — Details about the purchase, if applicable
        - `totalItems` number — Total number of items in the purchase
        - `products` object[] — List of products in the purchase
          - `id` string — Unique identifier for the product
          - `name` string — Name of the product
          - `amount` number — Amount of the product
          - `price` number — Price of the product
        - `shippingInfo` object — Shipping address details
          - `name` string — Full name
          - `addressLine1` string — Address line 1
          - `addressLine2` string — Address line 2
          - `city` string — City
          - `state` string — State/Province/Region
          - `zipPostalCode` string — ZIP or postal code
          - `country` string — Country code (ISO-3166-1 alpha-2)
          - `email` string — Email address
          - `phone` string — Phone number
      - `avs` object — Address Verification System (AVS) results
        - `code` string — AVS response code
        - `provider` string — AVS provider name
        - `matchLevel` 'none' | 'postal' | 'street' | 'full' | 'unknown' — AVS match level
    - `custom_attributes` object — Custom attributes add context to an action but must match the schema defined in the Portal. Invalid attributes are ignored.
  - TriggerActionWithSecureSessionToken
    - `secured_session_token` string, required — A cryptographically signed token returned by the SDK's `getSecureSessionToken()` method. Provides enhanced security through device binding and anti-replay protection. Recommended for high-risk actions. Make sure to use the secure session token that matches the action type. Otherwise, the request will fail with 403 "Action type mismatch" error.
    - `action_type` string, required — The action type
    - `user_id` string — Opaque identifier of the authenticated user in your system. Rejected (400) if provided as "null", "undefined", "none", or empty/whitespace-only; leading/trailing whitespace is otherwise trimmed.
    - `claimed_user_id_type` 'email' | 'phone_number' | 'account_id' | 'ssn' | 'national_id' | 'passport_number' | 'drivers_license_number' | 'other' — Specifies the type of value provided in the claimed_user_id field. This field is especially important when claimed_user_id contains a hashed value, as it clarifies the original data type used.
    - `claimed_user_id` string — User identifier of the not yet authenticated user, used to enhance risk and trust assessments. This field should not contain sensitive data in plain text. Once the user has authenticated, to set the user, report the action result via API call or call 'setAuthenticatedUser' from the client SDK. Rejected (400) if provided as "null", "undefined", "none", or empty/whitespace-only; leading/trailing whitespace is otherwise trimmed.
    - `auth_context` object — Adds authentication context for users who were already authenticated **outside the current Fraud Prevention flow** before this action was triggered (for example, on another site or through an external identity provider). Providing `auth_context` sets the user for this action and uses the same user for all subsequent events in the device session, just as reporting a successful login with `user_id` via [Report action result](/openapi/risk/client-actions.openapi/other/reportactionresult) does. The `auth_context.user_id` takes precedence over both the user already associated with the device session and the deprecated top-level `user_id`. An empty object (`{}`) is treated as if `auth_context` was not provided.
      - `user_id` string, required — Opaque identifier of the authenticated user in your system. Required whenever `auth_context` is provided, because its presence indicates that the user was already authenticated outside the current Fraud Prevention flow. Before validation, leading and trailing whitespace is trimmed. The value is rejected (400) if it is "null", "undefined", "none", empty, contains only whitespace, or doesn't match the user ID format configured for your tenant.
      - `login_timestamp` number — Unix timestamp (in milliseconds) of when the login happened
      - `challenge_type` 'sms_otp' | 'email_otp' | 'totp' | 'push_otp' | 'voice_otp' | 'idv' | 'captcha' | 'password' | 'passkey' — The challenge type used for the authentication action
      - `failed_attempts` integer — The number of failed attempts for the authentication action
      - `auth_method_type` 'password' | 'webauthn' | 'totp' | 'email_otp' | 'sms_otp' | 'direct_otp' | 'voice_otp' | 'push_otp' | 'idv' | 'email_magic_link' | 'mobile_biometric' | 'face' | 'pin_authenticator' | 'google' | 'facebook' | 'apple' | 'line' | 'saml' | 'oidc' — The authentication method used for the authentication action
      - `login_origin` string — The origin the user logged in from. For web, the URL of the login page (for example, `https://example.com/login`). For mobile, the app bundle or package identifier (for example, `com.example.myapp`).
    - `correlation_id` string — Any ID that could help relate the action with external context or session
    - `transaction_data` object — Transaction data-points given in the relevant action
      - `type` 'purchase' | 'bill_payment' | 'mobile_recharge' | 'money_transfer' | 'credit_transfer' | 'credit_redemption' | 'top_up' | 'withdrawal' | 'investment' | 'loan' | 'refund' | 'other' — Type of transaction
      - `method` 'bank_account' | 'wire' | 'card' | 'p2p' | 'wallet' — Method used for the transaction
      - `reason` string — The reason for the transaction
      - `amount` number — The monetary amount of the transaction. The backend sanitizes this value with parseFloat; it must be strictly positive and ≤ 999,999,999.99
      - `currency` string — The transaction currency (ISO-4217)
      - `payer` object — The provided data points for the transaction payer
        - `name` string — Payer/Payee name
        - `bankIdentifier` string — Bank identifier
        - `branchIdentifier` string — Branch identifier
        - `accountNumber` string — Account number
        - `accountId` string — Unique identifier for the account
        - `accountCountryCode` string — Country code of the account (ISO-3166-1 alpha-2)
        - `card` object — Credit card details if applicable
          - `holderName` string — Name of the card holder
          - `bin` string — Bank Identification Number (first 6 digits of card)
          - `last4` string — Last 4 digits of the credit card number
        - `billingInfo` object — Billing address details
          - `name` string — Full name
          - `addressLine1` string — Address line 1
          - `addressLine2` string — Address line 2
          - `city` string — City
          - `state` string — State/Province/Region
          - `zipPostalCode` string — ZIP or postal code
          - `country` string — Country code (ISO-3166-1 alpha-2)
          - `email` string — Email address
          - `phone` string — Phone number
        - `customerTier` string — Customer tier
      - `payee` object — The provided data points for the transaction payee
        - `name` string — Payer/Payee name
        - `bankIdentifier` string — Bank identifier
        - `branchIdentifier` string — Branch identifier
        - `accountNumber` string — Account number
        - `accountId` string — Unique identifier for the account
        - `accountCountryCode` string — Country code of the account (ISO-3166-1 alpha-2)
        - `card` object — Credit card details if applicable
          - `holderName` string — Name of the card holder
          - `bin` string — Bank Identification Number (first 6 digits of card)
          - `last4` string — Last 4 digits of the credit card number
      - `channelId` string — Identifier for the channel used for the transaction
      - `transactionDate` number — The transaction timestamp (Unix epoch in milliseconds or seconds). Must be a non-negative integer.
      - `purchase` object — Details about the purchase, if applicable
        - `totalItems` number — Total number of items in the purchase
        - `products` object[] — List of products in the purchase
          - `id` string — Unique identifier for the product
          - `name` string — Name of the product
          - `amount` number — Amount of the product
          - `price` number — Price of the product
        - `shippingInfo` object — Shipping address details
          - `name` string — Full name
          - `addressLine1` string — Address line 1
          - `addressLine2` string — Address line 2
          - `city` string — City
          - `state` string — State/Province/Region
          - `zipPostalCode` string — ZIP or postal code
          - `country` string — Country code (ISO-3166-1 alpha-2)
          - `email` string — Email address
          - `phone` string — Phone number
      - `avs` object — Address Verification System (AVS) results
        - `code` string — AVS response code
        - `provider` string — AVS provider name
        - `matchLevel` 'none' | 'postal' | 'street' | 'full' | 'unknown' — AVS match level
    - `custom_attributes` object — Custom attributes add context to an action but must match the schema defined in the Portal. Invalid attributes are ignored.

## Response `201`

Trigger action has been received and stored successfully. The response also contains a recommendation, if requested.

- object
  - `action_token` string, required
  - `recommendation` RecommendationFull — Recommendation
    - `id` string, required — Recommendation identifier
    - `issued_at` number, required — Unix epoch time in milliseconds this recommendation was issued at
    - `recommendation` Recommendation, required — Decision the engine produced for the action.
      - `type` 'ALLOW' | 'CHALLENGE' | 'DENY' | 'TRUST', required — Recommendation type.
      - `result` 'success' | 'failure' | 'incomplete' — The outcome of the action.
      - `challenge_type` 'sms_otp' | 'email_otp' | 'totp' | 'push_otp' | 'voice_otp' | 'idv' | 'captcha' | 'invisible_captcha' | 'password' | 'passkey' — The type of challenge enforced for the reported action.
    - `risk_score` number, required — Used to assess the risk level of the action.
    - `context` object, required — Identifies the context in which the action occurred.
      - `action_id` string, required — Identifier of the client action.
      - `action_type` string, required — Type of client action this recommendation was issued for.
      - `action_performed_at` integer, required — Unix epoch time in milliseconds the action event was reported.
      - `device_timestamp` integer — Unix epoch timestamp (ms) from the device clock when the action is triggered via `triggerActionEvent()`. For backend-triggered actions, uses the server time. Used to correlate client and server events.
      - `client_id` string — Identifies the client associated with the action.
      - `application_id` string, required — Identifies the application associated with the action.
      - `tenant_id` string — Identifies your tenant within Transmit.
      - `device_id` string, required — Unique device identifier generated by Transmit Security and stored by the SDK. On web, stored in the cookie. On mobile, uses platform-provided identifiers such as Android ID (hex string) or iOS `identifierForVendor` (alphanumeric). Not derived from IMEI or other hardware identifiers.
      - `correlation_id` string — Any ID that could help relate the action with external context or session (if set via `triggerActionEvent()` SDK calls).
      - `device_fingerprint` string, required — Hash value on all the device data collected from the browser.
      - `device_public_key` string — A unique and persistent identifier derived from cryptographic binding.
      - `user_id` string — Opaque identifier of the user in your system (if set via `setAuthenticatedUser()` or `init()` SDK calls).
      - `claimed_user_id` string — User ID of the not-yet-authenticated user, used to enhance risk and trust assessments. Once the user is authenticated, `setAuthenticatedUser()` should be called.
      - `location` string — The place in the application in which the action was performed (such as the page URL).
      - `ip` string, ipv4 — IP address.
      - `ip_country` string — Country code, specified in a two-letter format (ISO 3166-1 alpha-2).
      - `ip_location_region` string — Location region identified by IP address.
      - `ip_domain` string — Domain name resolved from IP address.
      - `ip_location_city` string — Location city identified by IP address.
      - `ip_location_zip` string — Location ZIP code identified by IP address.
      - `ip_location_longitude` string — Geolocation longitude identified by IP address.
      - `ip_location_latitude` string — Geolocation latitude identified by IP address.
      - `ip_asn_id` string — Globally unique identifier that defines a group of one or more IP prefixes.
      - `ip_asn_name` string — ASN name of the IP address.
      - `ip_organization_name` string — IP organization name.
      - `ip_organization_type` string — Type of IP connection (for example, `isp`, `hosting`, `business`).
      - `ip_location_timezone` string — Timezone location identified by IP address.
      - `device_timezone` string — Timezone on device.
      - `device_languages` string[] — Languages on device.
      - `device_platform` string — Type of device platform.
      - `os_name` string — Name of the operating system.
      - `os_version` string — Operating system version.
      - `browser_name` string — Name of the browser.
      - `browser_version` string — Browser major version.
      - `user_agent` string — User agent string.
    - `risk_signals` RiskSignals — Additional informative signals derived from the action.
      - `device` object — Device-relevant signals.
        - `ram` number — Device memory, a floating-point number.
        - `total_storage` number — Device total storage, as received from the mobile native platform.
        - `available_storage` number — Device available storage, as received from the mobile native platform.
        - `battery_level` number — Device battery level, a floating-point number.
        - `device_power_state` string — Indicates if the device is currently plugged into a power source.
        - `core_number` number — Device core number.
        - `graphic_card` string — Device graphics card, as received from the web platform.
        - `model` string — Device model.
        - `screen_width` number — Device screen width in pixels.
        - `screen_height` number — Device screen height in pixels.
        - `screen_pixel_depth` number — Pixel depth of the device screen.
        - `screen_color_depth` number — Color depth of the device screen.
        - `screen_avail_width` number — Available width of the screen.
        - `screen_avail_height` number — Available height of the screen.
        - `incognito` boolean — Whether the event was performed using incognito browsing.
        - `tampered` boolean — Whether the device is tampered (root or jailbreak).
        - `emulated` boolean — Whether the device is emulated.
        - `spoofed` boolean — Whether the device is spoofed.
        - `tz_mismatch` boolean — Whether the event was performed on a device with a timezone mismatching expected.
        - `esim_usage` boolean — Whether the event was performed using eSIM.
        - `accept_languages` string — Value of the `accept-language` header at the action request.
        - `mobile_network_code` string — String representation of the device's mobile carrier MCC and MNC.
        - `font_count` number — Number of fonts available on the device.
        - `cpu_arch` string — Device CPU architecture.
        - `navigator_useragent` string — User agent string from the device's browser navigator.
        - `true_useragent` string — User agent string reconstructed by the SDK, providing details about the browser, OS, and device.
        - `device_timezone_offset` number — Timezone offset of the device, in minutes from UTC.
        - `summer_timezone_offset` number — Device's timezone offset in minutes from UTC during daylight saving time.
        - `winter_timezone_offset` number — Device's timezone offset in minutes from UTC during standard time.
        - `device_name` string — Device's name as recorded on iOS, reflecting the user-set name.
      - `network` object — Network-relevant signals.
        - `vpn` boolean — Whether the event was performed using a VPN connection.
        - `tor` boolean — Whether the event was performed using a Tor connection.
        - `hosting` boolean — Whether the event was performed from a hosting provider.
        - `proxy` boolean — Whether the event was performed via a proxy.
        - `anonymizer` boolean — Whether the event was performed via an anonymizer.
        - `x_forwarded_for` string[] — The `X-Forwarded-For` header value, indicating the chain of intermediate proxies.
      - `behavior` object — User-behavior-relevant signals.
        - `typing_velocity` number — Percentile of user typing speed.
        - `movement_velocity` number — Number of input events per second.
        - `input_method` string[] — A list of used input methods. | Value | Description | Platform | |---|---|---| | `is_typing` | Standard character-by-character keyboard text entry. | Web, Mobile | | `is_paste` | Content inserted via paste (e.g. Ctrl/Cmd+V or context-menu paste). | Web, Mobile | | `is_autocomplete` | Value entered via an OS/keyboard autocomplete or autofill suggestion. | Mobile | | `is_password_manager` | Value populated by a password manager / browser autofill. | Web | | `is_insert_replacement_text` | Existing text replaced with a suggested value (e.g. spell-check/autocorrect or autofill replacement). | Web | | `is_insert_composition` | Text inserted from an in-progress IME composition (e.g. while composing CJK characters). | Web | | `is_insert_from_composition` | Text committed (finalized) from an IME composition. | Web | | `is_insert_line_break` | A line break was inserted (e.g. Shift+Enter). | Web | | `is_insert_from_drop` | Text inserted by dragging and dropping content into the field. | Web | | `is_delete` | A deletion occurred (generic). | Mobile | | `is_delete_content_backward` | Deletion of the character before the cursor (Backspace). | Web | | `is_delete_content_forward` | Deletion of the character after the cursor (Delete key). | Web | | `is_delete_content` | Generic content deletion where direction is unspecified. | Web | | `is_delete_word_backward` | Deletion of the word before the cursor (e.g. Ctrl/Alt+Backspace). | Web | | `is_delete_softline_backward` | Deletion to the start of the current soft-wrapped line. | Web | | `is_delete_hardline_backward` | Deletion to the start of the current line/block (hard line boundary). | Web | | `is_delete_by_cut` | Content removed via Cut (e.g. Ctrl/Cmd+X). | Web | | `is_delete_by_drag` | Content removed by dragging it out of the field. | Web | | `is_delete_composition_text` | Deletion of in-progress IME composition text. | Web | | `is_history_undo` | An undo action (e.g. Ctrl/Cmd+Z). | Web | | `is_history_redo` | A redo action (e.g. Ctrl/Cmd+Y or Shift+Ctrl/Cmd+Z). | Web |
        - `no_user_interaction` boolean — Whether there was any user interaction before clicks.
        - `straight_line_ratio` number — Ratio of straight-line movements out of all movements in the action's context.
        - `right_angels_ratio` number — Ratio of right-angle movements out of all movements in the action's context.
        - `minor_angels_ratio` number — Ratio of minor-angle movements out of all movements in the action's context.
        - `movement_latency` number — Median delay of mouse or touchscreen movements (ms) within the action's context.
        - `corner_click` boolean — Whether there were multiple clicks on the corner of a button in the action's context.
      - `history` object — User-history-relevant signals.
        - `ip_action_rate_60_sec` integer — Number of actions originating from the same client IP within 60 seconds prior to this action.
        - `user_action_rate_60_sec` integer — Number of actions with the same `user_id` within 60 seconds prior to this action.
        - `device_action_rate_60_sec` integer — Number of actions originating from the same `device_id` within 60 seconds prior to this action.
        - `ip_user_count_last_hour` integer — Number of distinct `user_id`s associated with the IP address within the previous hour.
        - `ip_device_count_last_hour` integer — Number of distinct `device_id`s associated with the IP address within the previous hour.
        - `linking_device_to_users_count` integer — Number of distinct `user_id`s associated with this `device_id`.
        - `linking_user_to_device_count` integer — Number of distinct `device_id`s associated with this `user_id`.
    - `reasons` string[], required — Reasons that contributed to the recommendation.
    - `transaction_data` TransactionData — Transaction data-points provided with the action via the SDK.
      - `amount` number — Monetary amount of the transaction. Sanitized server-side with `parseFloat`; must be strictly positive and at most 999,999,999.99.
      - `currency` string — Currency code for the transaction (ISO-4217).
      - `type` 'purchase' | 'bill_payment' | 'mobile_recharge' | 'money_transfer' | 'credit_transfer' | 'credit_redemption' | 'top_up' | 'withdrawal' | 'investment' | 'loan' | 'refund' | 'other' — Transaction type.
      - `method` 'bank_account' | 'wire' | 'card' | 'p2p' | 'wallet' — Transaction method.
      - `channelId` string — Identifier for the channel used for the transaction.
      - `reason` string — Reason for the transaction.
      - `transactionDate` integer — Transaction timestamp (Unix epoch, milliseconds or seconds).
      - `payer` TransactionPayer — Shared shape for a transaction party (payee or payer).
        - `name` string — Party's name.
        - `accountNumber` string — Party's account number.
        - `accountId` string — Unique identifier for the party's account.
        - `accountCountryCode` string — Country code of the account (ISO-3166-1 alpha-2).
        - `bankIdentifier` string — Party's bank identifier.
        - `branchIdentifier` string — Party's branch identifier.
        - `card` TransactionCard — Card-level identifiers for the party.
          - `holderName` string — Name of the card holder.
          - `bin` string — Bank Identification Number (first 6 digits of the card).
          - `last4` string — Last 4 digits of the credit card number.
      - `payee` TransactionPayee — Shared shape for a transaction party (payee or payer).
        - `name` string — Party's name.
        - `accountNumber` string — Party's account number.
        - `accountId` string — Unique identifier for the party's account.
        - `accountCountryCode` string — Country code of the account (ISO-3166-1 alpha-2).
        - `bankIdentifier` string — Party's bank identifier.
        - `branchIdentifier` string — Party's branch identifier.
        - `card` TransactionCard — Card-level identifiers for the party.
          - `holderName` string — Name of the card holder.
          - `bin` string — Bank Identification Number (first 6 digits of the card).
          - `last4` string — Last 4 digits of the credit card number.
      - `purchase` TransactionPurchase — Purchase details for the transaction.
        - `totalItems` integer — Total number of items in the purchase.
        - `products` TransactionProduct[] — Line items in the purchase.
          - `id` string — Unique identifier for the product.
          - `name` string — Name of the product.
          - `amount` integer — Quantity of this product line item.
          - `price` number — Price per unit of the product.
        - `shippingInfo` TransactionAddress — Address and contact information (used by `billingInfo` and `shippingInfo`).
          - `name` string — Full name.
          - `addressLine1` string — Address line 1.
          - `addressLine2` string — Address line 2.
          - `city` string — City.
          - `state` string — State, province, or region.
          - `zipPostalCode` string — ZIP or postal code.
          - `country` string — Country code (ISO-3166-1 alpha-2).
          - `email` string — Email address.
          - `phone` string — Phone number.
      - `avs` TransactionAvs — Address Verification Service result for the transaction.
        - `code` string — AVS response code.
        - `provider` string — AVS provider name.
        - `matchLevel` 'none' | 'postal' | 'street' | 'full' | 'unknown' — AVS match level.
    - `custom_attributes` CustomAttributes — Tenant-defined custom attributes attached to the action. These add context to an action but must match the schema defined in the Admin Portal. Invalid attributes are ignored and not included in the response.
    - `threats` string[] — List of all detected threats.
    - `preview_rule` PreviewRule — Rule configured in preview mode that would have determined this action's recommendation if all enabled rules were in production. Useful for impact analysis without changing live behavior.
      - `rule_name` string — Name of the preview rule.
      - `recommendation` 'ALLOW' | 'CHALLENGE' | 'DENY' | 'TRUST' — Recommendation the preview rule would have applied.
      - `risk_score` number — Risk score the preview rule would have applied.

## Other responses

- `400` — Bad request
- `401` — Invalid authentication
- `403` — Invalid authorization
- `429` — Rate limit reached
- `463` — Blacklisted token—Returned when Fraud Prevention detects repeated or abusive token/payload misuse within a short time window (e.g., reuse of expired tokens, token caching/automation, or repeated invalid requests, including highly repetitive invalid request values). The response body contains the underlying error code (e.g., expired session token). Clients should identify and stop the source of invalid requests. Other authorization failures that do not trigger blacklisting return 403 Forbidden.
- `500` — Internal error

## Changes

- **2026-08-10** `8adcc6e67945` — 2 info
  - added the new optional request property `oneOf[subschema #1: Using regular session token]/allOf[#/components/schemas/triggerActionBase]/auth_context`
  - added the new optional request property `oneOf[subschema #2: Using secure session token]/allOf[#/components/schemas/triggerActionBase]/auth_context`

[Change history](https://skmtc.dev/transmitsecurity/apis/client-actions/changes/action/trigger-action/post.md)

---

[API](https://skmtc.dev/transmitsecurity/apis/client-actions.md) · [All operations](https://skmtc.dev/transmitsecurity/apis/client-actions/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/transmitsecurity/client-actions/revisions/8adcc6e67945/schema)