APIs for device fingerprinting, user behavorial analytics, threat detection, and incident workflow.
_castle('createRequestToken').then(function(requestToken) {
// Insert requestToken into the form data
// ....
});
// or use onsubmit handler to automatically insert the castle_request_token hidden input
<form onsubmit="_castle('onFormSubmit', event)">
// ....
</form>
token = request.params['castle_request_token']
context = Castle::Context::Prepare.call(request)
res = castle.risk(
event: '$login',
status: '$succeeded',
request_token: token,
context: {
ip: context[:ip],
headers: context[:headers]
}
user: {
id: user.id,
email: user.email
}
)
Use risk scores and signals to detect malicious behavior. Take action based on policy verdicts: allow, challenge or deny.
The /risk endpoint assesses each user accessing your site.
{
"risk": 0.67,
"signals": {
"new_device": {},
"new_country": {},
"proxy_ip": {},
"impossible_travel": {},
"multiple_accounts_per_device": {}
},
"policy": {
"action": "challenge",
"name": "Step up MFA on suspicious logins",
"id": "e14c5a8d-c682-4a22-bbca-04fa6b98ad0c",
"revision_id": "b5cf794e-88c0-426e-8276-037ba1e7ceca"
},
"device": {
"token": "eyJhbGciOiJIUzI1NiJ9.eyJ0b2tlbiI6IlQyQ"
}
}
{
"risk": 0.67,
"signals": {
"new_device": {},
"new_country": {},
"proxy_ip": {},
"impossible_travel": {},
"multiple_accounts_per_device": {}
},
"policy": {
"action": "challenge",
"name": "Step up MFA on suspicious logins",
"id": "e14c5a8d-c682-4a22-bbca-04fa6b98ad0c",
"revision_id": "b5cf794e-88c0-426e-8276-037ba1e7ceca"
},
"device": {
"token": "eyJhbGciOiJIUzI1NiJ9.eyJ0b2tlbiI6IlQyQ"
}
}
{
"risk": 0.67,
"signals": {
"new_device": {},
"new_country": {},
"proxy_ip": {},
"impossible_travel": {},
"multiple_accounts_per_device": {}
},
"policy": {
"action": "challenge",
"name": "Step up MFA on suspicious logins",
"id": "e14c5a8d-c682-4a22-bbca-04fa6b98ad0c",
"revision_id": "b5cf794e-88c0-426e-8276-037ba1e7ceca"
},
"device": {
"token": "eyJhbGciOiJIUzI1NiJ9.eyJ0b2tlbiI6IlQyQ"
}
}
{
"risk": 0.67,
"signals": {
"new_device": {},
"new_country": {},
"proxy_ip": {},
"impossible_travel": {},
"multiple_accounts_per_device": {}
},
"policy": {
"action": "challenge",
"name": "Step up MFA on suspicious logins",
"id": "e14c5a8d-c682-4a22-bbca-04fa6b98ad0c",
"revision_id": "b5cf794e-88c0-426e-8276-037ba1e7ceca"
},
"device": {
"token": "eyJhbGciOiJIUzI1NiJ9.eyJ0b2tlbiI6IlQyQ"
}
}
Risk scores go up when signals trigger. Take action based on the score or individual signals.
Take action based on configurable policies rather than hard-coded values.
Create custom fraud protection workflows.
Detect suspicious activity. Stop malicious users.
Stop accounts with leaked credentials from being taken over.
Prevent fraudulent transactions and money laundering before they happen.
Mitigate new account registration fraud and fake spam accounts.
Prevent fraudsters from taking advantage of rewards, sales or other promotions.
Verify suspicious transaction behaviors such as excessive cash deposits or transfers.
Uncover accounts shared by multiple individuals.
