Integrate Address Risk
Learn how to call the RiskOS™ Evaluation API to assess fraud risk and correlation using Address Risk.
Overview
This guide shows you how to:
- Gather the consumer's address (at minimum
line_1andcountry), plus optional name and phone, on your onboarding form. - Submit a
POST /api/evaluationrequest from your backend with the collected data. - Act on the
decisionfield (ACCEPT,REVIEW, orREJECT) in the response to route the consumer. - Use the Address Risk score, name–address correlation, and reason codes to refine your routing thresholds.
Before you start
Start an evaluation
Endpoint
Start with Sandbox for development and testing, then move to Production for live applications.
POST https://riskos.sandbox.socure.com/api/evaluationPOST https://riskos.socure.com/api/evaluationAuthentication
Include your API key in the Authorization header as a Bearer token, with standard JSON headers:
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json
Accept: application/json
X-API-Version: 2025-01-01.orion # optional – pins a specific API versionExample request
{
"id": "APP-7891011",
"timestamp": "2025-09-17T08:45:00.000Z",
"workflow": "consumer_onboarding",
"data": {
"individual": {
"given_name": "Maria",
"family_name": "Lopez",
"phone_number": "+13051234567",
"address": {
"line_1": "123 Main Street",
"locality": "Miami",
"major_admin_division": "FL",
"postal_code": "33101",
"country": "US"
}
}
}
}curl --location --request POST 'https://riskos.sandbox.socure.com/api/evaluation' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer YOUR_API_KEY' \
--data-raw '{
"id": "APP-7891011",
"timestamp": "2025-09-17T08:45:00.000Z",
"workflow": "consumer_onboarding",
"data": {
"individual": {
"given_name": "Maria",
"family_name": "Lopez",
"phone_number": "+13051234567",
"address": {
"line_1": "123 Main Street",
"locality": "Miami",
"major_admin_division": "FL",
"postal_code": "33101",
"country": "US"
}
}
}
}'Request schema
Top-level fields
Path: root request object
Note:
To improve the accuracy of the address risk score, we recommend including as many optional fields as possible in the request.
| Field | Type | Required | Description | Example |
|---|---|---|---|---|
id | String | Required | Required, customer-defined unique identifier for the request. This value must be unique for each evaluation. Reusing an ID causes RiskOS™ to treat the request as a re-run and can impact processing behavior, results, and downstream workflows. | "APP-7891011" |
timestamp | String <Date-Time> | Required | RFC 3339 timestamp indicating when the evaluation was initiated. | "2025-09-17T08:45:00.000Z" |
workflow | String | Required | RiskOS™ workflow name configured in your environment. Note: The workflow name must be unique within your RiskOS™ environment. It is not scoped by use case and must identify a single active workflow for each Evaluation API request. | "consumer_onboarding" |
data | Object | Required | Main payload containing individual and contextual information. | |
→ individual | Object | Required | Primary identity object containing personal and address details. | See individual schema below. |
individual fields
individual fieldsPath: data.individual
| Field | Type | Required | Description | Example |
|---|---|---|---|---|
given_name | String | Required | First name. Improves correlation accuracy. | "Maria" |
family_name | String | Required | Last name. Improves correlation accuracy. | "Lopez" |
phone_number | String | Optional | Phone number in E.164 format. Recommended to improve correlation accuracy. | "+13051234567" |
address | Object | Required | Individual address fields. | See address schema below. |
address fields
address fieldsPath: data.individual.address
| Field | Type | Required | Description | Example |
|---|---|---|---|---|
line_1 | String | Required | Street address line 1. | "123 Main Street" |
line_2 | String | Optional | Street address line 2. | |
locality | String | Optional | City or locality. | "Miami" |
major_admin_division | String | Optional | State, province, or region (ISO 3166-2 format). | "FL" |
postal_code | String | Optional | ZIP or postal code (hyphens optional). | "33101" |
country | String | Required | Country in ISO 3166-1 alpha-2 format (for example, US, CA). | "US" |
Example response
When you call the Evaluation API, RiskOS™ returns a JSON payload that includes the final decision, evaluation metadata, and enrichment-specific results.
{
"id": "APP-7891011",
"eval_id": "8cfa9b52-5e6d-49ff-9d12-0c7f14f97c01",
"decision": "REVIEW",
"data_enrichments": [
{
"enrichment_name": "Socure Address Risk",
"enrichment_provider": "Socure",
"status_code": 200,
"request": {
"mobileNumber": "+13051234567",
"firstName": "Maria",
"surName": "Lopez",
"physicalAddress": "123 Main Street",
"city": "Miami",
"state": "FL",
"zip": "33101",
"country": "US"
},
"response": {
"referenceId": "a2c4ef01-b6a3-41af-9e82-df2c7db116d7",
"customerProfile": {
"userId": "usr_7f3a91bc",
"customerUserId": "cust_00123456"
},
"nameAddressCorrelation": {
"reasonCodes": [
"R710",
"I712"
],
"score": 0.84
},
"addressRisk": {
"reasonCodes": [
"R705",
"R720"
],
"scores": [
{
"name": "Address Risk Model (US) Norm",
"version": "3.2",
"score": 0.921
}
],
"signals": {}
}
}
}
]
}
Key response fields
RiskOS™ returns a consistent set of top-level fields that describe the outcome of an evaluation, with enrichment-specific results that depend on your workflow configuration.
Where to find specific results
| Area | Fields | How to use it |
|---|---|---|
| Decision and routing | decision, decision_at, tags, review_queues, notes, score | Primary control signals. Branch application logic using decision. Use tags, queues, notes, and score for secondary routing, review, and explanation. |
| Module results | Module-specific fields (for example: reasonCodes, scores, extracted attributes) | Evidence and signals produced by workflow modules. Use for escalation, compliance review, investigation, and audit. |
| Identifiers and traceability | id, eval_id | Persist these identifiers to correlate API calls, logs, webhooks, GET requests, and support cases. |
| Enrichment execution | data_enrichments[] (response, status_code, total_attempts, is_source_cache) | Inspect enrichment outputs and detect provisioning issues, partial failures, retries, or cached responses. |
| Workflow context | workflow, workflow_id, workflow_version | Understand which workflow ran and which version produced the result. Useful for debugging and historical analysis. |
| Evaluation lifecycle | eval_status, status, sub_status | Execution and case state only. Useful for monitoring and asynchronous workflows. Do not use for business decisions. |
| Execution context | eval_source, eval_start_time, eval_end_time, environment_name | Observability and performance metadata for latency tracking, environment validation, and API vs Dashboard attribution. |
Decision and routing (primary control signals)
Use these fields to determine what action your application should take.
decisionvalues are workflow-specific and may differ from the examples shown in this guide.
| Field | Type | Description | Example |
|---|---|---|---|
decision | String enum | Final evaluation result. Possible values: • ACCEPT• REVIEW• REJECTNote: The fields returned can be customized to fit your integration or business needs. | "REVIEW" |
decision_at | String <Date-Time> | RFC 3339 timestamp when the decision was finalized. | "2025-09-30T08:15:31.102Z" |
score | Number | If configured for a workflow, provides an aggregate score of all steps. This can be used for risk banding, additional routing, or analytics alongside the primary decision value. | 0.58 |
tags | Array of Strings | Array of labels applied during the workflow to highlight routing choices, notable signals, or rule outcomes. Useful for reporting, segmentation, or UI highlighting in the RiskOS™ Dashboard. | ["manual_review_required"] |
review_queues | Array of Strings | Lists any manual review queues the evaluation was sent to. Empty when the case is fully auto-resolved without human review. | ["kyc-us"] |
notes | String | Freeform text field for analyst or system comments about the evaluation. Often used to capture manual review rationale or investigation context. | "Additional verification recommended" |
Evaluation lifecycle and status
These fields describe where the evaluation is in its lifecycle and are useful for monitoring and asynchronous workflows.
| Field | Type | Description | Example |
|---|---|---|---|
eval_status | String enum | Indicates the current state of an evaluation in RiskOS™. Possible values: • evaluation_completed• evaluation_paused• evaluation_in_progress | "evaluation_completed" |
status | String enum | Indicates the current state of an evaluation or case. Possible values: • OPEN• CLOSED | "CLOSED" |
sub_status | String | Provides additional detail about the evaluation status. Example values: • Under Review• Pending Verification• Accept• Reject | "Under Review" |
Identifiers and traceability
Use these fields to correlate requests, logs, webhooks, and support cases.
| Field | Type | Description | Example |
|---|---|---|---|
id | String (UUID or custom string) | Your evaluation identifier within RiskOS™. Note: This is customer-generated. | "APP-7891011" |
eval_id | String (UUID) | RiskOS™-generated unique identifier for the evaluation. | "8cfa9b52-5e6d-49ff-9d12-0c7f14f97c01" |
workflow | String | Name of the workflow executed. | "consumer_onboarding" |
workflow_id | String (UUID) | Unique identifier for the workflow run. | "9d2f4a3b-71c6-4e3f-9c82-8b7c5e4a6d01" |
workflow_version | String | Version of the executed workflow. | "42.0.0" |
Execution context
These fields provide timing and environment context for the evaluation.
| Field | Type | Description | Example |
|---|---|---|---|
eval_source | String enum | Indicates where the evaluation was initiated from. Possible values: • API: Request submitted via the Evaluation API.• Dashboard: Case created or evaluated through the RiskOS™ Dashboard. | "API" |
eval_start_time | String <Date-Time> | RFC 3339 timestamp for when RiskOS™ started processing the evaluation. Useful for latency and performance monitoring. | "2025-09-30T08:15:30.982Z" |
eval_end_time | String <Date-Time> | RFC 3339 timestamp for when RiskOS™ finished processing the evaluation. Can be paired with eval_start_time to compute total processing time. | "2025-09-30T08:15:31.215Z" |
environment_name | String | Indicates which environment the evaluation ran in. Typically Sandbox for testing or Production for live traffic. | "Sandbox" |
Enrichment results
Enrichment outputs are returned in the data_enrichments array.
| Field | Type | Description | Example |
|---|---|---|---|
enrichment_name | String | Product name. | "Socure Address Risk" |
enrichment_endpoint | String (URL) | Endpoint invoked. | |
enrichment_provider | String | Provider. | "Socure" |
status_code | Integer | HTTP status code. | 200 |
request | Object | Payload sent to provider. | See request fields below. |
response | Object | Payload returned by provider. | See response fields below. |
is_source_cache | Boolean | Response served from cache. | false |
total_attempts | Integer | Number of attempts. | 1 |
request fields
request fields| Field | Type | Description | Example |
|---|---|---|---|
mobileNumber | String | Phone number of the individual in E.164 format. | "+13051234567" |
firstName | String | First name of the individual submitting the information. | "Maria" |
surName | String | Last name (surname) of the individual submitting the information. | "Lopez" |
physicalAddress | String | Primary street address line 1 of the individual’s residence. | "123 Main Street" |
physicalAddress2 | String | Secondary street address line (for example, apartment or unit). | "Apt 4B" |
city | String | City where the individual resides. | "Miami" |
state | String | State, province, or region where the individual resides. | "FL" |
zip | String | Postal or ZIP code associated with the individual’s address. | "33101" |
country | String | Country code in ISO 3166-1 alpha-2 format. | "US" |
modules | Array | List of enrichment modules requested for evaluation. | ["addressrisk"] |
returnSignals | Boolean | Indicates whether detailed address signals are requested. Controlled by your enrichment configuration, not sent per request. | true |
response fields
response fields| Field | Type | Description | Example |
|---|---|---|---|
referenceId | String (UUID) | Unique identifier for the enrichment transaction. | "a2c4ef01-b6a3-41af-9e82-df2c7db116d7" |
customerProfile | Object | Customer and user identifiers for this evaluation. Returned when you supply a customer or user identifier in the request. | See customerProfile schema below. |
nameAddressCorrelation | Object | Correlation between the consumer’s name and address data. | See nameAddressCorrelation schema below. |
addressRisk | Object | Risk assessment based on the provided address. | See addressRisk schema below. |
customerProfile fields
customerProfile fields| Field | Type | Description | Example |
|---|---|---|---|
userId | String | Socure-assigned persistent user identifier. | "usr_7f3a91bc" |
customerUserId | String | Customer-defined user identifier echoed from the request, when provided. | "cust_00123456" |
nameAddressCorrelation fields
nameAddressCorrelation fields| Field | Type | Description | Example |
|---|---|---|---|
score | Number | Correlation between physical address and provided given_name and family_name. | 0.84 |
reasonCodes | Array of Strings | Factors influencing the correlation value | ["R710", "I712"] |
The nameAddressCorrelation.score is a number between 0.01 and 0.99 that indicates the strength of the relationship between the physical address and the consumer's given_name and family_name.
You can interpret the range of possible values as follows:
0.95-0.99: Very high confidence. The full name match was verified by one or more sources.0.85-0.94: High confidence. The partial name match (includes fuzzy matches and nicknames) was verified by one or more sources.0.75-0.84: Medium-to-high confidence. The last name match was verified by one or more sources.0.65-0.74: Low confidence. Partial name match only.0.20-0.64: Correlation status is unknown. The Evaluation endpoint was unable to determine correlation.0.01-0.19: Disconnected identity elements. No correlation found.
addressRisk fields
addressRisk fields| Field | Type | Description | Example |
|---|---|---|---|
reasonCodes | Array of Strings | List of reason codes indicating potential address-level risk factors. | ["R705", "R720"] |
scores | Array of Objects | Address risk model scores returned by the provider. | |
→ name | String | Name of the scoring model used. | "Address Risk Model (US) Norm" |
→ version | String | Version of the scoring model. | "3.2" |
→ score | Number | Confidence score between 0.001 and 0.999. | 0.921 |
signals | Object | Address-level signal data points. Returned only when signals are enabled for your Address Risk enrichment configuration; otherwise returned as an empty object ({}). When populated, it contains an address object with the available data points. See Address Risk Signals. | {} |
Each address risk score is a probabilistic value between 0.001 and 0.999 that represents the level of risk associated with an address. A higher score indicates a greater likelihood of fraud.
For example, a score of 0.800 means that the consumer is riskier than 80 percent of all consumers and less risky than 20 percent of consumers. In general, consumers with scores equal to or greater than 0.970 are considered high risk.
Tip:
When multiple risk scores are returned, we recommend following these guidelines:
- Evaluate each model's performance individually, considering metrics such as fraud capture rate, false positive rate, and AUC to gauge accuracy.
- Understand the specific use cases and goals optimized in each model, as differently tuned models can yield varied scores.
- Scrutinize the input data and algorithms employed, recognizing that models utilizing distinct techniques or data may produce diverse results.
- Align scores with risk strategies and thresholds, contemplating the optimal use of multiple outputs for decision-making.
- Investigate substantial score discrepancies, as conflicting scores may indicate an unusual case that warrants further review.
- Refer to documentation outlining the design and purpose of each model to guide the interpretation of scores. Contact your Technical Account Manager to inquire about these documents.
In cases of significant score conflicts, prioritize the model with superior performance based on metrics like the fraud capture rate to serve as the tie-breaker.
Best practices
- Always include
given_nameandfamily_namefor stronger correlation. - Use parallel model scoring to compare challenger vs. champion models.
- Investigate discrepancies between multiple model scores — they may indicate edge cases.
- Tune thresholds (for example, ≥0.97 for auto-fail) to balance fraud capture vs. false positives.
- Log reason codes for auditability and continuous improvement.
Validation checklist
address.line\_1 and address.country.
≥0.97) and low-correlation (≤0.20) cases trigger additional review or step-up verification.
Updated 10 days ago

