Make
No published Make app. The generic HTTP → Make a request module is the supported path and works with no extra cost beyond your operations.
Setup
- 1Add an HTTP → Make a request module.
- 2URL: https://www.layercall.com/v1/score/user, method POST.
- 3Headers: X-Api-Key with your key; Content-Type application/json.
- 4Body type: Raw, content type JSON, with the fields you have.
- 5Enable 'Parse response' so verdict and risk_score are available to later modules.
Code
{ "ip": "{{1.ip}}", "email": "{{1.email}}", "phone": "{{1.phone}}" }
What to do with each verdict
Three outcomes, and the middle one is the one worth getting right — refusing a real customer usually costs more than reviewing them.
| Verdict | In Make |
|---|---|
| allow | Continue down the default route. |
| review | Add a Router with a filter on {{2.verdict}} = review, leading to a notification module. |
| block | Filter to a route that ends the bundle, or writes to a rejects sheet. Make stops a route when a filter does not match, so a single filter is enough — no explicit stop module needed. |
What comes back
A real response, generated from the live API rather than written by hand. Branch on verdict; summary is a sentence written to be shown to a person, and components_checked tells you what actually went into the score.
Show the full response(POST /v1/score/user)
{ "risk_score": 65, "verdict": "review", "summary": "Needs review (65/100) — Tor exit node, commercial VPN and datacenter ASN.", "components": { "email": { "email": "test@guerrillamail.com", "normalized_email": "test@guerrillamail.com", "risk_score": 100, "verdict": "block", "status": "do_not_mail", "sub_status": "disposable", "deliverability_score": 0, "did_you_mean": null, "signals": { "syntax_valid": true, "mx_found": true, "is_disposable": true, "is_homograph": false, "is_role_account": true, "is_free_provider": false, "is_suspicious_handle": true, "is_tagged": false, "is_risky_tld": false, "is_new_domain": null, "has_spf": true, "has_dmarc": true, "has_website": true, "mailbox_exists": null, "is_catch_all": null, "mailbox_status": "unavailable", "has_digital_footprint": null }, "domain": "guerrillamail.com", "domain_age_days": null, "mx_provider": null, "mx_records": [ "mail.guerrillamail.com." ], "abuse_reports": 0, "digital_footprint": { "has_gravatar": false, "gravatar_profile_url": null, "breach_count": null, "seen_in_breach": null } }, "phone": { "parse_status": "ok", "phone": "+14155552671", "risk_score": 0, "signals": { "syntax_valid": true, "is_possible": true, "is_voip": false, "is_premium_rate": false, "is_toll_free": false, "assigned_area_code": true, "is_fictional": false }, "number": { "e164": "+14155552671", "country": "US", "national": "(415) 555-2671", "international": "+1 415 555 2671", "line_type": "fixed_line_or_mobile" }, "verdict": "allow", "abuse_reports": 0 }, "ip": { "ip": "185.220.101.1", "risk_score": 60, "signals": { "is_vpn": true, "is_proxy": true, "is_datacenter": true, "is_tor": true, "recent_abuse": false, "is_hijacked_netblock": false }, "geo": { "country": "DE", "city": "Berlin", "asn": "AS60729", "isp": "Stiftung Erneuerbare Freiheit" }, "vpn_provider": null, "hijacked_source": null, "verdict": "review", "abuse_reports": 0 } }, "components_checked": [ "email", "phone", "ip" ], "linkage": { "device_email_count": null, "email_device_count": 0, "email_ip_count": 0, "subnet_rate_1h": 2, "domain_rate_1h": 0 }, "actor": { "type": "unknown", "proven": false, "basis": "none", "operator": null, "trigger": null, "detail": "No signature and no device fingerprint. Drop fp.js on the page, or pass the agent's signed request, to get an answer here." }, "top_signals": [ "ip: tor exit node", "ip: commercial vpn", "ip: datacenter asn", "email: disposable domain", "email: role account", "email: machine-generated handle" ] }
Traps specific to Make
Make returns the raw body unless you tick Parse response, so {{2.verdict}} resolves to nothing and your filter silently never matches — the scenario looks like it ran clean. Tick it, then re-run once so later modules can see the parsed structure.
{{1.ip}} means 'the first module's ip'. Inserting a module above it renumbers everything and your body starts sending empty strings. Re-check the body after any reorder.
A key typed into the header field is visible to everyone with scenario access and travels with the blueprint if anyone exports it. Make's Keychain exists for this.
Questions
Where do I put the API key safely?
Make's connection/keychain rather than a plain-text field in the scenario, so it is not visible to everyone with scenario access.
How many operations does one check cost?
One Make operation for the HTTP module, plus one for each subsequent module the bundle passes through. The LayerCall side is one lookup per value scored, independent of Make's counting.