Developer documentation
Policies and generic benefits
Policies are reusable rule sets evaluated against normalized facts from your request. Benefit name or reward type does not change the engine—only the assigned policy, enforcement mode, and eligibility window do.
One recipient rule
subject.external_id identifies whatever receives the benefit. This might be a person, team, installation, license, or another concept in your application. If you omit it, the canonical email is the recipient identity. There is no recipient-category setting.
Eligibility periods
Choose once ever, a calendar day/week/month in a named timezone, or a rolling number of days. These settings affect when history counts again; they do not create a different kind of benefit backend.
Rule order
Blocked entries take precedence over trusted entries. Deny automation runs next, followed by the first matching policy rule. If no rule matches, the combined risk threshold runs before the default result. Missing inputs do not match ordinary comparisons, so a missing phone or browser signal is not silently treated as a known negative.
Reusable policies
Policies are separate from benefits and have a name and immutable API key. Assign one saved policy and one enforcement mode to each benefit. A policy can protect several benefits, while each benefit can choose Enforce or Monitor only.
Policy presets
Balanced, Lenient, and Strict are read-only in each environment. All retain their identity and reuse protections. Lenient denies an IP risk snapshot of at least 95. Balanced denies at 90, Tor, public proxies, residential-proxy confidence of at least 80, and repeated anonymous traffic. Strict denies at 70, Tor, public proxies, VPNs, hosting providers, and residential-proxy confidence of at least 50. Static IP score and geography remain available for custom rules but do not deny by themselves.
Risk threshold
When no explicit rule matches, deny if AI Abuse Risk Score reaches risk_threshold; otherwise use the policy default. Lenient uses 80, Balanced 60, and Strict 40. Custom policies accept whole-number thresholds from 1 to 100 and start at 60. Lower thresholds deny more claims. An explicit allow rule can permit a claim regardless of its potential score. The threshold has no separate allow/deny action selector.
IP risk and static scores
IP risk snapshot is a nullable 0.01–99 estimate of risk associated with the network, with higher values indicating more risk. It is a network snapshot, not the evaluation result and not a real-time score trained on your own traffic. A null value means no supported value is available; it does not mean zero. Static IP score is a separate 0–99.99 estimate of how consistently an address is associated over time, with higher values indicating a more static address. Static score does not measure abuse risk by itself.
Custom policy versions and replay
Create a custom policy from Balanced. Saving an edit creates an immutable version that applies to every linked benefit’s future evaluations immediately. Past evaluations keep their recorded version. Historical replay uses retained facts and baseline risk scoring against a selected saved policy without new AI requests or changes to claims and outcomes.