Skip to main content
POST
cURL

Response Format

The API returns detailed information about the request, including:
  • Verdict - Whether the request should be allowed (can_pass: true/false) and whether the token had already been redeemed (redeemed: true/false)
  • Device information - Browser details, fingerprint, user agent
  • IP analysis - Location, threat indicators, proxy/VPN detection
  • Session data - Timing and behavioral analysis

Token Redemption

Tokens can be verified more than once — replay does not produce an error. Use verdict.redeemed to detect it:
  • verdict.redeemed: false — first time this token has been verified
  • verdict.redeemed: true — this token was already verified by a previous /verify call
If your defense action should treat a token as single-use (e.g. login, signup, payment), reject the request when verdict.redeemed is true.

Testing

For local development, use test action IDs that return predictable results without consuming API credits:
  • Success: t/FFFFFFFFFFFFF/111111111 (always returns can_pass: true)
  • Failure: t/FFFFFFFFFFFFF/000000000 (always returns can_pass: false)
See the Defense Actions guide for more details.

Body

application/json

Verdict request with session token and optional user identification

api_key
string
required

Your Deflect API Key

action_id
string
required

Your Deflect Action ID

token
string
required

The user session token from the protected endpoint.

id
string

Optional user identifier for multi-accounting detection. Highly recommended to include.

email
string<email>

Optional user email address. Response will include email risk assessment.

phone_number
string

Optional user phone number in E.164 format. Response will include phone validation.

Response

Successful response

success
boolean
user_id
string

Echo of the user identifier passed in the request.

score
integer

Bot detection score from 0 (bot) to 100 (human).

verdict
object
device
object
ip
object
location
object
email
object

Included when an email address is passed in the request.

phone
object

Included when a phone number is passed in the request.

session
object
rules
object[]

Bot rules and access rules that matched this request.

multi_accounting
object

Multi-accounting detection results. Requires a user id in the request.