Get the risk settings · Ownrecord docs

Returns the brand's risk rules in the mode of the request (spec §20). Until someone changes them the documented defaults apply (isDefault: true, version: 0), suited to prepaid credits:

New customers (no payment older than newCustomer.ageHours, 168): at most 2 top-ups in 24 hours, a first top-up of at most 100 EUR, USD, GBP or CHF, and 3-D Secure on the first payment.
Velocity: per IP network (/24 or /48; 10 attempts and 3 cards an hour), per card (5 attempts in 24 hours) and per email domain of new customers (10 an hour; large mail providers exempt).
Score: country mismatches between the IP, the billing address and the card add points (20, 25, 15), so do a new customer (10) and an elevated one (40); 20 points ask for 3-D Secure, 75 hold the payment for review.
Disposable email addresses are blocked; blocklists always apply.
Fresh balances: no usage cap until set (wallet.usageCapUntilAgeHours).

The counting rules (velocity and the new-customer top-up limits) are on in live mode and off in test mode, where everyone pays with the same test cards from the same machine; turn them on to try them. Amounts are integer micros as strings, per currency; a currency without an amount has no limit.

At a glance

REST: GET /api/v1/risk/settings
MCP tool: risk_settings_get
Operation ID: risk.settings.get
Scope: Brand
Permission: brands:read
Risk tier: read
Dry run: Not supported
Idempotency: Not needed (read only)
Modes: Test and live
Authentication: API key with the brands:read scope
Since: M9

Request

Query parameters

This operation takes no query parameters.

Response

200 OK with a JSON object:

Field	Type	Description
`object`	`"risk_settings"`
`brandId`	`brd_…` ID
`livemode`	boolean
`isDefault`	boolean
`version`	integer (at least 0)
`updatedAt`	date-time or null
`newCustomer`	object
`newCustomer.ageHours`	integer
`newCustomer.topups`	object
`newCustomer.topups.enabled`	boolean
`newCustomer.topups.limit`	integer
`newCustomer.topups.windowHours`	integer
`newCustomer.topups.action`	one of `block`, `review`, `require_3ds`
`newCustomer.firstTopupMax`	object
`newCustomer.firstTopupMax.enabled`	boolean
`newCustomer.firstTopupMax.amounts`	object
`newCustomer.firstTopupMax.action`	one of `block`, `review`, `require_3ds`
`newCustomer.threeDSecureFirstPayment`	boolean
`velocity`	object
`velocity.ipNetwork`	object
`velocity.ipNetwork.enabled`	boolean
`velocity.ipNetwork.limit`	integer
`velocity.ipNetwork.windowHours`	integer
`velocity.ipNetwork.action`	one of `block`, `review`, `require_3ds`
`velocity.ipNetwork.cardLimit`	integer
`velocity.cardFingerprint`	object
`velocity.cardFingerprint.enabled`	boolean
`velocity.cardFingerprint.limit`	integer
`velocity.cardFingerprint.windowHours`	integer
`velocity.cardFingerprint.action`	one of `block`, `review`, `require_3ds`
`velocity.emailDomain`	object
`velocity.emailDomain.enabled`	boolean
`velocity.emailDomain.limit`	integer
`velocity.emailDomain.windowHours`	integer
`velocity.emailDomain.action`	one of `block`, `review`, `require_3ds`
`velocity.emailDomain.exemptDomains`	array of string
`points`	object
`points.ipBillingMismatch`	integer
`points.cardBillingMismatch`	integer
`points.ipCardMismatch`	integer
`points.elevatedCustomer`	integer
`points.newCustomer`	integer
`thresholds`	object
`thresholds.threeDSecure`	integer
`thresholds.review`	integer
`thresholds.block`	integer or null
`disposableEmail`	object
`disposableEmail.enabled`	boolean
`disposableEmail.action`	one of `block`, `review`, `require_3ds`
`wallet`	object
`wallet.usageCapUntilAgeHours`	integer or null
`wallet.usageCap`	object

Examples

The live-mode defaults

HTTP

GET /api/v1/risk/settings
Authorization: Bearer or_test_…

Response (200):

JSON

{
  "object": "risk_settings",
  "brandId": "brd_01m4ttwd3veh9apbewxheq5xh5",
  "livemode": true,
  "isDefault": true,
  "version": 0,
  "updatedAt": null,
  "newCustomer": {
    "ageHours": 168,
    "topups": {
      "enabled": true,
      "limit": 2,
      "windowHours": 24,
      "action": "block"
    },
    "firstTopupMax": {
      "enabled": true,
      "amounts": {
        "CHF": "100000000",
        "EUR": "100000000",
        "GBP": "100000000",
        "USD": "100000000"
      },
      "action": "block"
    },
    "threeDSecureFirstPayment": true
  },
  "velocity": {
    "ipNetwork": {
      "enabled": true,
      "limit": 10,
      "windowHours": 1,
      "action": "block",
      "cardLimit": 3
    },
    "cardFingerprint": {
      "enabled": true,
      "limit": 5,
      "windowHours": 24,
      "action": "block"
    },
    "emailDomain": {
      "enabled": true,
      "limit": 10,
      "windowHours": 1,
      "action": "block",
      "exemptDomains": [
        "aol.com",
        "gmail.com",
        "gmx.at",
        "gmx.de",
        "gmx.net",
        "googlemail.com",
        "hotmail.com",
        "icloud.com",
        "live.com",
        "mail.com",
        "me.com",
        "msn.com",
        "outlook.com",
        "proton.me",
        "protonmail.com",
        "t-online.de",
        "web.de",
        "yahoo.com",
        "yandex.com"
      ]
    }
  },
  "points": {
    "ipBillingMismatch": 20,
    "cardBillingMismatch": 25,
    "ipCardMismatch": 15,
    "elevatedCustomer": 40,
    "newCustomer": 10
  },
  "thresholds": {
    "threeDSecure": 20,
    "review": 75,
    "block": null
  },
  "disposableEmail": {
    "enabled": true,
    "action": "block"
  },
  "wallet": {
    "usageCapUntilAgeHours": null,
    "usageCap": {}
  }
}

Errors

Code	HTTP status	When	What to do
`permission_denied`	403	You can't read this brand's settings.	Ask an organization owner or admin for a role or scope that allows this action.

It can also return these common errors: validation_failed, api_version_unsupported, authentication_required, api_key_invalid, scope_required, resource_not_found, dry_run_not_supported, rate_limited, internal_error.

At a glance#

Request#

Query parameters#

Response#

Examples#

The live-mode defaults#

Errors#