Reason codes

Every evaluation explains its result with a reason. The reason has a stable code for your code and reports, and a readable message you can show your team.

{
  "result": "deny",
  "reason": {
    "code": "prior_claim_email",
    "message": "An earlier claim used this email address."
  }
}

When one of your custom rules decided the result, the reason also carries rule, the ID of that rule.

Branch on the result

Your application should act on result, which is always allow or deny. Use reason.code for analytics, support tools and messages to your own team. Handle a code you don't recognize like any other reason.

Benefit history

These codes mean an earlier claim on the same benefit is linked to this one. They come from your workspace's claim history, which grows with every outcome you report or import.

Code	Message	What it means
`prior_claim_user`	This user already received this benefit.	The same user, by your user ID (`subject.external_id`), already has a claim that counts toward eligibility.
`prior_claim_email`	An earlier claim used this email address.	An earlier claim used this email address.
`prior_claim_payment`	An earlier claim used this payment method.	An earlier claim used the same payment method.
`prior_claim_phone`	An earlier claim used this verified phone number.	An earlier claim used the same verified phone number. See Hash and send a phone number.
`prior_claim_device`	This device is linked to earlier claims.	The device behind this claim is linked to earlier claims, through browser protection or the device ID you send.

Recommended action: open the evaluation to see the policy version it ran under and the inputs it received, and its association graph (GET /v1/evaluations/{id}/graph) to see the earlier outcomes behind the denial. If this person should receive the benefit, add an allow list entry. If the earlier claim was never actually granted, report its outcome as not_granted so it stops counting.

Network Intelligence, Identity Intelligence and Automation Defense

These codes mean AbuseZero's own assessment decided the result, under your protection level, your policy's risk threshold or the benefit's automation setting.

Code	Message	What it means
`network_risk`	AbuseZero Network Intelligence flagged this connection.	The connection behind this claim was assessed as high risk. It shows in the `network` signal family.
`identity_risk`	AbuseZero Identity Intelligence flagged this email address.	The email address behind this claim was assessed as high risk. It shows in the `identity` signal family.
`repeated_attempts`	AbuseZero detected repeated claim attempts.	This claim is part of a pattern of repeated attempts.
`automation`	AbuseZero Automation Defense detected automated activity.	The claim came from automation that isn't allowed for this benefit. See Bots and AI agents.
`protection_level`	AbuseZero managed protection matched this claim.	Your protection level decided the result.
`risk_threshold`	The AbuseZero Risk Score reached this policy's threshold.	The claim's overall risk reached the threshold set for this policy.

Recommended action: check the evaluation's signal families, in its evidence or the dashboard, to see which area was elevated. If your audience legitimately looks like this, for example a company that routes all traffic through one network, choose a protection level that fits it, add an allow list entry, or adjust your custom rules. For automation, review the benefit's automation settings and recognized agents. Test against past traffic before you change a live policy.

Your lists and rules

Code	Message	What it means
`allow_list`	An allow list entry matched this claim.	One of your allow list entries matched, so the claim was allowed.
`block_list`	A block list entry matched this claim.	One of your block list entries matched, so the claim was denied.
`custom_rule`	Your rule “…” matched this claim.	One of your custom rules decided the result. `rule` carries its ID.

For custom_rule, the evaluation's details name the rule in the message. Responses from POST /v1/evaluations and previews carry the message "One of your rules matched this claim." with the same rule ID.

Recommended action: these results are exactly what you configured. Review the matching entry or rule under Policies in the dashboard, or through the Allow and block lists and Policies endpoints.

Policy defaults

Code	Message	What it means
`default_allow`	No rule matched, so the policy's default allowed this claim.	Nothing in the policy matched, and the policy allows by default (`default_result`, see Custom policy definition).
`default_deny`	No rule matched, so the policy's default denied this claim.	Nothing in the policy matched, and the policy denies by default.

Repeat requests

Code	Message	What it means
`previously_authorized`	This claim was already approved.	This claim ID was already allowed for this user. The original allowed result is returned instead of a new decision. See Re-evaluating a `claim_id`.

Recommended action: nothing, if you're retrying the same award. To evaluate a new award, use a new claim ID.

Observe mode

When a benefit is in observe mode, every claim is allowed, and reason explains what the policy decided. The evaluation records that decision as observed_result, so you can review it in the dashboard or with GET /v1/evaluations/{id} before you switch the benefit to protect mode.

Evaluations
Troubleshooting
Developer FAQ
REST API errors, for requests that fail instead of returning a result

Benefit historyCopy Anchor Link

Network Intelligence, Identity Intelligence and Automation DefenseCopy Anchor Link

Your lists and rulesCopy Anchor Link

Policy defaultsCopy Anchor Link

Repeat requestsCopy Anchor Link

Observe modeCopy Anchor Link

RelatedCopy Anchor Link