Common request and response parameters for the Risk Identification API - Fraud Detection

This topic describes the common request parameters and common response parameters for Risk Identification API calls.

Common request parameters

Requests to the Risk Identification API include common request parameters and service-specific event parameters. Every API call must include the common request parameters described in the following table.

Parameter	Type	Required	Description
Format	String	Yes	The format of the response. Valid values: JSON (Default) XML
Version	String	Yes	The API version. Use the YYYY-MM-DD format. The current version is `2019-05-21`.
AccessKeyId	String	Yes	The AccessKey ID provided by Alibaba Cloud for service access.
Signature	String	Yes	The signature string. For information about how to calculate a signature, see Section 2.0 in Call an API operation by using an SDK.
SignatureMethod	String	Yes	The signing method. Only HMAC-SHA1 is supported.
Timestamp	String	Yes	The timestamp of the request, which must be in UTC and formatted in accordance with the ISO 8601 standard as `yyyy-MM-ddTHH:mm:ssZ`. For example, 09:44:35 on August 22, 2019 (UTC+8) is `2019-08-22T01:44:35Z`.
SignatureVersion	String	Yes	The version of the signature algorithm. Set the value to `1.0`.
SignatureNonce	String	Yes	A unique random number used to prevent replay attacks. This number must be unique for each request.
Action	String	Yes	The value must be `ExecuteRequestSG` (Singapore) or `ExecuteRequestML` (Malaysia).
Service	String	Yes	The predefined service code issued by Alibaba Cloud Security for the service you are calling. The following list provides the valid service codes: Device Risk Identification Service: device_risk_intl Device Risk Identification Pro Service: device_risk_intl_pro Registration Fraud Prevention Service: account_abuse_intl Registration Fraud Prevention Pro Service: account_abuse_intl_pro Marketing Fraud Prevention Service: coupon_abuse_intl Marketing Fraud Prevention Pro Service: coupon_abuse_intl_pro Email Profiling Service: email_risk IP Profiling Service: risk_intelligence_ip_intl
ServiceParameters	String	Yes	The JSON format of the service parameter list is `{"accountId":10123**** ...other request parameters for the event}`. The following is a list of links to the specific fields and parameter value formats: Event parameters and technical details of Device Risk Identification Functions and parameters of Registration Fraud Prevention Functions and parameters of Marketing Fraud Prevention Events and response parameters of Email Profiling Events and response parameters of IP Profiling

The following example shows the request parameters for the Device Risk Identification Pro Service:

    https://saf.{region}.aliyuncs.com/
    ?Format=JSON
    &Version=2019-05-21
    &Signature=vpEEL0zFHfxXYzSFV0n7%2FZiFL9o%3D 
    &SignatureMethod=Hmac-SHA1
    &SignatureNonce=15215528852396
    &SignatureVersion=1.0
    &Action=ExecuteRequest
    &AccessKeyId=123****saf 
    &Timestamp=2018-06-01T12:00:00Z
    &Service=device_risk_pro
    &ServiceParameters={"deviceToken":1012****}

Common response parameters

Every API response includes a unique RequestId, regardless of whether the call was successful. Responses may also include other parameters like score (risk score), tags (reason code), and extend (custom response parameters). The returned parameters vary based on the service. For more information, see the documentation for the specific service.

The following is a JSON example of the return parameters from the Device Risk Identification Pro Service:

{
  // service: device_risk_pro
  
 "RequestId": "52E3208D-E7BF-32F0-9913-2A168894D2D9",
 "Message": "OK",
 "Data": {
  		"extend": "0f533f6056f50664b48f2b3866220f0f", // Unique device ID
 		 	"tags": "is_rooted" // Reason code
 },
 "Code": 200 // The request is successful.
}

Note

The sample responses in this topic are formatted for readability. The actual responses are not indented or line-wrapped.

Error codes

Code	Description
200	The request is successful.
400	The `ServiceParameters` (event parameters) are invalid.
402	The query-per-second (QPS) rate exceeds the limit of your service plan, and the request was throttled.
403	Insufficient permissions. The service is not activated or has expired.
404	The `Service` (service code) parameter is invalid.
500	An internal server error occurred.