Fraud Prevention and Risk Scoring in One API Call
Score a whole signup — IP, email, phone, domain, device — in one call. Device fingerprinting catches the fraudster who switched to a VPN and a fresh inbox.
AI agent authorization catches the ones that pass every check because they drive a real browser.
IP address
185.220.101.1
Seen in Berlin, DE, arriving over Tor.
Berlin, DE · Stiftung Erneuerbare Freiheit (AS60729)
Example result — a real response from the live API. Paste anything above to run your own.
Live API response
One brand, every signal
Nine live products behind one key, one credit system, and one response shape — every endpoint returns the same 0–100 score and allow/review/block verdict.
Only on LayerCall
Score the whole signup in one call
Everyone else makes you call four endpoints and merge the results yourself. Send IP, email, phone, and domain to /v1/score/user and get back one combined risk score, one verdict, and the top signals — with every component's full detail included.
- One request, one verdict — allow, review, or block
- Weighted scoring: a hard red flag is never averaged away
- top_signals tells you why in plain English — branch on the signals booleans, show this
/v1/score/user referencePOST /v1/score/user
{ "ip": "185.220.101.1",
"email": "ceo@mailinator.com",
"phone": "+14155552671" }
→ {
"risk_score": 65,
"verdict": "review",
"top_signals": [
"ip: tor exit node",
"ip: commercial vpn",
"ip: datacenter asn"
],
"components_checked": [
"email",
"phone",
"ip"
],
"processing_time_sec": 0.036
}Live in three steps
Grab your API key
Create a free account and get a live key in minutes — no sales call, 1,000 lookups a month on the house.
Send a lookup
One request with the IP, email, phone, domain or device from your signup flow — or all five at once. Under 0.1 sec on cache hits.
Act on the verdict
allow → let them in. review → flag and monitor. block → reject or step-up challenge. Conservative by design.
Built to be trusted
Conservative scoring
Weights start strict — Tor +50, abuse +40, datacenter +30, VPN +25 — so when the verdict says block, you can act on it without fear of turning away real customers.
Cached & fast
Repeat lookups return from cache in 0.02–0.09 sec. A first-time lookup runs live DNS and RDAP against other people's servers and takes 1–4 sec. Every response reports its own processing_time_sec — no guessing.
Always-fresh feeds
Tor exit nodes and abuse lists auto-refresh every 6 hours. No stale blocklists, no manual updates.
Made for signup & checkout flows
Call it before creating the account or charging the card. Fail open if unreachable, challenge on review, reject on block — every response carries a request_id for debugging.
Your rules always win
Exclude your office IPs, corporate domains, or test numbers with allow rules; hard-block known bad actors with block rules — for any IP, CIDR range, email, domain, phone, or ASN. Every response shows rule_applied so you always know why.
Switch in one call
Coming from another provider? POST their exported blocklist/allowlist CSV as-is — we auto-detect every entry, skip the junk, and tell you exactly what was imported. Free.
Catch the next fake signup before it happens
One GET request between your signup form and your database.
Get your free API key →