--- title: "POST /session/authenticate" method: POST path: "/session/authenticate" --- # POST /session/authenticate `POST /session/authenticate` Authenticates a session with an account ## Query parameters - `accounts_linked` boolean ## Request body - SessionAuthenticateRequest - `account` object, required — The account to authenticate. See [Account Object](/api-reference/types/account) for more information. - `id` string, required — The account identifier - `email` string — The email associated with the account - `phone` string — The phone number on file for the account in E.164 format (e.g. +14155550123). Used for multi-accounting phone matching. - `first_name` string — The account holder's first name. Combined with last_name for multi-accounting name matching. - `last_name` string — The account holder's last name. Combined with first_name for multi-accounting name matching. - `username` string — The username associated with the account. Used for multi-accounting username matching. - `expected_countries` string[] — Countries the account is expected to legitimately operate from, as ISO 3166-1 alpha-2 codes (e.g. ["US", "CA"]). A non-empty list replaces the stored list; an empty or omitted list leaves the stored list unchanged. - `metadata` object — Additional metadata about the account - `group` string — Groups must be enabled for the project to use this field. See [Multi Accounting Groups](/integration/advanced/multi-accounting-groups) for more information. - `lists` string[] — Array of list names to add the account to during authentication. Lists will be automatically created if they don't exist. See [Lists](/action/lists) for more information. - `session_id` string, required — The ID of the session to authenticate ## Response `200` Session authentication response - SessionAuthenticateResponse - `project_id` string — The ID of the project - `session_id` string — The ID of the session - `account_id` string — The ID of the account - `request_id` string — The ID of the request - `decision` string — Decision about the authenticity (Real/Fake) - `account_score` number, float — Overall account risk score - `bot` number, float — Bot detection score - `multiple_accounts` number, float — Multiple accounts detection score - `risk_signals` number, float — Risk signals score - `accounts_linked` integer — Number of accounts linked to this account - `lists` string[] — Lists the account belongs to - `session` SessionDetails - `start_time` string, date-time — Timestamp when the session started - `true_country_code` string — The true country code of the session - `device_id` string — Device identifier from the session - `network` object - `ip_address` string — IP address of the session - `service_provider` string — Internet service provider - `connection_type` string — Type of network connection - `location` object - `continent` string — Continent code - `country_code` string — Country code - `state` string — State or region - `city` string — City name - `zip_code` string — Postal/ZIP code - `timezone` string — Timezone of the location - `latitude` number, float — Latitude coordinate - `longitude` number, float — Longitude coordinate - `browser` object - `type` string — Browser type - `version` string — Browser version - `language` string — Browser language setting - `user_agent` string — User agent string - `timezone` string — Browser timezone setting - `device` object - `category` 'desktop' | 'mobile' | 'tablet' | 'console' | 'smarttv' | 'wearable' | 'embedded' | 'other' — Device category. See [Device Categories](/signals-scores/device#device-categories) for details. - `type` string — Device type - `os` string — Operating system - `cpu_cores` integer — Number of CPU cores - `memory` integer — Amount of memory in GB - `gpu` string — GPU information - `screen_height` number — Screen height in pixels - `screen_width` number — Screen width in pixels - `bot` object - `mouse_num_events` integer — Number of mouse events - `click_num_events` integer — Number of click events - `keyboard_num_events` integer — Number of keyboard events - `touch_num_events` integer — Number of touch events - `clipboard_num_events` integer — Number of clipboard events - `risk_signals` object - `device_risk` boolean — Device risk flag - `proxy` boolean — Proxy usage flag - `vpn` boolean — VPN usage flag - `tor` boolean — Tor usage flag - `spoofed_ip` boolean — Spoofed IP flag - `datacenter` boolean — Datacenter IP flag - `recent_fraud_ip` boolean — Recent fraud IP flag - `impossible_travel` boolean — Impossible travel flag - `device_network_mismatch` boolean — Device network mismatch flag - `location_spoofing` boolean — Location spoofing flag - `risk_signal_scores` object - `device_risk` number, float — Device risk score - `proxy` number, float — Proxy detection score - `vpn` number, float — VPN detection score - `tor` number, float — Tor detection score - `datacenter` number, float — Datacenter detection score - `recent_fraud_ip` number, float — Recent fraud IP detection score - `impossible_travel` number, float — Impossible travel detection score - `device_network_mismatch` number, float — Device network mismatch score - `location_spoofing` number, float — Location spoofing detection score - `risk_signal_details` RiskSignalDetails - `network` string[] — See [Risk Signal Details](/signals-scores/risk-signals) for descriptions. - `device` string[] — See [Risk Signal Details](/signals-scores/risk-signals) for descriptions. - `mobile` Mobile — Native mobile SDK device facts. An empty object for sessions that did not come from the native iOS/Android SDK. - `brand` string, nullable — Device brand as reported by the native SDK (e.g. Apple, samsung) - `model` string, nullable — Device model as reported by the native SDK - `system_memory_gb` integer, nullable — Total device RAM in GB. Null on Android (not collected by the SDK yet) - `boot_count` integer, nullable — Device boot count. Null on iOS (not exposed by the platform) - `system_uptime_days` number, float, nullable — Days since the device last booted - `battery_level` number, float, nullable — Battery level between 0 and 1. Null on Android (not collected by the SDK yet) - `languages` string[], nullable — Device language preferences (e.g. ["en-US"]) - `oem_app_integrity` string, nullable — OEM app integrity verdict: passed, failed, or unavailable - `oem_device_integrity` string, nullable — OEM device integrity verdict: passed, failed, or unavailable - `account` AccountDetails - `account` object - `id` string — The account identifier - `email` string — The email associated with the account - `phone` string — The phone number stored for the account in E.164 format - `first_name` string — The account holder's first name - `last_name` string — The account holder's last name - `username` string — The username stored for the account - `expected_countries` string[] — Countries the account is expected to operate from (ISO 3166-1 alpha-2 codes) - `metadata` object — Additional metadata about the account - `group` string — The group associated with the account - `num_sessions` integer — Number of sessions associated with this account - `first_seen` string, date-time — Timestamp when the account was first seen - `last_seen` string, date-time — Timestamp when the account was last seen - `last_session` string — ID of the last session - `country` string — Country code of the account - `countries` string[] — List of countries associated with this account - `unique_devices` object - `1_day` integer — Number of unique devices in the last day - `7_day` integer — Number of unique devices in the last 7 days - `unique_networks` object - `1_day` integer — Number of unique networks in the last day - `7_day` integer — Number of unique networks in the last 7 days - `email` object - `email` string — Email address - `disposable` boolean — Whether the email is disposable - `personal` boolean — Whether the email is personal - `valid` boolean — Whether the email is valid - `domain_type` 'relay' | 'personal' | 'disposable' | 'business' | 'government' | 'education' | 'invalid' | 'not_active' — The type of domain. See [Domain Types](/signals-scores/email#domain-types) for details. - `email_score` number, float — Email risk score from -1 (most trustworthy) to 1 (most risky) - `trust_signals` string[] — Array of trust signals detected for this email. See [Trust Flags](/signals-scores/email#trust-flags) for descriptions. - `risk_signals` string[] — Array of risk signals detected for this email. See [Risk Flags](/signals-scores/email#risk-flags) for descriptions. - `num_account_from_domain` integer — Number of accounts from the same apex domain seen in your project. Capped at 1000. See [Domain Account Velocity](/signals-scores/email#domain-account-velocity) for details. - `risk_signal_average` object - `device_risk` number, float — Device risk score - `proxy` number, float — Proxy detection score - `vpn` number, float — VPN detection score - `tor` number, float — Tor detection score - `spoofed_ip` number, float — Spoofed IP detection score - `datacenter` number, float — Datacenter detection score - `recent_fraud_ip` number, float — Recent fraud IP detection score - `impossible_travel` number, float — Impossible travel detection score - `device_network_mismatch` number, float — Device network mismatch score - `location_spoofing` number, float — Location spoofing detection score - `linked_accounts` LinkedAccount[] — List of accounts linked to the authenticated account (only included when accounts_linked=true) - `account_id` string — The ID of the linked account - `score` number, float — Confidence score of the link between accounts - `email` string — Email associated with the linked account - `phone` string — Phone number associated with the linked account - `first_name` string — First name associated with the linked account - `last_name` string — Last name associated with the linked account - `username` string — Username associated with the linked account - `expected_countries` string[] — Expected countries declared for the linked account (ISO 3166-1 alpha-2 codes) - `match_type` string[] — Types of matches that linked these accounts. Possible values: browser, device, network, email, phone, username, name, mobile_id, apple_device_check. - `lists` string[] — Lists the linked account belongs to - `metadata` object — Additional metadata about the linked account ## Other responses - `400` — Session not found or invalid request --- [API](https://skmtc.net/verisoul/apis/verisoul-api.md) · [All operations](https://skmtc.net/verisoul/apis/verisoul-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/verisoul/verisoul-api/versions/a4f2fd0ee333/schema)