DOCSEARCHbyAlgolia
Submit Docs

TrustPath Fraud Detection API

website·Indexed 32 days ago

https://docs.trustpath.io

An advanced fraud detection system designed to identify and mitigate fraudulent activities. TrustPath analyzes user events—such as account registration, login, and order purchases—to evaluate risk levels and prevent account farming, fake accounts, and fraudulent transactions. It includes a content moderation system to detect prohibited content and provides integrations for Shopify, Auth0, Kinde, and Keycloak.

Tokens
9K
Snippets
28
Records
69
Agent score
59%

What's inside TrustPath

  1. Overview of TrustPath fraud detection

    TrustPath is an advanced fraud detection system that identifies and mitigates fraudulent activities by analyzing critical user data, specifically IP addresses and email addresses. It uses behavioral analysis and algorithms to generate risk scores and actionable insights in real time, allowing developers to implement security during registration, safeguard transactions, and enforce geographic restrictions via a REST API.

  2. Overview of TrustPath.io Content Moderation

    TrustPath.io provides a content_moderation event type to evaluate the risk of textual user-generated content (UGC) in real-time. It is designed to screen posts, messages, product listings, comments, forum threads, and profile descriptions to detect scams, phishing, hate speech, offensive language, and prohibited materials (e.g., drugs, weapons, adult content).

  3. Prevent fraud using Trustpath risk analysis

    Trustpath provides a fraud prevention system that evaluates risks by analyzing IP addresses and email data. The system generates detailed risk scores and data points to identify fraudulent behavior and block threats before they impact business operations.

  4. Understand the Trustpath Fraud Scoring system

    Trustpath assesses the likelihood of fraud by evaluating behavioral signals (such as IP and email addresses) against a set of predefined rules. Each request generates a fraud score from 0 to 100, where 0 indicates low risk and 100 indicates high risk. The system assigns a 'state' based on this score to guide the action taken on the request.

  5. Analyze user behavior with TrustPath Fraud Detection API

    The TrustPath Fraud Detection API identifies potential risks by analyzing specific user events on your platform. Risk analysis is performed on both individual events and across historical data. Common events to track include:

    • Account registration
    • Account login
    • Order purchase
    • User-generated content (e.g., comments, ads, posts)

  6. Fetch enriched user data from Kinde Management API

    TrustPath requires detailed user information (email, first name, last name) beyond the basic user ID.

    1. Create a Kinde M2M application with the read:users scope enabled.
    2. Configure the following environment variables in Kinde (Settings > Data management > Env variables):
      • KINDE_WF_M2M_CLIENT_ID: The Client ID of the M2M app.
      • KINDE_WF_M2M_CLIENT_SECRET: The Client Secret of the M2M app (mark as sensitive).
    3. Use the createKindeAPI helper from @kinde/infrastructure to call the Management API.
    const kindeAPI = await createKindeAPI(event);
const user = await getUserData(kindeAPI, event.context.user.id);

async function getUserData(kindeAPI: any, userId: string) {
  const { data: user } = await kindeAPI.get({ endpoint: `user?id=${userId}` });
  return user;
}

  7. Run Keycloak with TrustPath.io SPI integration via Docker

    To run Keycloak with a custom TrustPath.io SPI provider, use the following Docker configuration. This setup maps the necessary ports, sets admin credentials, provides the TrustPath API credentials via environment variables, and mounts the compiled SPI JAR file into the Keycloak providers directory.
    docker run -p 8080:8080 
  -e KC_BOOTSTRAP_ADMIN_USERNAME=admin 
  -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin 
  -e TRUST_PATH_API_URL=<your_api_url> 
  -e TRUST_PATH_API_KEY=<your_api_key> 
  -v /path/to/your/trustpath.io-integration-example.jar:/opt/keycloak/providers/trustpath.io-integration-example.jar 
  quay.io/keycloak/keycloak:26.2.2 
  start-dev

  8. Implement fraud-based content moderation

    TrustPath assists in content moderation by identifying fraudulent users who spread hate speech, explicit material, or misleading information. It helps platforms maintain community guidelines and brand trust by detecting sophisticated harmful content and bot activity that traditional moderation tools may miss.

  9. Prerequisites for Kinde and TrustPath integration

    To integrate TrustPath with Kinde for fraud detection, you need the following accounts and assets:

    • Kinde Account: A registered account and a configured application.
    • Kinde M2M Application: A dedicated Machine-to-Machine (M2M) app to access the Kinde Management API.
    • TrustPath Account: A registered account.
    • TrustPath API Key: Obtained from the TrustPath console under [Your Name] > API Keys.
    • Git Repository: A repository to store the workflow code (an example is provided by TrustPath).

  10. Configure Keycloak Authentication Flow for TrustPath.io Fraud Detection

    To activate the TrustPath.io Fraud Detection SPI within Keycloak's registration process:

    1. Navigate to Configure > Authentication.
    2. Duplicate the existing Registration flow and name it Registration-flow-with-trustpath-io.
    3. Select the new flow, click the three-dot menu, choose Bind Flow, set the Binding Type to Registration Flow, and bind it.
    4. Open the Registration-flow-with-trustpath-io flow and click the + icon to add a new execution step.
    5. Select the SPI provider (e.g., TrustPath.io – Fraud Detection).
    6. Set the execution requirement to Required to activate the fraud detection check.

  11. Prevent account farming and fake account creation

    Use TrustPath to detect 'account farming,' where bad actors create bulk fake accounts to abuse sign-up bonuses, referral programs, free trials, or conduct bot-driven engagement (spamming/review manipulation). TrustPath is designed to identify sophisticated fraud rings that use residential proxies, device spoofing, and AI-generated identities to bypass traditional security.

  12. Determine TrustPath event types for risk evaluation

    TrustPath uses different risk assessment criteria based on the event type. You should distinguish between new registrations and existing user logins using the isNewUserRecordCreated flag from the Kinde event context.
    const isNewUser = event.context.auth.isNewUserRecordCreated;
const eventType = isNewUser ? "account_register" : "account_login";