Sign in

v1

latestOpenAPI 3.0.22026-08-061611.1 KB

Evaluate entity

Evaluates an entity against the tenant's configured recommendation rules. The entity is enriched with third-party intelligence data and matched against enabled rules in priority order. Only the first matching production rule applies to the returned recommendation. Any matching preview rule is returned separately in preview_rule for impact analysis without affecting the final decision. If no production rule matches, the recommendation defaults to ALLOW.

post/evaluate

Request body

entity_type'ip_address' required

The type of entity to evaluate.

entity_valuestring required

The value of the entity to evaluate. When entity_type is ip_address, this must be a valid IPv4 or IPv6 address.

Example request

{
  "entity_type": "ip_address",
  "entity_value": "1.2.3.4"
}

Response

Entity evaluated successfully.

entity_type'ip_address' required

The type of entity to evaluate.

entitystring required

The entity value that was evaluated (echoed back from the request).

recommendation'ALLOW' | 'TRUST' | 'CHALLENGE' | 'DENY' required

Recommendation derived from the first matching production rule. Defaults to ALLOW when no production rule matches.

Example response

{
  "entity_type": "ip_address",
  "entity": "1.2.3.4",
  "recommendation": "DENY",
  "matched_rule": {
    "rule_name": "Block restricted jurisdictions"
  },
  "data": {
    "country_code": "CN",
    "asn_id": "AS4134",
    "organization_name": "Example ISP",
    "organization_type": "hosting",
    "ip_timezone": "Asia/Shanghai",
    "ip_is_vpn": true
  },
  "preview_rule": {
    "rule_name": "Flag suspicious IPs",
    "recommendation": "DENY"
  }
}