Enrichment and in-network reputation for one email address: disposable/ throwaway domain, deliverability, fraud score, plus how often the address has been seen abusing other operators. Also returns canonical, the identity key: every alias that reaches one mailbox (+tags, gmail dot tricks, googlemail.com) collapses to the same string, so compare THAT across accounts to tell whether two signups are one person. is_aliased and alias_tricks say which trick was used, and reject_reason says why an address is unusable. Consumes one row of monthly quota.

Enrichment and in-network reputation for one IP: proxy/VPN/Tor, datacenter ASN, geo, fraud score, and cross-operator abuse history. Consumes one row of monthly quota.

Validity, line type, carrier and fraud score for one phone number. Consumes one row of monthly quota.

Scored events for this tenant, newest first. Free — does not consume quota. Filter by verdict or event type to narrow an investigation.

Aggregate view over a rolling window: totals by verdict, average score and the most common reasons. Free — does not consume quota. Start here to see what changed before drilling into individual events.

This tenant's weight and threshold overrides plus the effective merged engine config. Free. Useful for explaining why a score landed where it did.

The 'why was this blocked?' tool. Returns the event with every check that fired, its weight, and the raw evidence behind it, so the reasoning can be narrated with receipts rather than guessed at. Free.

One call for what a fraud analyst actually wants. Returns enrichment for the entity, its reputation across the CROSS-OPERATOR abuse network (whether this email, IP or device has already burned other businesses, not just yours), and every recent event it appears in — which is how you get from one suspicious signup to the whole ring of accounts sharing its device, IP or inbox. Supply exactly one of email, ip or device_id. Enrichment consumes one row of monthly quota (device_id lookups are free).

Every event sitting on the 'review' verdict, sorted by score descending — the daily triage job. Free.

Run an event through the scoring engine and get {score, verdict, reasons, checks}. When the event carries an email, the response also has an identity block whose email_canonical is the dedupe key for that address — so one call both scores the event and tells you whether the mailbox is one you have already seen. Consumes one row of monthly quota AND records an event — prefer the read-only tools when investigating history rather than testing new input.