Integrate Address Risk

Learn how to call the RiskOS™ Evaluation API to assess fraud risk and correlation using Address Risk.

Overview

This guide shows you how to:

  1. Gather the consumer's address (at minimum line_1 and country), plus optional name and phone, on your onboarding form.
  2. Submit a POST /api/evaluation request from your backend with the collected data.
  3. Act on the decision field (ACCEPT, REVIEW, or REJECT) in the response to route the consumer.
  4. Use the Address Risk score, name–address correlation, and reason codes to refine your routing thresholds.

Before you start

Configure and publish a workflow for the Address Risk enrichment.
Confirm regional coverage for the Address Risk enrichment.
Get your API key from the API & SDK Keys page in the RiskOS™ Dashboard.

Start an evaluation

Endpoint

Start with Sandbox for development and testing, then move to Production for live applications.

POST https://riskos.sandbox.socure.com/api/evaluation
POST https://riskos.socure.com/api/evaluation

Authentication

Include your API key in the Authorization header as a Bearer token, with standard JSON headers:

Authorization: Bearer YOUR_API_KEY
Content-Type: application/json
Accept: application/json
X-API-Version: 2025-01-01.orion   # optional – pins a specific API version

Example request

{
  "id": "APP-7891011",
  "timestamp": "2025-09-17T08:45:00.000Z",
  "workflow": "consumer_onboarding",
  "data": {
    "individual": {
      "given_name": "Maria",
      "family_name": "Lopez",
      "phone_number": "+13051234567",
      "address": {
        "line_1": "123 Main Street",
        "locality": "Miami",
        "major_admin_division": "FL",
        "postal_code": "33101",
        "country": "US"
      }
    }
  }
}
curl --location --request POST 'https://riskos.sandbox.socure.com/api/evaluation' \
  --header 'Content-Type: application/json' \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer YOUR_API_KEY' \
  --data-raw '{
    "id": "APP-7891011",
    "timestamp": "2025-09-17T08:45:00.000Z",
    "workflow": "consumer_onboarding",
    "data": {
      "individual": {
        "given_name": "Maria",
        "family_name": "Lopez",
        "phone_number": "+13051234567",
        "address": {
          "line_1": "123 Main Street",
          "locality": "Miami",
          "major_admin_division": "FL",
          "postal_code": "33101",
          "country": "US"
        }
      }
    }
  }'

Request schema

Top-level fields

Path: root request object

📘

Note:

To improve the accuracy of the address risk score, we recommend including as many optional fields as possible in the request.

FieldTypeRequiredDescriptionExample
idStringRequired

Required, customer-defined unique identifier for the request.

This value must be unique for each evaluation. Reusing an ID causes RiskOS™ to treat the request as a re-run and can impact processing behavior, results, and downstream workflows.

"APP-7891011"
timestampString <Date-Time>RequiredRFC 3339 timestamp indicating when the evaluation was initiated."2025-09-17T08:45:00.000Z"
workflowStringRequiredRiskOS™ workflow name configured in your environment.

Note: The workflow name must be unique within your RiskOS™ environment. It is not scoped by use case and must identify a single active workflow for each Evaluation API request.
"consumer_onboarding"
dataObjectRequiredMain payload containing individual and contextual information.
individualObjectRequiredPrimary identity object containing personal and address details.See individual schema below.

individual fields

Path: data.individual

FieldTypeRequiredDescriptionExample
given_nameStringRequiredFirst name. Improves correlation accuracy."Maria"
family_nameStringRequiredLast name. Improves correlation accuracy."Lopez"
phone_numberStringOptionalPhone number in E.164 format. Recommended to improve correlation accuracy."+13051234567"
addressObjectRequiredIndividual address fields.See address schema below.

address fields

Path: data.individual.address

FieldTypeRequiredDescriptionExample
line_1StringRequiredStreet address line 1."123 Main Street"
line_2StringOptionalStreet address line 2.
localityStringOptionalCity or locality."Miami"
major_admin_divisionStringOptionalState, province, or region (ISO 3166-2 format)."FL"
postal_codeStringOptionalZIP or postal code (hyphens optional)."33101"
countryStringRequiredCountry in ISO 3166-1 alpha-2 format (for example, US, CA)."US"

Example response

When you call the Evaluation API, RiskOS™ returns a JSON payload that includes the final decision, evaluation metadata, and enrichment-specific results.

{
  "id": "APP-7891011",
  "eval_id": "8cfa9b52-5e6d-49ff-9d12-0c7f14f97c01",
  "decision": "REVIEW",
  "data_enrichments": [
    {
      "enrichment_name": "Socure Address Risk",
      "enrichment_provider": "Socure",
      "status_code": 200,
      "request": {
        "mobileNumber": "+13051234567",
        "firstName": "Maria",
        "surName": "Lopez",
        "physicalAddress": "123 Main Street",
        "city": "Miami",
        "state": "FL",
        "zip": "33101",
        "country": "US"
      },
      "response": {
        "referenceId": "a2c4ef01-b6a3-41af-9e82-df2c7db116d7",
        "customerProfile": {
          "userId": "usr_7f3a91bc",
          "customerUserId": "cust_00123456"
        },
        "nameAddressCorrelation": {
          "reasonCodes": [
            "R710",
            "I712"
          ],
          "score": 0.84
        },
        "addressRisk": {
          "reasonCodes": [
            "R705",
            "R720"
          ],
          "scores": [
            {
              "name": "Address Risk Model (US) Norm",
              "version": "3.2",
              "score": 0.921
            }
          ],
          "signals": {}
        }
      }
    }
  ]
}

Key response fields

RiskOS™ returns a consistent set of top-level fields that describe the outcome of an evaluation, with enrichment-specific results that depend on your workflow configuration.

Where to find specific results

AreaFieldsHow to use it
Decision and routingdecision, decision_at, tags, review_queues, notes, scorePrimary control signals. Branch application logic using decision. Use tags, queues, notes, and score for secondary routing, review, and explanation.
Module resultsModule-specific fields (for example: reasonCodes, scores, extracted attributes)Evidence and signals produced by workflow modules. Use for escalation, compliance review, investigation, and audit.
Identifiers and traceabilityid, eval_idPersist these identifiers to correlate API calls, logs, webhooks, GET requests, and support cases.
Enrichment executiondata_enrichments[] (response, status_code, total_attempts, is_source_cache)Inspect enrichment outputs and detect provisioning issues, partial failures, retries, or cached responses.
Workflow contextworkflow, workflow_id, workflow_versionUnderstand which workflow ran and which version produced the result. Useful for debugging and historical analysis.
Evaluation lifecycleeval_status, status, sub_statusExecution and case state only. Useful for monitoring and asynchronous workflows. Do not use for business decisions.
Execution contexteval_source, eval_start_time, eval_end_time, environment_nameObservability and performance metadata for latency tracking, environment validation, and API vs Dashboard attribution.

Decision and routing (primary control signals)

Use these fields to determine what action your application should take.

decision values are workflow-specific and may differ from the examples shown in this guide.

FieldTypeDescriptionExample
decisionString enumFinal evaluation result.

Possible values:
ACCEPT
REVIEW
REJECT

Note: The fields returned can be customized to fit your integration or business needs.
"REVIEW"
decision_atString <Date-Time>RFC 3339 timestamp when the decision was finalized."2025-09-30T08:15:31.102Z"
scoreNumberIf configured for a workflow, provides an aggregate score of all steps. This can be used for risk banding, additional routing, or analytics alongside the primary decision value.0.58
tagsArray of StringsArray of labels applied during the workflow to highlight routing choices, notable signals, or rule outcomes. Useful for reporting, segmentation, or UI highlighting in the RiskOS™ Dashboard.["manual_review_required"]
review_queuesArray of StringsLists any manual review queues the evaluation was sent to. Empty when the case is fully auto-resolved without human review.["kyc-us"]
notesStringFreeform text field for analyst or system comments about the evaluation. Often used to capture manual review rationale or investigation context."Additional verification recommended"

Evaluation lifecycle and status

These fields describe where the evaluation is in its lifecycle and are useful for monitoring and asynchronous workflows.

FieldTypeDescriptionExample
eval_statusString enumIndicates the current state of an evaluation in RiskOS™.

Possible values:
evaluation_completed
evaluation_paused
evaluation_in_progress
"evaluation_completed"
statusString enumIndicates the current state of an evaluation or case.

Possible values:
OPEN
CLOSED
"CLOSED"
sub_statusStringProvides additional detail about the evaluation status.

Example values:
Under Review
Pending Verification
Accept
Reject
"Under Review"

Identifiers and traceability

Use these fields to correlate requests, logs, webhooks, and support cases.

FieldTypeDescriptionExample
idString (UUID or custom string)Your evaluation identifier within RiskOS™.

Note: This is customer-generated.
"APP-7891011"
eval_idString (UUID)RiskOS™-generated unique identifier for the evaluation."8cfa9b52-5e6d-49ff-9d12-0c7f14f97c01"
workflowStringName of the workflow executed."consumer_onboarding"
workflow_idString (UUID)Unique identifier for the workflow run."9d2f4a3b-71c6-4e3f-9c82-8b7c5e4a6d01"
workflow_versionStringVersion of the executed workflow."42.0.0"

Execution context

These fields provide timing and environment context for the evaluation.

FieldTypeDescriptionExample
eval_sourceString enumIndicates where the evaluation was initiated from.

Possible values:
API: Request submitted via the Evaluation API.
Dashboard: Case created or evaluated through the RiskOS™ Dashboard.
"API"
eval_start_timeString <Date-Time>RFC 3339 timestamp for when RiskOS™ started processing the evaluation. Useful for latency and performance monitoring."2025-09-30T08:15:30.982Z"
eval_end_timeString <Date-Time>RFC 3339 timestamp for when RiskOS™ finished processing the evaluation. Can be paired with eval_start_time to compute total processing time."2025-09-30T08:15:31.215Z"
environment_nameStringIndicates which environment the evaluation ran in. Typically Sandbox for testing or Production for live traffic."Sandbox"

Enrichment results

Enrichment outputs are returned in the data_enrichments array.

FieldTypeDescriptionExample
enrichment_nameStringProduct name."Socure Address Risk"
enrichment_endpointString (URL)Endpoint invoked.
enrichment_providerStringProvider."Socure"
status_codeIntegerHTTP status code.200
requestObjectPayload sent to provider.See request fields below.
responseObjectPayload returned by provider.See response fields below.
is_source_cacheBooleanResponse served from cache.false
total_attemptsIntegerNumber of attempts.1

request fields

FieldTypeDescriptionExample
mobileNumberStringPhone number of the individual in E.164 format."+13051234567"
firstNameStringFirst name of the individual submitting the information."Maria"
surNameStringLast name (surname) of the individual submitting the information."Lopez"
physicalAddressStringPrimary street address line 1 of the individual’s residence."123 Main Street"
physicalAddress2StringSecondary street address line (for example, apartment or unit)."Apt 4B"
cityStringCity where the individual resides."Miami"
stateStringState, province, or region where the individual resides."FL"
zipStringPostal or ZIP code associated with the individual’s address."33101"
countryStringCountry code in ISO 3166-1 alpha-2 format."US"
modulesArrayList of enrichment modules requested for evaluation.["addressrisk"]
returnSignalsBooleanIndicates whether detailed address signals are requested. Controlled by your enrichment configuration, not sent per request.true

response fields

FieldTypeDescriptionExample
referenceIdString (UUID)Unique identifier for the enrichment transaction."a2c4ef01-b6a3-41af-9e82-df2c7db116d7"
customerProfileObjectCustomer and user identifiers for this evaluation. Returned when you supply a customer or user identifier in the request.See customerProfile schema below.
nameAddressCorrelationObjectCorrelation between the consumer’s name and address data.See nameAddressCorrelation schema below.
addressRiskObjectRisk assessment based on the provided address.See addressRisk schema below.

customerProfile fields

FieldTypeDescriptionExample
userIdStringSocure-assigned persistent user identifier."usr_7f3a91bc"
customerUserIdStringCustomer-defined user identifier echoed from the request, when provided."cust_00123456"

nameAddressCorrelation fields

FieldTypeDescriptionExample
scoreNumberCorrelation between physical address and provided given_name and family_name.0.84
reasonCodesArray of StringsFactors influencing the correlation value["R710", "I712"]

The nameAddressCorrelation.score is a number between 0.01 and 0.99 that indicates the strength of the relationship between the physical address and the consumer's given_name and family_name.

You can interpret the range of possible values as follows:

  • 0.95 - 0.99: Very high confidence. The full name match was verified by one or more sources.
  • 0.85 - 0.94: High confidence. The partial name match (includes fuzzy matches and nicknames) was verified by one or more sources.
  • 0.75 - 0.84: Medium-to-high confidence. The last name match was verified by one or more sources.
  • 0.65 - 0.74: Low confidence. Partial name match only.
  • 0.20 - 0.64: Correlation status is unknown. The Evaluation endpoint was unable to determine correlation.
  • 0.01 - 0.19: Disconnected identity elements. No correlation found.

addressRisk fields

FieldTypeDescriptionExample
reasonCodesArray of StringsList of reason codes indicating potential address-level risk factors.["R705", "R720"]
scoresArray of ObjectsAddress risk model scores returned by the provider.
nameStringName of the scoring model used."Address Risk Model (US) Norm"
versionStringVersion of the scoring model."3.2"
scoreNumberConfidence score between 0.001 and 0.999.0.921
signalsObjectAddress-level signal data points. Returned only when signals are enabled for your Address Risk enrichment configuration; otherwise returned as an empty object ({}). When populated, it contains an address object with the available data points. See Address Risk Signals.{}

Each address risk score is a probabilistic value between 0.001 and 0.999 that represents the level of risk associated with an address. A higher score indicates a greater likelihood of fraud.

For example, a score of 0.800 means that the consumer is riskier than 80 percent of all consumers and less risky than 20 percent of consumers. In general, consumers with scores equal to or greater than 0.970 are considered high risk.

👍

Tip:

When multiple risk scores are returned, we recommend following these guidelines:

  • Evaluate each model's performance individually, considering metrics such as fraud capture rate, false positive rate, and AUC to gauge accuracy.
  • Understand the specific use cases and goals optimized in each model, as differently tuned models can yield varied scores.
  • Scrutinize the input data and algorithms employed, recognizing that models utilizing distinct techniques or data may produce diverse results.
  • Align scores with risk strategies and thresholds, contemplating the optimal use of multiple outputs for decision-making.
  • Investigate substantial score discrepancies, as conflicting scores may indicate an unusual case that warrants further review.
  • Refer to documentation outlining the design and purpose of each model to guide the interpretation of scores. Contact your Technical Account Manager to inquire about these documents.

In cases of significant score conflicts, prioritize the model with superior performance based on metrics like the fraud capture rate to serve as the tie-breaker.



Best practices

  • Always include given_name and family_name for stronger correlation.
  • Use parallel model scoring to compare challenger vs. champion models.
  • Investigate discrepancies between multiple model scores — they may indicate edge cases.
  • Tune thresholds (for example, ≥0.97 for auto-fail) to balance fraud capture vs. false positives.
  • Log reason codes for auditability and continuous improvement.


Validation checklist

Validation checklist:

Requests include at least address.line\_1 and address.country.
High-risk (≥0.97) and low-correlation (≤0.20) cases trigger additional review or step-up verification.
Parallel models are configured where available.
Logs capture full enrichment payload and decision scores.

Did this page help you?