API
Decisions & enforcement
Turn risk evidence into application behavior using the action returned by your site policy.
On this page
Handle every action
| Action | Application behavior |
|---|---|
| allow | Continue after normal authentication, payment, and application checks. |
| review | Hold the operation for your fraud-review workflow. Do not automatically fulfill. |
| challenge | Present a challenge or your additional verification flow. Keep the operation pending. |
| block | Stop the operation. Offer a safe support or appeal path where appropriate. |
Configure the site policy
bash
curl -X PATCH 'https://api.bastionsecurity.io/api/sites/YOUR_SITE_ID' \
-H "Authorization: Bearer $BASTION_ACCESS_TOKEN" \
-H 'Content-Type: application/json' \
--data '{"challengeMode":"block","threshold":70}'challengeMode accepts monitor, block, or challenge. threshold is 0–100 and defaults to 70. A blocked account produces block. Otherwise monitor allows; at or above the threshold, enforcement blocks or challenges; below the threshold, scores at least 30 produce review and lower scores allow. Changing the threshold can differ from the named risk-level boundaries.
Store useful evidence
- Record request_id and action with the attempted operation.
- Keep signal descriptions and scores so analysts can understand the result.
- Correlate external account_id to your customer; webhook accountId is Bastion’s internal account ID.
- Keep payment and fulfillment idempotency separate from scoring idempotency.
- Use confirmed customer outcomes for your review process; a manual review action is not proof of a chargeback.