Risk & fraud

Fraud scoring, sanctions (OFAC) screening, device/IP fingerprinting and identity verification (KYC) behind one risk API.

Overview

Base path: https://api.infrai.cc/v1/risk

Auth header: Authorization: Bearer $INFRAI_API_KEY

bash

# Call any /v1/risk capability over raw HTTP — no SDK to install.
# curl:
curl https://api.infrai.cc/v1/risk/... \
  -H "Authorization: Bearer $INFRAI_API_KEY" \
  -H "Content-Type: application/json"

Methods

risk.score

POST /v1/risk/score

Score a user/account event (login, payment, signup) for fraud and abuse risk, returning a normalized 0..1 score plus an accept / review / reject disposition. Billable work-action, ML high-margin (service_markup).

Parameters

Name	Type	Required	Description
`subject_id`	`string`	Optional	User / account id under evaluation.
`event_type`	`string`	Optional	The event being scored / reported.
`ip`	`string`	Optional	Originating IP address.
`email`	`string`	Optional	Email address associated with the subject.
`device_fingerprint`	`string`	Optional	Device fingerprint / visitor id.
`amount`	`number`	Optional	Transaction amount.
`currency`	`string`	Optional	ISO currency code for the amount.
`properties`	`Record<string, unknown>`	Optional	Arbitrary signal properties.
`vendor`	`string`	Optional	Explicit vendor pin.
`idempotency_key`	`string`	Optional	Client-supplied key to make the call idempotent.

Returns

RiskScore { score, decision, reasons: string[] }

Example

一次性前置(每个范例都假定已完成):

bash

# No SDK to install — every call is a plain HTTPS request.
# Get a project key by signing in at the console: Google/GitHub gives you
# $2 free credit (email sign-in starts at $0). On 402 INSUFFICIENT_CREDIT,
# POST /v1/account/topup and open the returned checkout_url.
export INFRAI_API_KEY="ifr_pk_proj_..."

bash

curl -X POST https://api.infrai.cc/v1/risk/score \
  -H "Authorization: Bearer $INFRAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

python

import os, requests

resp = requests.post(
    "https://api.infrai.cc/v1/risk/score",
    headers={"Authorization": f"Bearer {os.environ['INFRAI_API_KEY']}"},
    json={},
)
resp.raise_for_status()
print(resp.json())

javascript

const resp = await fetch(
  "https://api.infrai.cc/v1/risk/score",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({}),
  },
);
console.log(await resp.json());

typescript

const resp = await fetch(
  "https://api.infrai.cc/v1/risk/score",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({}),
  },
);
if (!resp.ok) throw new Error(`infrai ${resp.status}`);
const data: unknown = await resp.json();
console.log(data);

risk.ofac.check

POST /v1/risk/ofac/check

Screen a name / address / id against sanctions lists (OFAC SDN, EU, UN consolidated), returning match details. Billable work-action.

Parameters

Name	Type	Required	Description
`name`	`string`	Required	Full legal name to screen.
`address`	`string`	Optional	Address to screen.
`country`	`string`	Optional	Country code.
`dob`	`string`	Optional	Date of birth (YYYY-MM-DD).
`id_number`	`string`	Optional	Government ID number.
`lists`	`string[]`	Optional	Sanctions lists to check against.

Returns

OfacResult { match: boolean, hits: object[] }

Example

一次性前置(每个范例都假定已完成):

bash

# No SDK to install — every call is a plain HTTPS request.
# Get a project key by signing in at the console: Google/GitHub gives you
# $2 free credit (email sign-in starts at $0). On 402 INSUFFICIENT_CREDIT,
# POST /v1/account/topup and open the returned checkout_url.
export INFRAI_API_KEY="ifr_pk_proj_..."

bash

curl -X POST https://api.infrai.cc/v1/risk/ofac/check \
  -H "Authorization: Bearer $INFRAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "..."}'

python

import os, requests

resp = requests.post(
    "https://api.infrai.cc/v1/risk/ofac/check",
    headers={"Authorization": f"Bearer {os.environ['INFRAI_API_KEY']}"},
    json={'name': '...'},
)
resp.raise_for_status()
print(resp.json())

javascript

const resp = await fetch(
  "https://api.infrai.cc/v1/risk/ofac/check",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({"name": "..."}),
  },
);
console.log(await resp.json());

typescript

const resp = await fetch(
  "https://api.infrai.cc/v1/risk/ofac/check",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({"name": "..."}),
  },
);
if (!resp.ok) throw new Error(`infrai ${resp.status}`);
const data: unknown = await resp.json();
console.log(data);

risk.device.fingerprint

POST /v1/risk/device/fingerprint

Resolve a stable device fingerprint / visitor id from a client-collected token plus IP and user-agent signals, for bot and incognito detection. Served by a vendor (sift / castle).

Parameters

Name	Type	Required	Description
`request_token`	`string`	Optional	Client-collected token / visitor id.
`ip`	`string`	Optional	Originating IP address.
`user_agent`	`string`	Optional	Client user-agent string.
`properties`	`Record<string, unknown>`	Optional	Arbitrary signal properties.

Returns

Device { device_id, signals: object }

Example

一次性前置(每个范例都假定已完成):

bash

# No SDK to install — every call is a plain HTTPS request.
# Get a project key by signing in at the console: Google/GitHub gives you
# $2 free credit (email sign-in starts at $0). On 402 INSUFFICIENT_CREDIT,
# POST /v1/account/topup and open the returned checkout_url.
export INFRAI_API_KEY="ifr_pk_proj_..."

bash

curl -X POST https://api.infrai.cc/v1/risk/device/fingerprint \
  -H "Authorization: Bearer $INFRAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

python

import os, requests

resp = requests.post(
    "https://api.infrai.cc/v1/risk/device/fingerprint",
    headers={"Authorization": f"Bearer {os.environ['INFRAI_API_KEY']}"},
    json={},
)
resp.raise_for_status()
print(resp.json())

javascript

const resp = await fetch(
  "https://api.infrai.cc/v1/risk/device/fingerprint",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({}),
  },
);
console.log(await resp.json());

typescript

const resp = await fetch(
  "https://api.infrai.cc/v1/risk/device/fingerprint",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({}),
  },
);
if (!resp.ok) throw new Error(`infrai ${resp.status}`);
const data: unknown = await resp.json();
console.log(data);

risk.event.report

POST /v1/risk/event/report

Report a risk-relevant event or label (chargeback, fraud, abuse) back to the vendor as feedback to improve future scoring.

Parameters

Name	Type	Required	Description
`subject_id`	`string`	Optional	User / account id under evaluation.
`event_type`	`string`	Required	The event being scored / reported.
`label`	`"fraud" \| "legit" \| "chargeback"`	Optional	Outcome label — fraud, legit or chargeback.
`reason`	`string`	Optional	Free-text reason for the report.
`properties`	`Record<string, unknown>`	Optional	Arbitrary signal properties.

Returns

{ ok: boolean }

Example

一次性前置(每个范例都假定已完成):

bash

# No SDK to install — every call is a plain HTTPS request.
# Get a project key by signing in at the console: Google/GitHub gives you
# $2 free credit (email sign-in starts at $0). On 402 INSUFFICIENT_CREDIT,
# POST /v1/account/topup and open the returned checkout_url.
export INFRAI_API_KEY="ifr_pk_proj_..."

bash

curl -X POST https://api.infrai.cc/v1/risk/event/report \
  -H "Authorization: Bearer $INFRAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"event_type": "..."}'

python

import os, requests

resp = requests.post(
    "https://api.infrai.cc/v1/risk/event/report",
    headers={"Authorization": f"Bearer {os.environ['INFRAI_API_KEY']}"},
    json={'event_type': '...'},
)
resp.raise_for_status()
print(resp.json())

javascript

const resp = await fetch(
  "https://api.infrai.cc/v1/risk/event/report",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({"event_type": "..."}),
  },
);
console.log(await resp.json());

typescript

const resp = await fetch(
  "https://api.infrai.cc/v1/risk/event/report",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({"event_type": "..."}),
  },
);
if (!resp.ok) throw new Error(`infrai ${resp.status}`);
const data: unknown = await resp.json();
console.log(data);

risk.kyc.submit

POST /v1/risk/kyc/submit

Submit an identity-verification (KYC) request — document type, name, DOB, document/selfie images — to a real-name verification vendor (shumei / tongdun).

Parameters

Name	Type	Required	Description
`subject_id`	`string`	Required	User / account id under evaluation.
`document_type`	`string`	Optional	Identity document type.
`document_country`	`string`	Optional	Issuing country of the document.
`full_name`	`string`	Optional	Full name on the document.
`dob`	`string`	Optional	Date of birth (YYYY-MM-DD).
`document_images`	`string[]`	Optional	Document image references.
`selfie_image`	`string`	Optional	Selfie image reference.
`metadata`	`Record<string, unknown>`	Optional	Arbitrary key/value metadata.

Returns

KycCase { case_id, status }

Example

一次性前置(每个范例都假定已完成):

bash

# No SDK to install — every call is a plain HTTPS request.
# Get a project key by signing in at the console: Google/GitHub gives you
# $2 free credit (email sign-in starts at $0). On 402 INSUFFICIENT_CREDIT,
# POST /v1/account/topup and open the returned checkout_url.
export INFRAI_API_KEY="ifr_pk_proj_..."

bash

curl -X POST https://api.infrai.cc/v1/risk/kyc/submit \
  -H "Authorization: Bearer $INFRAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"subject_id": "..."}'

python

import os, requests

resp = requests.post(
    "https://api.infrai.cc/v1/risk/kyc/submit",
    headers={"Authorization": f"Bearer {os.environ['INFRAI_API_KEY']}"},
    json={'subject_id': '...'},
)
resp.raise_for_status()
print(resp.json())

javascript

const resp = await fetch(
  "https://api.infrai.cc/v1/risk/kyc/submit",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({"subject_id": "..."}),
  },
);
console.log(await resp.json());

typescript

const resp = await fetch(
  "https://api.infrai.cc/v1/risk/kyc/submit",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({"subject_id": "..."}),
  },
);
if (!resp.ok) throw new Error(`infrai ${resp.status}`);
const data: unknown = await resp.json();
console.log(data);

risk.kyc.status

GET /v1/risk/kyc/status

Fetch the current state (pending / approved / rejected / manual_review) of a previously submitted KYC verification. Sticky_resource: status must be polled on the same vendor that accepted the submission.

Parameters

Name	Type	Required	Description
`subject_id`	`string`	Required	User / account id under evaluation.

Returns

KycCase { case_id, status, decided_at? }

Example

一次性前置(每个范例都假定已完成):

bash

# No SDK to install — every call is a plain HTTPS request.
# Get a project key by signing in at the console: Google/GitHub gives you
# $2 free credit (email sign-in starts at $0). On 402 INSUFFICIENT_CREDIT,
# POST /v1/account/topup and open the returned checkout_url.
export INFRAI_API_KEY="ifr_pk_proj_..."

bash

curl -X GET https://api.infrai.cc/v1/risk/kyc/status \
  -H "Authorization: Bearer $INFRAI_API_KEY"

python

import os, requests

resp = requests.get(
    "https://api.infrai.cc/v1/risk/kyc/status",
    headers={"Authorization": f"Bearer {os.environ['INFRAI_API_KEY']}"},
)
resp.raise_for_status()
print(resp.json())

javascript

const resp = await fetch(
  "https://api.infrai.cc/v1/risk/kyc/status",
  {
    method: "GET",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
    },
  },
);
console.log(await resp.json());

typescript

const resp = await fetch(
  "https://api.infrai.cc/v1/risk/kyc/status",
  {
    method: "GET",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
    },
  },
);
if (!resp.ok) throw new Error(`infrai ${resp.status}`);
const data: unknown = await resp.json();
console.log(data);

Advanced: pin a vendor

By default infrai routes each call to the best available provider — you do not pick a vendor. As an escape hatch, this capability accepts an optional vendor parameter to pin one specific provider. Every live vendor for this capability is available in real time from the discovery endpoint for the capability id — see the discovery API.

GET /v1/discovery/{capability}

risk.score

All capabilities

Every routed capability in this module — the complete public REST contract. The methods above are the guided walkthrough; this index is the full reference.

Capability	Endpoint	Description
`risk.device.fingerprint`	`POST /v1/risk/device/fingerprint`	Resolve a stable device fingerprint / visitor id from a client-collected token plus IP and user-agent signals, for bot and incognito detection. Served by a vendor (sift / castle).
`risk.event.report`	`POST /v1/risk/event/report`	Report a risk-relevant event or label (chargeback, fraud, abuse) back to the vendor as feedback to improve future scoring.
`risk.kyc.status`	`GET /v1/risk/kyc/status`	Fetch the current state (pending / approved / rejected / manual_review) of a previously submitted KYC verification. Sticky_resource: status must be polled on the same vendor that accepted the submission.
`risk.kyc.submit`	`POST /v1/risk/kyc/submit`	Submit an identity-verification (KYC) request — document type, name, DOB, document/selfie images — to a real-name verification vendor (shumei / tongdun).
`risk.ofac.check`	`POST /v1/risk/ofac/check`	Screen a name / address / id against sanctions lists (OFAC SDN, EU, UN consolidated), returning match details. Billable work-action.
`risk.score`	`POST /v1/risk/score`	Score a user/account event (login, payment, signup) for fraud and abuse risk, returning a normalized 0..1 score plus an accept / review / reject disposition. Billable work-action, ML high-margin (service_markup).

End-to-end example

A production-style walkthrough of this module: configure once, then run the flow. It exercises most of the module's APIs.

A copy-paste-runnable single-file Python program (stdlib only, no SDK): set your INFRAI_API_KEY, run it, and walk this module's core flow with REAL billed calls — later steps reuse real fields returned by earlier ones. The 12-line helper is the entire integration.

python

#!/usr/bin/env python3
"""Infrai · risk — runnable real-app example (single file, zero deps).

Copy this file, set your key, run it: every step is a REAL call to
api.infrai.cc, billed at the real (tiny) per-call price, printing the
live JSON response. Get a key at https://console.infrai.cc (Google/
GitHub sign-in grants $2 free credit). No SDK — the 12-line helper
below is the entire integration."""
import json
import os
from urllib import error, request

KEY = os.environ.get("INFRAI_API_KEY") or "ifr_pk_proj_..."  # <- your key
BASE = "https://api.infrai.cc"


# Same raw HTTPS POST/GET as every per-method example on this page —
# wrapped once for reuse. There is nothing else to it: no SDK.
def infrai(method, path, body=None):
    req = request.Request(
        BASE + path, method=method,
        data=json.dumps(body).encode() if body is not None else None,
        headers={"Authorization": f"Bearer {KEY}",
                 "Content-Type": "application/json"})
    try:
        with request.urlopen(req, timeout=60) as r:
            return json.loads(r.read())
    except error.HTTPError as e:
        return json.loads(e.read())


def show(label, resp):
    print(f"\n== {label} ==")
    print(json.dumps(resp, indent=2, ensure_ascii=False))
    return resp


# 1) risk.score — POST /v1/risk/score · Score a user/account event (login, payment, signup) for fraud and abuse risk, returning a normalized 0..1 score plus an accept / review / reject disposition. Billable work-action, ML high-margin (service_markup).
r1 = show("risk.score", infrai("POST", "/v1/risk/score", {}))

# 2) risk.ofac.check — POST /v1/risk/ofac/check · Screen a name / address / id against sanctions lists (OFAC SDN, EU, UN consolidated), returning match details. Billable work-action.
r2 = show("risk.ofac.check", infrai("POST", "/v1/risk/ofac/check", {"name":"..."}))

# 3) risk.device.fingerprint — POST /v1/risk/device/fingerprint · Resolve a stable device fingerprint / visitor id from a client-collected token plus IP and user-agent signals, for bot and incognito detection. Served by a vendor (sift / castle).
r3 = show("risk.device.fingerprint", infrai("POST", "/v1/risk/device/fingerprint", {}))

# 4) risk.kyc.status — GET /v1/risk/kyc/status · Fetch the current state (pending / approved / rejected / manual_review) of a previously submitted KYC verification. Sticky_resource: status must be polled on the same vendor that accepted the submission.
r4 = show("risk.kyc.status", infrai("GET", "/v1/risk/kyc/status"))

一次性前置(每个范例都假定已完成):

bash

# No SDK to install — every call is a plain HTTPS request.
# Get a project key by signing in at the console: Google/GitHub gives you
# $2 free credit (email sign-in starts at $0). On 402 INSUFFICIENT_CREDIT,
# POST /v1/account/topup and open the returned checkout_url.
export INFRAI_API_KEY="ifr_pk_proj_..."

bash

# 1) Auth: every call is a raw HTTPS request to the Infrai gateway carrying
#    only your project key. No SDK, no install.
#    Get your key: sign in with Google/GitHub at the console for a project key
#    + $2 free credit (email sign-in starts at $0). On 402 INSUFFICIENT_CREDIT,
#    POST /v1/account/topup and open the returned checkout_url.
export INFRAI_API_KEY="ifr_pk_proj_..."   # from the console


# 2) risk.score
curl -X POST https://api.infrai.cc/v1/risk/score \
  -H "Authorization: Bearer $INFRAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

# 3) risk.ofac.check
curl -X POST https://api.infrai.cc/v1/risk/ofac/check \
  -H "Authorization: Bearer $INFRAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "..."}'

# 4) risk.device.fingerprint
curl -X POST https://api.infrai.cc/v1/risk/device/fingerprint \
  -H "Authorization: Bearer $INFRAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

# 5) risk.event.report
curl -X POST https://api.infrai.cc/v1/risk/event/report \
  -H "Authorization: Bearer $INFRAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"event_type": "..."}'

# 6) risk.kyc.submit
curl -X POST https://api.infrai.cc/v1/risk/kyc/submit \
  -H "Authorization: Bearer $INFRAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"subject_id": "..."}'

# 7) risk.kyc.status
curl -X GET https://api.infrai.cc/v1/risk/kyc/status \
  -H "Authorization: Bearer $INFRAI_API_KEY"

python

# 1) Auth: every call is a raw HTTPS request carrying only your project key.
#    No SDK to install — just the `requests` library.
import os, requests

BASE = "https://api.infrai.cc"
HEADERS = {
    "Authorization": f"Bearer {os.environ['INFRAI_API_KEY']}",
    "Content-Type": "application/json",
}


# 2) risk.score
import os, requests

resp = requests.post(
    "https://api.infrai.cc/v1/risk/score",
    headers={"Authorization": f"Bearer {os.environ['INFRAI_API_KEY']}"},
    json={},
)
resp.raise_for_status()
print(resp.json())

# 3) risk.ofac.check
import os, requests

resp = requests.post(
    "https://api.infrai.cc/v1/risk/ofac/check",
    headers={"Authorization": f"Bearer {os.environ['INFRAI_API_KEY']}"},
    json={'name': '...'},
)
resp.raise_for_status()
print(resp.json())

# 4) risk.device.fingerprint
import os, requests

resp = requests.post(
    "https://api.infrai.cc/v1/risk/device/fingerprint",
    headers={"Authorization": f"Bearer {os.environ['INFRAI_API_KEY']}"},
    json={},
)
resp.raise_for_status()
print(resp.json())

# 5) risk.event.report
import os, requests

resp = requests.post(
    "https://api.infrai.cc/v1/risk/event/report",
    headers={"Authorization": f"Bearer {os.environ['INFRAI_API_KEY']}"},
    json={'event_type': '...'},
)
resp.raise_for_status()
print(resp.json())

# 6) risk.kyc.submit
import os, requests

resp = requests.post(
    "https://api.infrai.cc/v1/risk/kyc/submit",
    headers={"Authorization": f"Bearer {os.environ['INFRAI_API_KEY']}"},
    json={'subject_id': '...'},
)
resp.raise_for_status()
print(resp.json())

# 7) risk.kyc.status
import os, requests

resp = requests.get(
    "https://api.infrai.cc/v1/risk/kyc/status",
    headers={"Authorization": f"Bearer {os.environ['INFRAI_API_KEY']}"},
)
resp.raise_for_status()
print(resp.json())

javascript

// 1) Auth: every call is a raw HTTPS request carrying only your project key.
//    No SDK to install — just the built-in fetch().
const BASE = "https://api.infrai.cc";
const HEADERS = {
  "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
  "Content-Type": "application/json",
};


// 2) risk.score
const resp = await fetch(
  "https://api.infrai.cc/v1/risk/score",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({}),
  },
);
console.log(await resp.json());

// 3) risk.ofac.check
const resp = await fetch(
  "https://api.infrai.cc/v1/risk/ofac/check",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({"name": "..."}),
  },
);
console.log(await resp.json());

// 4) risk.device.fingerprint
const resp = await fetch(
  "https://api.infrai.cc/v1/risk/device/fingerprint",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({}),
  },
);
console.log(await resp.json());

// 5) risk.event.report
const resp = await fetch(
  "https://api.infrai.cc/v1/risk/event/report",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({"event_type": "..."}),
  },
);
console.log(await resp.json());

// 6) risk.kyc.submit
const resp = await fetch(
  "https://api.infrai.cc/v1/risk/kyc/submit",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({"subject_id": "..."}),
  },
);
console.log(await resp.json());

// 7) risk.kyc.status
const resp = await fetch(
  "https://api.infrai.cc/v1/risk/kyc/status",
  {
    method: "GET",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
    },
  },
);
console.log(await resp.json());

typescript

// 1) Auth: every call is a raw HTTPS request carrying only your project key.
//    No SDK to install — just the built-in fetch(), typed.
const BASE = "https://api.infrai.cc";
const HEADERS: Record<string, string> = {
  "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
  "Content-Type": "application/json",
};


// 2) risk.score
const resp = await fetch(
  "https://api.infrai.cc/v1/risk/score",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({}),
  },
);
if (!resp.ok) throw new Error(`infrai ${resp.status}`);
const data: unknown = await resp.json();
console.log(data);

// 3) risk.ofac.check
const resp = await fetch(
  "https://api.infrai.cc/v1/risk/ofac/check",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({"name": "..."}),
  },
);
if (!resp.ok) throw new Error(`infrai ${resp.status}`);
const data: unknown = await resp.json();
console.log(data);

// 4) risk.device.fingerprint
const resp = await fetch(
  "https://api.infrai.cc/v1/risk/device/fingerprint",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({}),
  },
);
if (!resp.ok) throw new Error(`infrai ${resp.status}`);
const data: unknown = await resp.json();
console.log(data);

// 5) risk.event.report
const resp = await fetch(
  "https://api.infrai.cc/v1/risk/event/report",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({"event_type": "..."}),
  },
);
if (!resp.ok) throw new Error(`infrai ${resp.status}`);
const data: unknown = await resp.json();
console.log(data);

// 6) risk.kyc.submit
const resp = await fetch(
  "https://api.infrai.cc/v1/risk/kyc/submit",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({"subject_id": "..."}),
  },
);
if (!resp.ok) throw new Error(`infrai ${resp.status}`);
const data: unknown = await resp.json();
console.log(data);

// 7) risk.kyc.status
const resp = await fetch(
  "https://api.infrai.cc/v1/risk/kyc/status",
  {
    method: "GET",
    headers: {
      "Authorization": `Bearer ${process.env.INFRAI_API_KEY}`,
    },
  },
);
if (!resp.ok) throw new Error(`infrai ${resp.status}`);
const data: unknown = await resp.json();
console.log(data);