Trust API Design

Trust API enables fraud and security teams to obtain real-time decisions and rich contextual signals for important business flow operations (such as login, step-up authentication, and high-risk transactions) so you can embed these decisions directly into your application business logic and proactively mitigate fraudulent activity. This shifts HUMAN Sightline’s philosophy from a purely cookie-based enforcement model to an event-centric, contextual security framework that unifies bot, fraud detection, agentic detection, and threat intelligence. The solution is designed to return consolidated decisions, explanatory context, and support real-time enforcement within your existing workflows.

Key Solution Elements

• Extended signal: Combination of enhanced behavioral and biometric signals, which the Sensor collects per key activity (e.g., login, checkout) and packages to the HUMAN token.
• Trust API: Called by the customer server. Provides the token and optional business signals such as activity, user_id, or any other contextual attributes.
• Enhanced real-time detection decision: Based on the cached token, detection context, and provided business signals.
• Contextual Trust API output: Structured API response that customers can use to decide how to act–either invoking HUMAN’s Enforcer for immediate action or using the data for deferred or custom downstream actions.

Behavior

Sensitive Route: A high-value endpoint specified by the customer that requires protection against bot attacks via a HUMAN Enforcer. Actions are determined by a combination of the supplied policy and Bot Defender logic.

Business Route: An endpoint or series of endpoints executing critical operations. Here, the customer’s application dictates the necessary action using its own internal logic alongside unified contextual signals gathered from Sightline products. While clients utilizing Sightline will maintain their standard usage of HUMAN Enforcers alongside BD, AD, and CI, HUMAN BD Enforcers will intentionally bypass applying decisions or actions to these designated “business flows” and delegate that responsibility entirely to the customer.

Setup Flow

Prerequisites

1. BD integration complete: The Sensor and Enforcer must be installed to maintain baseline security at the edge or middleware level.
2. AD and CI (Optional): These are nice-to-have integrations that enable additional signals and deeper account-level insights.

Enablement

1. HUMAN side, Console: Move specific routes from Sensitive routes and add them as business routes in the new configuration.
2. HUMAN side (future iterations): Set up Policy within the custom policies mechanism.
3. Customer side: Implement the server-to-server API call to the Trust API at the application level. The application backend acts as the orchestrator to retrieve consolidated signals.

Architecture Overview

Mitigation Flow

Implement mitigation and enforcement based on the Trust API response. The application uses these unified contextual signals to dictate necessary actions using its own internal logic.

Data Schema

See the API specification for the complete data schema.

Analytics & Reporting

Because the customer owns the decisions and logic made based on the Trust API response, HUMAN cannot support portal reporting for events. However, we are considering implementing an auxiliary API to track asynchronous activities. If this feature would be helpful for your organization, we encourage sharing your feedback to us.