---
title: "Send label"
method: POST
path: "/label"
---

# Send label

`POST /label`

Sends the label to our servers for analysis to improve our recommendation system.

## Request body

- Label
  - `label_type` 'CONFIRMED_FRAUD' | 'SUSPECTED_FRAUD' | 'CONFIRMED_LEGIT' | 'UNDETERMINED', required — Type of label to send, which contains additional information that helps to classify the subject as fraudulent or legitimate. The API accepts both the enum values below and the legacy values (`KNOWN_MALICIOUS`, `SUSPECTED_MALICIOUS`, `KNOWN_LEGIT`, `UNKNOWN`) for backward compatibility.
  - `subject` Subject, required — Subject of the label
    - `type` 'ACTION_ID' | 'CORRELATION_ID' | 'CAMPAIGN_ID' | 'USER_ID' | 'IP_ADDRESS' | 'VERIFICATION_SESSION_ID' | 'FRAUD_RING_ID', required — The subject type.
    - `value` string, required — The subject value
    - `recommendations` string[], nullable — For `FRAUD_RING_ID` labels only. Allows labeling actions with specific recommendation.
    - `is_campaign_confirmed` boolean, nullable — For `CAMPAIGN_ID` labels only. Defines whether or not to label actions related to the campaign.
  - `use_case` 'ACCOUNT_TAKEOVER' | 'DEVICE_TAKEOVER' | 'FIRST_PARTY_FRAUD' | 'IDENTITY_THEFT' | 'MONEY_MULE' | 'BOT_ATTACK' | 'SYNTHETIC_IDENTITY' | 'SOCIAL_ENGINEERING' | 'NEW_ACCOUNT_FRAUD' | 'CREDENTIAL_STUFFING' — Fraud scenario associated with the label. You can further classify the scenario by providing `sub_category` and, for supported scenarios, `attack_method`. For supported values and combinations, see [Specify fraud scenarios with labels](/guides/risk/label-fraud-scenarios.md).
  - `sub_category` 'PHISHING' | 'MALWARE' | 'CREDENTIAL_BREACH' | 'DEVICE_TAKEOVER' | 'SESSION_HIJACKING' | 'RECOVERY_ABUSE' | 'INVESTMENT_SCAM' | 'ROMANCE_SCAM' | 'TECH_SUPPORT_SCAM' | 'PAYMENT_SCAM' | 'IMPERSONATION_SCAM' | 'COERCION' | 'DATA_BREACH' | 'PHYSICAL_THEFT' | 'SOCIAL_ENGINEERING' | 'CHARGEBACK_FRIENDLY_FRAUD' | 'BUST_OUT_FRAUD' | 'ACCOUNT_AGING' | 'APPLICATION_KYC_FRAUD' | 'REFERRAL_ABUSE' | 'SIGNUP_BONUS_ABUSE' | 'REWARDS_MANIPULATION' | 'STOLEN_IDENTITY' | 'SYNTHETIC_IDENTITY' | 'MULE_ACCOUNT' | 'BONUS_PROMO_ABUSE' | 'OTHER' — Optional refinement of `use_case`. Valid values depend on the selected `use_case`. Do not provide this field for `MONEY_MULE` or `CREDENTIAL_STUFFING`. For supported values by use case, see [Specify fraud scenarios with labels](/guides/risk/label-fraud-scenarios.md).
  - `attack_method` 'PHISHING_EMAIL' | 'PHISHING_SMS' | 'PHISHING_VOICE' | 'PHISHING_QR' | 'KEYLOGGER' | 'TROJAN' | 'SPYWARE' | 'BROWSER_MALWARE' | 'COMBO_LIST' | 'PASSWORD_SPRAYING' | 'AUTOMATED_TESTING' | 'REMOTE_DESKTOP' | 'SCREEN_SHARING' | 'REMOTE_SHELL' | 'ROOTKIT' | 'MITM' | 'TOKEN_THEFT_XSS' | 'TOKEN_THEFT_MALWARE' | 'SESSION_FIXATION' | 'PHISHING_RECOVERY' | 'HELPDESK_SOCENG' | 'FLOW_EXPLOITATION' | 'PHONE' | 'SOCIAL_MEDIA' | 'FAKE_PLATFORM' | 'DATING_APP' | 'MESSAGING_APP' | 'FAKE_POPUP' | 'COLD_CALL' | 'EMAIL' | 'FAKE_INVOICE' | 'IMPERSONATION' | 'URGENT_TRANSFER' | 'BANK' | 'GOVERNMENT' | 'FAMILY_EMERGENCY' | 'INPERSON' | 'LIVE_PHONE' | 'DATA_BREACH' | 'PHYSICAL_THEFT' | 'SOCIAL_ENGINEERING' | 'PHISHING' | 'PHYSICAL_DOC_THEFT' | 'DOCUMENT_FABRICATION' | 'DATA_COMBINATION' | 'AI_GENERATED' | 'JOB_SCAM_RECRUITMENT' | 'ROMANCE_RECRUITMENT' | 'NETWORK_RECRUITMENT' | 'MULTI_ACCOUNT' | 'BOT_AUTOMATION' | 'JOB_SCAM' | 'ROMANCE_SCAM' | 'INVESTMENT_SCAM' | 'SELF_RECRUITED' | 'COERCED' | 'UNKNOWN' | 'OTHER' — Optional attack method associated with the label. Valid values depend on the selected `sub_category`, or directly on `use_case` for `MONEY_MULE` and `CREDENTIAL_STUFFING`. Do not provide this field for `FIRST_PARTY_FRAUD`. For supported values and combinations, see [Specify fraud scenarios with labels](/guides/risk/label-fraud-scenarios.md).
  - `source` 'MANUAL_REVIEW' | 'CUSTOMER_COMPLAINTS' | 'CHARGEBACKS' | 'OTHER_VENDORS' | 'AUTOMATED_DETECTION' | 'LAW_ENFORCEMENT' — Source of the information used to assign the label, such as manual review, customer complaints, chargebacks, another fraud system, automated detection, or law enforcement. For supported values and definitions, see [Specify fraud scenarios with labels](/guides/risk/label-fraud-scenarios.md).

## Response `201`

Label has been received and stored successfully.

- LabelSuccessResponse
  - `message` string, required
  - `label_id` string, required — ID of the saved label
  - `label` object, required
    - `label_id` string — ID of the saved label
    - `label_type` 'CONFIRMED_FRAUD' | 'SUSPECTED_FRAUD' | 'CONFIRMED_LEGIT' | 'UNDETERMINED', required — Type of label to send, which contains additional information that helps to classify the subject as fraudulent or legitimate. The API accepts both the enum values below and the legacy values (`KNOWN_MALICIOUS`, `SUSPECTED_MALICIOUS`, `KNOWN_LEGIT`, `UNKNOWN`) for backward compatibility.
    - `subject` Subject, required — Subject of the label
      - `type` 'ACTION_ID' | 'CORRELATION_ID' | 'CAMPAIGN_ID' | 'USER_ID' | 'IP_ADDRESS' | 'VERIFICATION_SESSION_ID' | 'FRAUD_RING_ID', required — The subject type.
      - `value` string, required — The subject value
      - `recommendations` string[], nullable — For `FRAUD_RING_ID` labels only. Allows labeling actions with specific recommendation.
      - `is_campaign_confirmed` boolean, nullable — For `CAMPAIGN_ID` labels only. Defines whether or not to label actions related to the campaign.
    - `use_case` 'ACCOUNT_TAKEOVER' | 'DEVICE_TAKEOVER' | 'FIRST_PARTY_FRAUD' | 'IDENTITY_THEFT' | 'MONEY_MULE' | 'BOT_ATTACK' | 'SYNTHETIC_IDENTITY' | 'SOCIAL_ENGINEERING' | 'NEW_ACCOUNT_FRAUD' | 'CREDENTIAL_STUFFING' — Fraud scenario associated with the label. You can further classify the scenario by providing `sub_category` and, for supported scenarios, `attack_method`. For supported values and combinations, see [Specify fraud scenarios with labels](/guides/risk/label-fraud-scenarios.md).
    - `sub_category` 'PHISHING' | 'MALWARE' | 'CREDENTIAL_BREACH' | 'DEVICE_TAKEOVER' | 'SESSION_HIJACKING' | 'RECOVERY_ABUSE' | 'INVESTMENT_SCAM' | 'ROMANCE_SCAM' | 'TECH_SUPPORT_SCAM' | 'PAYMENT_SCAM' | 'IMPERSONATION_SCAM' | 'COERCION' | 'DATA_BREACH' | 'PHYSICAL_THEFT' | 'SOCIAL_ENGINEERING' | 'CHARGEBACK_FRIENDLY_FRAUD' | 'BUST_OUT_FRAUD' | 'ACCOUNT_AGING' | 'APPLICATION_KYC_FRAUD' | 'REFERRAL_ABUSE' | 'SIGNUP_BONUS_ABUSE' | 'REWARDS_MANIPULATION' | 'STOLEN_IDENTITY' | 'SYNTHETIC_IDENTITY' | 'MULE_ACCOUNT' | 'BONUS_PROMO_ABUSE' | 'OTHER' — Optional refinement of `use_case`. Valid values depend on the selected `use_case`. Do not provide this field for `MONEY_MULE` or `CREDENTIAL_STUFFING`. For supported values by use case, see [Specify fraud scenarios with labels](/guides/risk/label-fraud-scenarios.md).
    - `attack_method` 'PHISHING_EMAIL' | 'PHISHING_SMS' | 'PHISHING_VOICE' | 'PHISHING_QR' | 'KEYLOGGER' | 'TROJAN' | 'SPYWARE' | 'BROWSER_MALWARE' | 'COMBO_LIST' | 'PASSWORD_SPRAYING' | 'AUTOMATED_TESTING' | 'REMOTE_DESKTOP' | 'SCREEN_SHARING' | 'REMOTE_SHELL' | 'ROOTKIT' | 'MITM' | 'TOKEN_THEFT_XSS' | 'TOKEN_THEFT_MALWARE' | 'SESSION_FIXATION' | 'PHISHING_RECOVERY' | 'HELPDESK_SOCENG' | 'FLOW_EXPLOITATION' | 'PHONE' | 'SOCIAL_MEDIA' | 'FAKE_PLATFORM' | 'DATING_APP' | 'MESSAGING_APP' | 'FAKE_POPUP' | 'COLD_CALL' | 'EMAIL' | 'FAKE_INVOICE' | 'IMPERSONATION' | 'URGENT_TRANSFER' | 'BANK' | 'GOVERNMENT' | 'FAMILY_EMERGENCY' | 'INPERSON' | 'LIVE_PHONE' | 'DATA_BREACH' | 'PHYSICAL_THEFT' | 'SOCIAL_ENGINEERING' | 'PHISHING' | 'PHYSICAL_DOC_THEFT' | 'DOCUMENT_FABRICATION' | 'DATA_COMBINATION' | 'AI_GENERATED' | 'JOB_SCAM_RECRUITMENT' | 'ROMANCE_RECRUITMENT' | 'NETWORK_RECRUITMENT' | 'MULTI_ACCOUNT' | 'BOT_AUTOMATION' | 'JOB_SCAM' | 'ROMANCE_SCAM' | 'INVESTMENT_SCAM' | 'SELF_RECRUITED' | 'COERCED' | 'UNKNOWN' | 'OTHER' — Optional attack method associated with the label. Valid values depend on the selected `sub_category`, or directly on `use_case` for `MONEY_MULE` and `CREDENTIAL_STUFFING`. Do not provide this field for `FIRST_PARTY_FRAUD`. For supported values and combinations, see [Specify fraud scenarios with labels](/guides/risk/label-fraud-scenarios.md).
    - `source` 'MANUAL_REVIEW' | 'CUSTOMER_COMPLAINTS' | 'CHARGEBACKS' | 'OTHER_VENDORS' | 'AUTOMATED_DETECTION' | 'LAW_ENFORCEMENT' — Source of the information used to assign the label, such as manual review, customer complaints, chargebacks, another fraud system, automated detection, or law enforcement. For supported values and definitions, see [Specify fraud scenarios with labels](/guides/risk/label-fraud-scenarios.md).
    - `label_timestamp` number — Unix time indicating the label creation time
  - `afftectedActionIds` string[], required

## Other responses

- `400` — Bad request
- `401` — Invalid authentication
- `403` — Invalid authorization
- `429` — Rate limit reached
- `500` — Internal error

---

[API](https://skmtc.dev/transmitsecurity/apis/labels.md) · [All operations](https://skmtc.dev/transmitsecurity/apis/labels/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/transmitsecurity/labels/revisions/466f6ecac202/schema)