Risk and Intelligence APIs

Account Protection API Overview

5 min

Topic type: Concept

Purpose: Explain how the Account Protection API evaluates risk associated with account activity prior to, during, and outside of a purchase transaction.

Audience: API integrators and client developers implementing pre‑transaction fraud prevention.

Applies to: Clients using the Account Protection API for account-level and identity-driven events.

Does not apply to: Industry‑specific Fraud APIs, Dispute APIs, or regulatory‑only APIs such as Data Privacy.

The Accertify Account Protection API evaluates risk associated with user activity on your website or application, with a focus on Account Takeover (ATO) and New Account Opening (NAO) fraud. It is designed to assess risk before a transaction occurs, or in cases where no payment is involved at all.

Account Protection operates at the event level. Each request represents a specific user action—such as a login attempt, password reset, account update, or withdrawal—that should be evaluated for risk at the moment it occurs.

The API does not take action on accounts directly. Instead, it returns risk signals and scores that you use to determine how your systems should respond.

Account Protection Architecture

At a high level, the flow is:

A user triggers an event in your application (for example, login or account update).

Your system submits the event to the Account Protection API.

Accertify evaluates the event using behavioral signals, historical context, and machine‑learning models.

The API returns a risk score and supporting details.

Your system decides how to proceed.

While each request represents a single event, evaluation does not occur in isolation. Accertify measures consistency, change, and correlation across events over time to identify abnormal behavior that may indicate fraud.

The Account Protection API currently supports the following event types.

Each event type has its own expected context and field requirements, which are documented in the linked event‑specific overview pages:

accountCreateaccountCreate

accountUpdateaccountUpdate

loginlogin

logoutlogout

passwordForgotpasswordForgot

passwordUpdatepasswordUpdate

usernameForgotusernameForgot

verificationverification

paymentpayment

refundrefund

withdrawalwithdrawal

transfertransfer

inventoryHoldinventoryHold

listingCreatelistingCreate

listingUpdatelistingUpdate

giftCardBalancegiftCardBalance

chargebackchargeback

The Account Protection API provides decision support, not enforcement.

Using the returned risk score and event details, you determine how your systems respond. Common response patterns include:

Preventative actions:

Require multi‑factor authentication

Reset a password

Block or reject a high‑risk action

Supportive actions:

Allow one‑click checkout

Reduce friction for trusted users

Enable expedited flows for low‑risk activity

The appropriate response depends on your business logic, risk tolerance, and regulatory obligations.

Account Protection requests must be submitted from a back‑end system. Client‑side JavaScript API submission is not supported.

This requirement exists because:

Some required data elements are available only from server‑side systems.

Error handling and retry behavior must be controlled centrally.

Requests are accepted only from whitelisted IP addresses.

Certain fields require cryptographic hashing prior to transmission.

Details on authentication, hashing, field classification, and validation behavior are documented in Global ConstraintsGlobal Constraints.

Some Account Protection fields are labeled Imperative, meaning they provide high‑value signals when available.

Imperative fields should be sent whenever your system can legitimately provide them. However, there are valid scenarios where an Imperative field may be unavailable for a given event. In those cases:

Do not suppress the request

Do not fabricate placeholder values

Send the event with the available data

For example, automated attacks may prevent generation of a device identifier, but the event should still be evaluated using the remaining context.

Refer to Global ConstraintsGlobal Constraints for full definitions and expectations.

Prior to sending certain sensitive fields, you must hash the clear-text value using our Accertify Hash Algorithm.

The fields that require hashing are:

cardNumber

giftCardNumber

hashedPassword

previousHashedPassword

updatedHashedPassword

Refer to Hashing RequirementsHAsh and Accertify Hash AlgorithmHAsh for more information.

Account Protection includes a set of standard webhooks that allow Accertify to notify your systems when follow‑up action is recommended.

Webhooks act as a reverse API, enabling Accertify to push messages—such as account‑level actions or payment flags—back to your environment. These notifications are commonly used to:

Force password resets

Trigger verification flows

Flag or cancel suspicious payments

Apply account‑level restrictions

Webhook payloads may reference a single object or multiple related objects, depending on the action taken.

Event References

Account Protection fields

Overviews

Account Createdd

Account Updateaa

Chargebackchargeback

Gift Card Balancegc

Inventory Holdih

Listing Createlc

Listing Updatelu

Loginffffff

Logouthh

Password Forgotpf

Password Updatepu

Paymentpay

Refundref

Transfertra

Username Forgotuf

Verificationver

Withdrawalwww

Field References

Account Create Fields

Account Update Fields

Chargeback Fields

Gift Card Balance Fields

Inventory Hold Fields

Listing Create Fields

Listing Update Fields

Logout Fields

Password Forgot Fields

Password Update Fields

Payment Fields

Refund Fields

Transfer Fields

Username Forgot Fields

Verification Fields

Withdrawal Fields

Risk and Intelligence APIs

Account Protection API Changelog

Account Protection API Overview

Topic Intent

How Account Protection Works

Supported Event Types

Taking Action

Request Origin and Integration Model

Field Availability and Imperative Data

Field Hashing

Webhooks and Downstream Actions

Event References

Overviews

Field References

Account Protection API Overview

﻿﻿﻿﻿Topic Intent﻿﻿﻿﻿

How Account Protection﻿ Works

Supported Event Types

Taking Action

Request Origin and Integration Model

Field Availability and Imperative Data

Field Hashing

Webhooks and Downstream Actions

Event References

Overviews

Field References

Topic Intent

How Account Protection Works