Skip to main content
GET
List one visit's decisions

Authorizations

X-API-Key
string
header
required

Path Parameters

visit_id
string<uuid>
required

The visit's id.

Query Parameters

limit
integer
default:10

Maximum number of records to return in a single page. Must be between 1 and 1000.

Required range: 1 <= x <= 1000
offset
integer | null

Number of records to skip from the beginning. Use 0 for the first page. Cannot be used with cursor.

Required range: x >= 0
cursor
string | null

Opaque pagination cursor token that identifies the position in the result set. Use the cursor from the previous response to get the next page. Cannot be used with offset.

sort
enum<string> | null

decided_at: when the SDK decided; ties break on the decision's id. Defaults to decided_at desc. The field a list of decisions sorts on.

Available options:
decided_at
sort_direction
enum<string> | null

asc or desc, for every key of the sort. Defaults to the field's own: decided_at desc.

Available options:
asc,
desc
step
enum<string>[] | null

Only decisions at this step. Repeat for several.

The funnel step a request maps to under the acceptance policy.

Available options:
browse,
search,
cart,
checkout,
payment,
account,
signup,
write
outcome
enum<string>[] | null

Only decisions with this recommendation. Repeat for several.

What a decision recommends for a request: let it through, serve a challenge, ask for a stronger credential, or refuse it.

Available options:
allow,
challenge,
step_up,
block

Response

The visit's decisions in the requested order.

One decision of a visit: what the SDK reported, what the merchant did, and where the visit stands.

policy_version_id
string<uuid>
required

The policy version that decided; null for the bundled policy.

report_id
string<uuid>
required

The SDK's id for the record; a resent record with the same id is a duplicate.

decided_at
string<date-time>
required

When the SDK decided, on the merchant's clock.

transport
enum<string>
required

How the visitor reached the merchant.

Available options:
browser,
api,
mcp,
ucp
step
enum<string>
required

The funnel step the request mapped to.

Available options:
browse,
search,
cart,
checkout,
payment,
account,
signup,
write
presence
Presence (v1) · object
required

The presence the policy ran on.

evidence
Evidence (v1) · object[]
required

One entry per reader that contributed, raw: at most 16, with at most 8,192 bytes of detail in all, counted as the UTF-8 of each detail as sent, in RFC 8785 canonical form.

Maximum array length: 16
sdk
Sdk (v1) · object
required

The SDK that computed the decision.

outcome
enum<string>
required

What the decision recommends.

Available options:
allow,
challenge,
step_up,
block
enforcement_mode
enum<string>
required

The mode the SDK applied; a step run report-only because of a rule it could not read is report_only.

Available options:
report_only,
enforce
reasons
enum<string>[]
required

Why the decision came out as it did.

Why a decision came out as it did.

rule_unsupported means the SDK met a rule it cannot read: the rule never matches and the whole step runs report-only. Values may be added.

Available options:
credential_verified,
credential_refused,
web_bot_auth_verified,
tap_verified,
declared_user_agent,
ip_range_match,
detection_scored,
detection_unavailable,
presence_conflict,
challenge_passed,
no_rule_matched,
unobserved,
rule_unsupported
acceptance_decision_id
string<uuid>
required

The decision's id.

environment
enum<string>
required

The application's environment.

Available options:
sandbox,
production
integrity
VisitDecisionIntegrity (v1) · object
required

Baselayer's check on the decision.

identity_level
enum<string> | null

The deepest identity the SDK established; null for a person, an unknown visitor or an uncorroborated claim.

Available options:
L1,
L2,
L3
rule
string | null

The policy rule that fired; null when none matched.

Maximum string length: 128
Example:

"vl2"

policy_version_label
string | null

bundled: and the SDK version, set only when the SDK never fetched a policy.

Maximum string length: 64
Pattern: ^bundled:.+$
Example:

"bundled:1.4.0"

requirement
Requirement (v1) · object

What a step_up or challenge asks for, verbatim from the rule; null otherwise.

expires_at
string<date-time> | null

When the decision stops applying.

visit_id
string<uuid> | null

Its visit; null until the decision is joined to its visit, about a minute after it is reported.

agent
VisitAgent (v1) · object | null

The agent behind the request.

credential
VisitCredential (v1) · object | null

The presented KYA credential behind the request: its own presentation, or the verified one a session named; null otherwise.

credential_verification
enum<string> | null

Baselayer's conclusion about the credential the request presented or its session named, even when credential is null (a pending or unbacked session); null when the decision names no credential, including a presentation no reader parsed.

Available options:
pending,
verified,
refused
credential_refusal_reason
string | null

Why it was refused, as an error type, unbacked_session included; null unless credential_verification is refused.

Example:

"unbacked_session"

merchant_outcome
enum<string> | null

What the merchant did with the recommendation; null when the SDK could not observe it.

Available options:
allow,
challenge,
step_up,
block
visit
VisitSummary (v1) · object | null

Its visit; null until the decision is joined to its visit, about a minute after it is reported.