Verdicts
allow, challenge, shadow, block — plus score, reasons, and what you should enforce.
Every successful check and evaluate returns:
Prop
Type
What to enforce
| Verdict | Typical action |
|---|---|
allow | Continue the auth flow |
challenge | Step-up (MFA, extra proof) then continue |
shadow | Allow, but queue for review / tighten later |
block | Stop account creation or session |
AbuseGraph does not terminate requests. Your app (or worker) applies the verdict.
Errors
Failures use application/problem+json (RFC 9457). Rate headers: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, Retry-After.