POST /api/v1/assess returns a risk_score from 0 to 100 and a decision. The score is the sum of the weights of the signals that fired, capped at 100.
Decisions
Thresholds between these bands are configurable per organization in the dashboard, so you can tune Clausum to your risk appetite without code changes.
A hard block (for example an email on a
block-severity blocklist, or an amount over your configured maximum) forces decline with a risk_score of 100 and populates blocked_by with the reason.Response shape
signals— short codes of every signal that contributed.signal_details— the weight and human-readable description for each.session_id— persist this to correlate with later reports and webhooks.blocked_by— non-null only when the transaction was hard-blocked.
Signal categories
Blocklist matches
Blocklist matches
Email, email domain, IP, IP range, device fingerprint, card BIN, card hash, country, phone, or customer id present on your blocklists.
block severity hard-declines; flag and review add weight.Email signals
Email signals
Disposable email providers and suspicious TLDs (
.xyz, .top, .click, …).Behavioral signals
Behavioral signals
Very short sessions, no mouse movement, copy-pasted fields, and bot-like patterns — most reliable when paired with the browser SDK.
Amount signals
Amount signals
Configurable min/max limits and statistical outliers compared to your recent transaction history.
Velocity signals
Velocity signals
Repeated transactions from the same email or device within a short window.
Payer history
Payer history
Prior confirmed fraud associated with the email carries a heavy penalty.
Custom rules
Custom rules
Organization-defined rules can add or subtract score, or force a specific decision. Triggered rules appear in
rules_applied.