--- title: "POST /v1/{+parent}/assessments" method: POST path: "/v1/{+parent}/assessments" tags: ["projects"] --- # POST /v1/{+parent}/assessments `POST /v1/{+parent}/assessments` Creates an Assessment of the likelihood an event is legitimate. ## Path parameters - `parent` string, required ## Request body - GoogleCloudRecaptchaenterpriseV1Assessment — A reCAPTCHA Enterprise assessment resource. - `name` string — Output only. Identifier. The resource name for the Assessment in the format `projects/{project}/assessments/{assessment}`. - `fraudPreventionAssessment` GoogleCloudRecaptchaenterpriseV1FraudPreventionAssessment — Assessment for Fraud Prevention. - `cardTestingVerdict` GoogleCloudRecaptchaenterpriseV1FraudPreventionAssessmentCardTestingVerdict — Information about card testing fraud, where an adversary is testing fraudulently obtained cards or brute forcing their details. - `risk` number, float — Output only. Probability of this transaction attempt being part of a card testing attack. Values are from 0.0 (lowest) to 1.0 (highest). - `riskReasons` GoogleCloudRecaptchaenterpriseV1FraudPreventionAssessmentRiskReason[] — Output only. Reasons why the transaction is probably fraudulent and received a high transaction risk score. - `reason` 'REASON_UNSPECIFIED' | 'HIGH_TRANSACTION_VELOCITY' | 'EXCESSIVE_ENUMERATION_PATTERN' | 'SHORT_IDENTITY_HISTORY' | 'GEOLOCATION_DISCREPANCY' | 'ASSOCIATED_WITH_FRAUD_CLUSTER' — Output only. Risk reasons applicable to the Fraud Prevention assessment. - `stolenInstrumentVerdict` GoogleCloudRecaptchaenterpriseV1FraudPreventionAssessmentStolenInstrumentVerdict — Information about stolen instrument fraud, where the user is not the legitimate owner of the instrument being used for the purchase. - `risk` number, float — Output only. Probability of this transaction being executed with a stolen instrument. Values are from 0.0 (lowest) to 1.0 (highest). - `transactionRisk` number, float — Output only. Probability of this transaction being fraudulent. Summarizes the combined risk of attack vectors below. Values are from 0.0 (lowest) to 1.0 (highest). - `behavioralTrustVerdict` GoogleCloudRecaptchaenterpriseV1FraudPreventionAssessmentBehavioralTrustVerdict — Information about behavioral trust of the transaction. - `trust` number, float — Output only. Probability of this transaction attempt being executed in a behaviorally trustworthy way. Values are from 0.0 (lowest) to 1.0 (highest). - `policyEvaluation` GoogleCloudRecaptchaenterpriseV1PolicyEvaluation — Information about the policy evaluation. - `challengeRuleEvaluation` GoogleCloudRecaptchaenterpriseV1ChallengeRuleEvaluation — Information about the evaluation of a `ChallengeRule`. - `firewallPolicyAssessment` GoogleCloudRecaptchaenterpriseV1FirewallPolicyAssessment — Policy config assessment. - `error` GoogleRpcStatus — The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). - `details` object[] — A list of messages that carry the error details. There is a common set of message types for APIs to use. - `code` integer — The status code, which should be an enum value of google.rpc.Code. - `message` string — A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. - `firewallPolicy` GoogleCloudRecaptchaenterpriseV1FirewallPolicy — A FirewallPolicy represents a single matching pattern and resulting actions to take. - `description` string — Optional. A description of what this policy aims to achieve, for convenience purposes. The description can at most include 256 UTF-8 characters. - `actions` GoogleCloudRecaptchaenterpriseV1FirewallAction[] — Optional. The actions that the caller should take regarding user access. There should be at most one terminal action. A terminal action is any action that forces a response, such as `AllowAction`, `BlockAction` or `SubstituteAction`. Zero or more non-terminal actions such as `SetHeader` might be specified. A single policy can contain up to 16 actions. - `allow` GoogleCloudRecaptchaenterpriseV1FirewallActionAllowAction — An allow action continues processing a request unimpeded. - `redirect` GoogleCloudRecaptchaenterpriseV1FirewallActionRedirectAction — A redirect action returns a 307 (temporary redirect) response, pointing the user to a reCAPTCHA interstitial page to attach a token. - `substitute` GoogleCloudRecaptchaenterpriseV1FirewallActionSubstituteAction — A substitute action transparently serves a different page than the one requested. - `path` string — Optional. The address to redirect to. The target is a relative path in the current host. Example: "/blog/404.html". - `block` GoogleCloudRecaptchaenterpriseV1FirewallActionBlockAction — A block action serves an HTTP error code a prevents the request from hitting the backend. - `includeRecaptchaScript` GoogleCloudRecaptchaenterpriseV1FirewallActionIncludeRecaptchaScriptAction — An include reCAPTCHA script action involves injecting reCAPTCHA JavaScript code into the HTML returned by the site backend. This reCAPTCHA script is tasked with collecting user signals on the requested web page, issuing tokens as a cookie within the site domain, and enabling their utilization in subsequent page requests. - `setHeader` GoogleCloudRecaptchaenterpriseV1FirewallActionSetHeaderAction — A set header action sets a header and forwards the request to the backend. This can be used to trigger custom protection implemented on the backend. - `key` string — Optional. The header key to set in the request to the backend server. - `value` string — Optional. The header value to set in the request to the backend server. - `name` string — Identifier. The resource name for the FirewallPolicy in the format `projects/{project}/firewallpolicies/{firewallpolicy}`. - `condition` string — Optional. A CEL (Common Expression Language) conditional expression that specifies if this policy applies to an incoming user request. If this condition evaluates to true and the requested path matched the path pattern, the associated actions should be executed by the caller. The condition string is checked for CEL syntax correctness on creation. For more information, see the [CEL spec](https://github.com/google/cel-spec) and its [language definition](https://github.com/google/cel-spec/blob/master/doc/langdef.md). A condition has a max length of 500 characters. - `path` string — Optional. The path for which this policy applies, specified as a glob pattern. For more information on glob, see the [manual page](https://man7.org/linux/man-pages/man7/glob.7.html). A path has a max length of 200 characters. - `assessmentEnvironment` GoogleCloudRecaptchaenterpriseV1AssessmentEnvironment — The environment creating the assessment. This describes your environment (the system invoking CreateAssessment), NOT the environment of your user. - `client` string — Optional. Identifies the client module initiating the CreateAssessment request. This can be the link to the client module's project. Examples include: - "github.com/GoogleCloudPlatform/recaptcha-enterprise-google-tag-manager" - "wordpress.org/plugins/recaptcha-something" - `version` string — Optional. The version of the client module. For example, "1.0.0". - `event` GoogleCloudRecaptchaenterpriseV1Event — The event being assessed. - `userAgent` string — Optional. The user agent present in the request from the user's device related to this event. - `expectedAction` string — Optional. The expected action for this type of event. This should be the same action provided at token generation time on client-side platforms already integrated with recaptcha enterprise. Required for Universal keys. - `requestedUri` string — Optional. The URI resource the user requested that triggered an assessment. - `ja3` string — Optional. JA3 fingerprint for SSL clients. To learn how to compute this fingerprint, please refer to https://github.com/salesforce/ja3. - `headers` string[] — Optional. HTTP header information about the request. - `wafTokenAssessment` boolean — Optional. Flag for running Web Application Firewall (WAF) token assessment. If enabled, the token must be specified, and have been created by a WAF-enabled key. - `fraudPrevention` 'FRAUD_PREVENTION_UNSPECIFIED' | 'ENABLED' | 'DISABLED' — Optional. The Fraud Prevention setting for this assessment. - `express` boolean — Optional. Flag for a reCAPTCHA express request for an assessment without a token. If enabled, `site_key` must reference an Express site key. - `ja4` string — Optional. JA4 fingerprint for SSL clients. To learn how to compute this fingerprint, please refer to https://github.com/FoxIO-LLC/ja4. - `userInfo` GoogleCloudRecaptchaenterpriseV1UserInfo — User information associated with a request protected by reCAPTCHA Enterprise. - `createAccountTime` string, google-datetime — Optional. Creation time for this account associated with this user. Leave blank for non logged-in actions, guest checkout, or when there is no account associated with the current user. - `accountId` string — Optional. For logged-in requests or login/registration requests, the unique account identifier associated with this user. You can use the username if it is stable (meaning it is the same for every request associated with the same user), or any stable user ID of your choice. Leave blank for non logged-in actions or guest checkout. - `userIds` GoogleCloudRecaptchaenterpriseV1UserId[] — Optional. Identifiers associated with this user or request. - `phoneNumber` string — Optional. A phone number. Should use the E.164 format. - `username` string — Optional. A unique username, if different from all the other identifiers and `account_id` that are provided. Can be a unique login handle or display name for a user. - `email` string — Optional. An email address. - `hashedAccountId` string, byte — Optional. Deprecated: use `user_info.account_id` instead. Unique stable hashed user identifier for the request. The identifier must be hashed using hmac-sha256 with stable secret. - `firewallPolicyEvaluation` boolean — Optional. Flag for enabling firewall policy config assessment. If this flag is enabled, the firewall policy is evaluated and a suggested firewall action is returned in the response. - `transactionData` GoogleCloudRecaptchaenterpriseV1TransactionData — Transaction data associated with a payment protected by reCAPTCHA Enterprise. - `transactionId` string — Unique identifier for the transaction. This custom identifier can be used to reference this transaction in the future, for example, labeling a refund or chargeback event. Two attempts at the same transaction should use the same transaction id. - `shippingValue` number, double — Optional. The value of shipping in the specified currency. 0 for free or no shipping. - `shippingAddress` GoogleCloudRecaptchaenterpriseV1TransactionDataAddress — Structured address format for billing and shipping addresses. - `locality` string — Optional. The town/city of the address. - `address` string[] — Optional. The first lines of the address. The first line generally contains the street name and number, and further lines may include information such as an apartment number. - `postalCode` string — Optional. The postal or ZIP code of the address. - `recipient` string — Optional. The recipient name, potentially including information such as "care of". - `regionCode` string — Optional. The CLDR country/region of the address. - `administrativeArea` string — Optional. The state, province, or otherwise administrative area of the address. - `value` number, double — Optional. The decimal value of the transaction in the specified currency. - `gatewayInfo` GoogleCloudRecaptchaenterpriseV1TransactionDataGatewayInfo — Details about the transaction from the gateway. - `name` string — Optional. Name of the gateway service (for example, stripe, square, paypal). - `gatewayResponseCode` string — Optional. Gateway response code describing the state of the transaction. - `cvvResponseCode` string — Optional. CVV response code from the gateway (available only when reCAPTCHA Enterprise is called after authorization). - `avsResponseCode` string — Optional. AVS response code from the gateway (available only when reCAPTCHA Enterprise is called after authorization). - `merchants` GoogleCloudRecaptchaenterpriseV1TransactionDataUser[] — Optional. Information about the user or users fulfilling the transaction. - `accountId` string — Optional. Unique account identifier for this user. If using Account defense, this should match the hashed_account_id field. Otherwise, a unique and persistent identifier for this account. - `email` string — Optional. The email address of the user. - `creationMs` string, int64 — Optional. The epoch milliseconds of the user's account creation. - `phoneNumber` string — Optional. The phone number of the user, with country code. - `emailVerified` boolean — Optional. Whether the email has been verified to be accessible by the user (OTP or similar). - `phoneVerified` boolean — Optional. Whether the phone number has been verified to be accessible by the user (OTP or similar). - `paymentMethod` string — Optional. The payment method for the transaction. The allowed values are: * credit-card * debit-card * gift-card * processor-{name} (If a third-party is used, for example, processor-paypal) * custom-{name} (If an alternative method is used, for example, custom-crypto) - `items` GoogleCloudRecaptchaenterpriseV1TransactionDataItem[] — Optional. Items purchased in this transaction. - `name` string — Optional. The full name of the item. - `value` number, double — Optional. The value per item that the user is paying, in the transaction currency, after discounts. - `merchantAccountId` string — Optional. When a merchant is specified, its corresponding account_id. Necessary to populate marketplace-style transactions. - `quantity` string, int64 — Optional. The quantity of this item that is being purchased. - `currencyCode` string — Optional. The currency code in ISO-4217 format. - `user` GoogleCloudRecaptchaenterpriseV1TransactionDataUser — Details about a user's account involved in the transaction. - `accountId` string — Optional. Unique account identifier for this user. If using Account defense, this should match the hashed_account_id field. Otherwise, a unique and persistent identifier for this account. - `email` string — Optional. The email address of the user. - `creationMs` string, int64 — Optional. The epoch milliseconds of the user's account creation. - `phoneNumber` string — Optional. The phone number of the user, with country code. - `emailVerified` boolean — Optional. Whether the email has been verified to be accessible by the user (OTP or similar). - `phoneVerified` boolean — Optional. Whether the phone number has been verified to be accessible by the user (OTP or similar). - `billingAddress` GoogleCloudRecaptchaenterpriseV1TransactionDataAddress — Structured address format for billing and shipping addresses. - `locality` string — Optional. The town/city of the address. - `address` string[] — Optional. The first lines of the address. The first line generally contains the street name and number, and further lines may include information such as an apartment number. - `postalCode` string — Optional. The postal or ZIP code of the address. - `recipient` string — Optional. The recipient name, potentially including information such as "care of". - `regionCode` string — Optional. The CLDR country/region of the address. - `administrativeArea` string — Optional. The state, province, or otherwise administrative area of the address. - `cardBin` string — Optional. The Bank Identification Number - generally the first 6 or 8 digits of the card. - `cardLastFour` string — Optional. The last four digits of the card. - `userIpAddress` string — Optional. The IP address in the request from the user's device related to this event. - `token` string — Optional. The user response token provided by the reCAPTCHA Enterprise client-side integration on your site. - `siteKey` string — Optional. The site key that was used to invoke reCAPTCHA Enterprise on your site and generate the token. - `phoneFraudAssessment` GoogleCloudRecaptchaenterpriseV1PhoneFraudAssessment — Assessment for Phone Fraud - `smsTollFraudVerdict` GoogleCloudRecaptchaenterpriseV1SmsTollFraudVerdict — Information about SMS toll fraud. - `risk` number, float — Output only. Probability of an SMS event being fraudulent. Values are from 0.0 (lowest) to 1.0 (highest). - `reasons` string[] — Output only. Reasons contributing to the SMS toll fraud verdict. - `riskAnalysis` GoogleCloudRecaptchaenterpriseV1RiskAnalysis — Risk analysis result for an event. - `extendedVerdictReasons` string[] — Output only. Additional reasons contributing to the risk analysis verdict. These reasons are available to Enterprise tier projects only. Contact sales for more information. The set of reasons is subject to change. - `verifiedBots` GoogleCloudRecaptchaenterpriseV1Bot[] — Output only. Bots with identities that have been verified by reCAPTCHA and detected in the event. - `botType` 'BOT_TYPE_UNSPECIFIED' | 'AI_AGENT' | 'CONTENT_SCRAPER' | 'SEARCH_INDEXER' — Optional. Enumerated field representing the type of bot. - `name` string — Optional. Enumerated string value that indicates the identity of the bot, formatted in kebab-case. Current example values include the following: * google-agent * browser-base * chat-gpt * aws-bedrock * cybaa-bot * cloudflare * payhawk Ensure that your applications can handle identifier values not explicitly listed here. Deprecated values might take some time to stop showing up in responses. New values can be pushed so this list should be taken as non exhaustive. - `score` number, float — Output only. Legitimate event score from 0.0 to 1.0. (1.0 means very likely legitimate traffic while 0.0 means very likely non-legitimate traffic). - `challenge` 'CHALLENGE_UNSPECIFIED' | 'NOCAPTCHA' | 'PASSED' | 'FAILED' — Output only. Challenge information for Universal, `POLICY_BASED_CHALLENGE` and `INVISIBLE` keys. - `lastChallengeType` 'CHALLENGE_TYPE_UNSPECIFIED' | 'CHALLENGE_TYPE_VISUAL' | 'CHALLENGE_TYPE_AUDIO' — Output only. Type of the last challenge presented to the user for Universal, `POLICY_BASED_CHALLENGE` and `INVISIBLE` keys. The field is only set when a challenge was presented to the user. - `reasons` string[] — Output only. Reasons contributing to the risk analysis verdict. - `accountDefenderAssessment` GoogleCloudRecaptchaenterpriseV1AccountDefenderAssessment — Account defense risk assessment. - `accountTakeoverVerdict` GoogleCloudRecaptchaenterpriseV1AccountDefenderAssessmentAccountTakeoverVerdict — Account takeover risk assessment. - `riskReasons` GoogleCloudRecaptchaenterpriseV1AccountDefenderAssessmentAccountRiskReason[] — Output only. Unordered list. Reasons why the request appears risky. Risk reasons can be returned even if the risk is low, as trustworthy requests can still have some risk signals. - `reason` 'RISK_REASON_UNSPECIFIED' | 'CLIENT_HISTORICAL_BOT_ACTIVITY' | 'ACCOUNT_IN_LARGE_RELATED_GROUP' | 'CLIENT_ACCESSED_MANY_ACCOUNTS' | 'DISPOSABLE_EMAIL_DOMAIN' — Output only. A risk reason associated with this request. - `trustReasons` GoogleCloudRecaptchaenterpriseV1AccountDefenderAssessmentAccountTrustReason[] — Output only. Unordered list. Reasons why the request appears trustworthy. Trust reasons can be returned even if the risk is high, as risky requests can still have some trust signals. - `reason` 'TRUST_REASON_UNSPECIFIED' | 'PROFILE_MATCH' | 'ACCOUNT_HISTORY_REPUTABLE' | 'IDENTITY_GLOBAL_ACTIVITY_REPUTABLE' | 'IDENTITY_HISTORY_REPUTABLE' — Output only. A trust reason associated with this request. - `risk` number, float — Output only. Account takeover attempt probability. Values are from 0.0 (lowest risk) to 1.0 (highest risk). - `labels` string[] — Output only. Labels for this request. - `accountVerification` GoogleCloudRecaptchaenterpriseV1AccountVerificationInfo — Information about account verification, used for identity verification. - `endpoints` GoogleCloudRecaptchaenterpriseV1EndpointVerificationInfo[] — Optional. Endpoints that can be used for identity verification. - `emailAddress` string — Email address for which to trigger a verification request. - `phoneNumber` string — Phone number for which to trigger a verification request. Should be given in E.164 format. - `lastVerificationTime` string, google-datetime — Output only. Timestamp of the last successful verification for the endpoint, if any. - `requestToken` string — Output only. Token to provide to the client to trigger endpoint verification. It must be used within 15 minutes. - `languageCode` string — Optional. Language code preference for the verification message, set as a IETF BCP 47 language code. - `latestVerificationResult` 'RESULT_UNSPECIFIED' | 'SUCCESS_USER_VERIFIED' | 'ERROR_USER_NOT_VERIFIED' | 'ERROR_SITE_ONBOARDING_INCOMPLETE' | 'ERROR_RECIPIENT_NOT_ALLOWED' | 'ERROR_RECIPIENT_ABUSE_LIMIT_EXHAUSTED' | 'ERROR_CRITICAL_INTERNAL' | 'ERROR_CUSTOMER_QUOTA_EXHAUSTED' | 'ERROR_VERIFICATION_BYPASSED' | 'ERROR_VERDICT_MISMATCH' — Output only. Result of the latest account verification challenge. - `username` string — Username of the account that is being verified. Deprecated. Customers should now provide the `account_id` field in `event.user_info`. - `privatePasswordLeakVerification` GoogleCloudRecaptchaenterpriseV1PrivatePasswordLeakVerification — Private password leak verification info. - `lookupHashPrefix` string, byte — Required. Exactly 26-bit prefix of the SHA-256 hash of the canonicalized username. It is used to look up password leaks associated with that hash prefix. - `encryptedLeakMatchPrefixes` string[] — Output only. List of prefixes of the encrypted potential password leaks that matched the given parameters. They must be compared with the client-side decryption prefix of `reencrypted_user_credentials_hash` - `encryptedUserCredentialsHash` string, byte — Optional. Encrypted Scrypt hash of the canonicalized username+password. It is re-encrypted by the server and returned through `reencrypted_user_credentials_hash`. - `reencryptedUserCredentialsHash` string, byte — Output only. Corresponds to the re-encryption of the `encrypted_user_credentials_hash` field. It is used to match potential password leaks within `encrypted_leak_match_prefixes`. - `tokenProperties` GoogleCloudRecaptchaenterpriseV1TokenProperties — Properties of the provided event token. - `createTime` string, google-datetime — Output only. The timestamp corresponding to the generation of the token. - `valid` boolean — Output only. Indicates whether the provided user response token is valid. If `false`, the token is invalid, either because the user failed the challenge or for a reason provided in the `invalid_reason` field. - `iosBundleId` string — Output only. The ID of the iOS bundle with which the token was generated (iOS keys only). - `hostname` string — Output only. The hostname of the page on which the token was generated (Web keys only). - `invalidReason` 'INVALID_REASON_UNSPECIFIED' | 'UNKNOWN_INVALID_REASON' | 'MALFORMED' | 'EXPIRED' | 'DUPE' | 'MISSING' | 'BROWSER_ERROR' | 'UNEXPECTED_ACTION' | 'KEY_MISMATCH' | 'DOMAIN_MISMATCH' — Output only. Reason associated with the response when valid = false. - `androidPackageName` string — Output only. The name of the Android package with which the token was generated (Android keys only). - `action` string — Output only. Action name provided at token generation. - `fraudSignals` GoogleCloudRecaptchaenterpriseV1FraudSignals — Fraud signals describing users and cards involved in the transaction. - `userSignals` GoogleCloudRecaptchaenterpriseV1FraudSignalsUserSignals — Signals describing the user involved in this transaction. - `activeDaysLowerBound` integer — Output only. This user (based on email, phone, and other identifiers) has been seen on the internet for at least this number of days. - `syntheticRisk` number, float — Output only. Likelihood (from 0.0 to 1.0) this user includes synthetic components in their identity, such as a randomly generated email address, temporary phone number, or fake shipping address. - `cardSignals` GoogleCloudRecaptchaenterpriseV1FraudSignalsCardSignals — Signals describing the payment card used in this transaction. - `cardLabels` string[] — Output only. The labels for the payment card in this transaction. ## Response `200` Successful response --- [API](https://skmtc.net/google/apis/recaptchaenterprise.md) · [All operations](https://skmtc.net/google/apis/recaptchaenterprise/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/recaptchaenterprise/versions/3b5248d3ca31/schema)