Fraud Decision API Reference Guide

Introduction

The Fraud Decision API retrieves the fraud verdict for a scan submitted in async fraud mode. In that mode, the device uploads the scan and returns right away without waiting for the verdict; the DyScan backend computes it as soon as the upload lands, so your backend can fetch it server-to-server from this endpoint almost immediately after the scan. This endpoint serves the stored verdict rather than computing on demand, so in the rare event you query before it has finished computing, you'll get a "PENDING" response (see Results Overview). A completed response also contains isFraud and declineReasons for the scan.

Unlike the Integrity Check API (which authenticates with an X-REVIEW-ID and validates a payloadId), the Fraud Decision API authenticates with a secret key passed in the X-API-KEY header. Please contact Dyneti to be issued this key; it is scoped to read fraud decisions for your account.

Results Overview

The Fraud Decision API returns a status of "OK" with the isFraud verdict and declineReasons once the verdict has been computed and stored on the DyScan backend.

If the verdict isn't ready yet, the API returns "PENDING" with isFraud: null. Retry shortly.

If the scanId was not submitted in async fraud mode (i.e. a normal scan), the API returns a 409 status with "NOT_ASYNC" — use the Integrity Check API for those scans instead.

If the scanId is not found, the API returns a 404 status. If the scanId is not a valid UUID, it returns a 400 status.

The Fraud Decision verdict does not expire — you can retrieve it at any time after it has been computed.

Endpoints

Fraud Decision

No OpenAPI specification URL provided

The scanId is passed as a path parameter: GET /fraud-decision/{scanId}.

Here is a table summarizing all possible outputs when the status is 200:

Status	isFraud	Message / Meaning
OK	true/false	The verdict has been computed. declineReasons are included.
PENDING	null	The verdict is still being computed — retry shortly. declineReasons is also null.

Example Code

Python

import requests

scanId = '3d581785-2be8-44da-b6bf-7757e7553537'
endpoint = f'https://api.dyneti.com/fraud-decision/{scanId}'
apiKey = 'example_readFraudDecision_secret_key'

r = requests.get(endpoint, headers={"X-API-KEY": apiKey})
r.json()

Response (verdict ready):

{"status": "OK", "lastFourDigits": "1234", "isFraud": false, "declineReasons": {"formatMismatch": false, "numberMismatch": false, "generatedImage": false, "rateLimited": false, "tamperedFeatures": false}}

Node

const axios = require('axios');

const scanId = '3d581785-2be8-44da-b6bf-7757e7553537';
const endpoint = `https://api.dyneti.com/fraud-decision/${scanId}`;
const apiKey = 'example_readFraudDecision_secret_key';

axios.get(endpoint, {
    headers: {
        'X-API-KEY': apiKey
    }
})
.then(response => {
    console.log(response.data);
})
.catch(error => {
    console.error(error);
});

Response

{"status": "OK", "lastFourDigits": "1234", "isFraud": false, "declineReasons": {"formatMismatch": false, "numberMismatch": false, "generatedImage": false, "rateLimited": false, "tamperedFeatures": false}}

curl

curl -X GET \
  -H "X-API-KEY: example_readFraudDecision_secret_key" \
  "https://api.dyneti.com/fraud-decision/3d581785-2be8-44da-b6bf-7757e7553537"

{"status": "OK", "lastFourDigits": "1234", "isFraud": false, "declineReasons": {"formatMismatch": false, "numberMismatch": false, "generatedImage": false, "rateLimited": false, "tamperedFeatures": false}}