Operations
Custom rules
Express site-specific risk conditions with a bounded comparison grammar and plan-aware rule configuration.
On this page
Create a rule
Pro and Enterprise can create custom rules. Use the Rules dashboard or POST /api/rules with a Bearer access token authorized to manage the site. Enabled rules contribute to risk scoring; they do not independently replace your enforcement policy.
{
"siteId": "YOUR_SITE_ID",
"name": "High-value checkout on new account",
"description": "Adds risk for early high-value orders.",
"condition": "account.age < 2h AND event.type == \"checkout\" AND event.amount > 200",
"scoreContribution": 35,
"enabled": true,
"category": "payment"
}Supported grammar
| Element | Supported values |
|---|---|
| Fields | event.type, event.amount, account.age, account.riskScore, device.accountCount, ip.accountCount, payment.accountCount. |
| Operators | ==, !=, >, <, >=, <=. |
| Values | Double-quoted strings or nonnegative numeric literals. |
| Time suffixes | h or m for age comparisons, such as 2h or 30m. |
| Composition | Comparisons joined by AND; no OR, JavaScript, functions, or arbitrary expressions. |
| Condition length | At most 1,000 characters. |
| scoreContribution | Number from 0 to 100. |
The stored event type for promo_claim is promo, so use event.type == "promo" in rules. device.accountCount means accounts sharing a device, not devices belonging to one account. GET /api/rules/suggestions returns the accepted fields, operators, and templates.
Manage and test rules
PATCH /api/rules/{id} updates a custom rule. Built-in rules can only be enabled or disabled; their name, condition, and contribution are immutable. Built-in rules cannot be deleted. DELETE removes a custom rule. Plan access is enforced by the API, including after downgrade.
- Begin with monitor mode and review real event evidence.
- Check the matched rule in signals and rulesTriggered after scoring.
- Compare legitimate customer outcomes before switching enforcement.
- Use the site policy threshold and challengeMode for the final action.