Get Started
Integrate / SDKs
User Verification
Business Verification
Transaction Monitoring
Changelogcurl -X GET 'https://verification.didit.me/v3/events/11111111-2222-3333-4444-555555555555/' \
-H 'x-api-key: YOUR_API_KEY'import os
import requests
event_uuid = '11111111-2222-3333-4444-555555555555'
resp = requests.get(
f'https://verification.didit.me/v3/events/{event_uuid}/',
headers={'x-api-key': os.environ['DIDIT_API_KEY']},
timeout=10,
)
resp.raise_for_status()
event = resp.json()
print(event['status'], event['score'])
for run in event['rule_runs']:
print(run['rule_title'], run['score_delta'], run['action_summary'])const eventUuid = '11111111-2222-3333-4444-555555555555';
const resp = await fetch(`https://verification.didit.me/v3/events/${eventUuid}/`, {
headers: { 'x-api-key': process.env.DIDIT_API_KEY },
});
if (!resp.ok) throw new Error(`Request failed: ${resp.status}`);
const event = await resp.json();
console.log(event.status, event.score, event.rule_runs.length, 'rule runs');<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://verification.didit.me/v3/events/{event_uuid}/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://verification.didit.me/v3/events/{event_uuid}/"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://verification.didit.me/v3/events/{event_uuid}/")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://verification.didit.me/v3/events/{event_uuid}/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"event_uuid": "33333333-4444-5555-6666-777777777777",
"event_id": "login-2026-10-17-000001",
"event_category": "auth",
"action_type": "login",
"occurred_at": "2026-10-17T09:15:02.481000Z",
"received_at": "2026-10-17T09:15:02.903114Z",
"status": "IN_REVIEW",
"score": 40,
"subject_vendor_data": "user-42",
"subject_entity_type": "individual",
"subject_uuid": "66666666-7777-8888-9999-000000000000",
"counterparty_vendor_data": null,
"session_id": "web-session-abc",
"device_fingerprint": "fp-a8c1",
"ip_address": "203.0.113.42",
"ip_country": "ES",
"amount": null,
"currency": null,
"game_id": null,
"round_id": null,
"bonus_id": null,
"affiliate_code": null,
"payment_reference_id": null,
"retention_class": "risk_relevant",
"rules_matched_count": 1,
"correlation_pending": false,
"is_droppable": true,
"payload": {
"method": "password"
},
"custom_values": {
"vip_tier": "gold",
"vpn_or_proxy_detected": true
},
"device_context": {
"fingerprint": "fp-a8c1",
"network_context": {
"ip_address": "203.0.113.42",
"ip_country": "Spain",
"ip_country_code": "ES",
"ip_city": "Madrid",
"asn_number": 64500,
"asn_organization": "Example Networks",
"is_vpn_or_tor": true,
"is_data_center": false
}
},
"field_sources": {
"subject.vendor_data": "customer",
"event_category": "customer",
"action_type": "customer",
"occurred_at": "customer",
"received_at": "server",
"payload.method": "customer",
"session.session_id": "customer",
"session.sequence": "customer",
"device_context.fingerprint": "customer",
"device_context.network_context.ip_address": "customer",
"device_context.network_context.ip_country": "server",
"device_context.network_context.ip_country_code": "server",
"device_context.network_context.ip_city": "server",
"device_context.network_context.asn_number": "server",
"device_context.network_context.asn_organization": "server",
"device_context.network_context.is_vpn_or_tor": "server",
"device_context.network_context.is_data_center": "server"
},
"session_sequence": 142,
"table_id": null,
"hand_id": null,
"match_id": null,
"market_id": null,
"side": null,
"role": null,
"net_result_amount": null,
"payment_fingerprint": null,
"instrument_reference_hash": null,
"withdrawal_address_hash": null,
"dispute_id": null,
"chargeback_id": null,
"changed_field": null,
"identity_match_ref": null,
"schema_version": 1,
"expires_at": "2027-01-15T09:15:02.481000Z",
"rules_evaluated_count": 6,
"rule_runs": [
{
"rule_uuid": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
"rule_title": "Login from VPN or Tor",
"library_key": null,
"matched": true,
"mode": "ACTIVE",
"is_async": false,
"severity": "MEDIUM",
"score_delta": 40,
"action_summary": "score +40; add_tag:VPN_LOGIN",
"matched_payload": [
{
"field": "event.ip.is_vpn_or_tor",
"operator": "eq",
"expected_value": true,
"current_value": true,
"matched": true,
"group_index": null,
"group_logic": "AND",
"field_source": "server"
}
],
"created_at": "2026-10-17T09:15:02.951207Z"
}
],
"ip_enrichment": {
"ip_country_code": "ES",
"ip_city": "Madrid",
"asn_number": 64500,
"asn_organization": "Example Networks",
"is_vpn_or_tor": true,
"is_data_center": false,
"proxy_type": null,
"last_enriched_at": "2026-10-17T09:15:02.910442Z"
},
"subject_profile": null,
"tags": [
"VPN_LOGIN"
]
}Get Monitoring Event
Retrieve one monitoring event with its payload, device context, IP enrichment, cached subject signals, tags and rule evidence.
curl -X GET 'https://verification.didit.me/v3/events/11111111-2222-3333-4444-555555555555/' \
-H 'x-api-key: YOUR_API_KEY'import os
import requests
event_uuid = '11111111-2222-3333-4444-555555555555'
resp = requests.get(
f'https://verification.didit.me/v3/events/{event_uuid}/',
headers={'x-api-key': os.environ['DIDIT_API_KEY']},
timeout=10,
)
resp.raise_for_status()
event = resp.json()
print(event['status'], event['score'])
for run in event['rule_runs']:
print(run['rule_title'], run['score_delta'], run['action_summary'])const eventUuid = '11111111-2222-3333-4444-555555555555';
const resp = await fetch(`https://verification.didit.me/v3/events/${eventUuid}/`, {
headers: { 'x-api-key': process.env.DIDIT_API_KEY },
});
if (!resp.ok) throw new Error(`Request failed: ${resp.status}`);
const event = await resp.json();
console.log(event.status, event.score, event.rule_runs.length, 'rule runs');<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://verification.didit.me/v3/events/{event_uuid}/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://verification.didit.me/v3/events/{event_uuid}/"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://verification.didit.me/v3/events/{event_uuid}/")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://verification.didit.me/v3/events/{event_uuid}/")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"event_uuid": "33333333-4444-5555-6666-777777777777",
"event_id": "login-2026-10-17-000001",
"event_category": "auth",
"action_type": "login",
"occurred_at": "2026-10-17T09:15:02.481000Z",
"received_at": "2026-10-17T09:15:02.903114Z",
"status": "IN_REVIEW",
"score": 40,
"subject_vendor_data": "user-42",
"subject_entity_type": "individual",
"subject_uuid": "66666666-7777-8888-9999-000000000000",
"counterparty_vendor_data": null,
"session_id": "web-session-abc",
"device_fingerprint": "fp-a8c1",
"ip_address": "203.0.113.42",
"ip_country": "ES",
"amount": null,
"currency": null,
"game_id": null,
"round_id": null,
"bonus_id": null,
"affiliate_code": null,
"payment_reference_id": null,
"retention_class": "risk_relevant",
"rules_matched_count": 1,
"correlation_pending": false,
"is_droppable": true,
"payload": {
"method": "password"
},
"custom_values": {
"vip_tier": "gold",
"vpn_or_proxy_detected": true
},
"device_context": {
"fingerprint": "fp-a8c1",
"network_context": {
"ip_address": "203.0.113.42",
"ip_country": "Spain",
"ip_country_code": "ES",
"ip_city": "Madrid",
"asn_number": 64500,
"asn_organization": "Example Networks",
"is_vpn_or_tor": true,
"is_data_center": false
}
},
"field_sources": {
"subject.vendor_data": "customer",
"event_category": "customer",
"action_type": "customer",
"occurred_at": "customer",
"received_at": "server",
"payload.method": "customer",
"session.session_id": "customer",
"session.sequence": "customer",
"device_context.fingerprint": "customer",
"device_context.network_context.ip_address": "customer",
"device_context.network_context.ip_country": "server",
"device_context.network_context.ip_country_code": "server",
"device_context.network_context.ip_city": "server",
"device_context.network_context.asn_number": "server",
"device_context.network_context.asn_organization": "server",
"device_context.network_context.is_vpn_or_tor": "server",
"device_context.network_context.is_data_center": "server"
},
"session_sequence": 142,
"table_id": null,
"hand_id": null,
"match_id": null,
"market_id": null,
"side": null,
"role": null,
"net_result_amount": null,
"payment_fingerprint": null,
"instrument_reference_hash": null,
"withdrawal_address_hash": null,
"dispute_id": null,
"chargeback_id": null,
"changed_field": null,
"identity_match_ref": null,
"schema_version": 1,
"expires_at": "2027-01-15T09:15:02.481000Z",
"rules_evaluated_count": 6,
"rule_runs": [
{
"rule_uuid": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
"rule_title": "Login from VPN or Tor",
"library_key": null,
"matched": true,
"mode": "ACTIVE",
"is_async": false,
"severity": "MEDIUM",
"score_delta": 40,
"action_summary": "score +40; add_tag:VPN_LOGIN",
"matched_payload": [
{
"field": "event.ip.is_vpn_or_tor",
"operator": "eq",
"expected_value": true,
"current_value": true,
"matched": true,
"group_index": null,
"group_logic": "AND",
"field_source": "server"
}
],
"created_at": "2026-10-17T09:15:02.951207Z"
}
],
"ip_enrichment": {
"ip_country_code": "ES",
"ip_city": "Madrid",
"asn_number": 64500,
"asn_organization": "Example Networks",
"is_vpn_or_tor": true,
"is_data_center": false,
"proxy_type": null,
"last_enriched_at": "2026-10-17T09:15:02.910442Z"
},
"subject_profile": null,
"tags": [
"VPN_LOGIN"
]
}Authorizations
Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is missing, wrong, revoked or expired; 403 means the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys.
Path Parameters
Didit identifier of the event (event_uuid from the create, batch, list or timeline response), not your own event_id.
Response
The event with its evidence.
One monitoring event with its full envelope, enrichment and rule evidence. Every field of MonitoringEvent plus the fields below.
Didit identifier of the event. Use it as {event_uuid} in the retrieve and delete calls.
Your own identifier, the idempotency key you sent.
128Event category.
auth, session, gameplay, bonus, affiliate, payment, dispute, security, responsible_gambling, custom What happened within the category, as you sent it.
128When the event happened on your side.
When Didit accepted the event.
ACCEPTED: stored, no matched rule changed its standing (the normal answer for most events, and always the answer in a sandbox application, where no rules run). APPROVED: a rule matched and the score stayed under your review threshold. IN_REVIEW: a rule pushed the score over the review threshold or set the status. DECLINED: a rule declined it or the score crossed your decline threshold.
ACCEPTED, APPROVED, IN_REVIEW, DECLINED Accumulated rule score. Starts at 0; rule add_score actions move it (negative deltas are allowed).
subject.vendor_data of the event: your id for the user or company.
255individual or company: which kind of subject subject_vendor_data names.
"individual"
UUID of the user (individual) or company the event resolved to, or null when that record no longer exists.
The other player of a P2P event (promoted from payload.counterparty_vendor_data).
255session.session_id sent with the event.
255device_context.fingerprint sent with the event.
255IP address of the event. On the server lane this is device_context.network_context.ip_address as you sent it; on the device lane it is the IP of the request.
64Country code of ip_address from IP enrichment, or null when the address was not enriched (missing, private, or low-value telemetry whose address was not already known).
"ES"
Amount as a decimal string with 18 decimal places, from transaction_context.amount, payload.amount or payload.stake_amount, in that order.
"250.000000000000000000"
Currency from transaction_context.currency or payload.currency.
10Promoted from payload.game_id.
128Promoted from payload.round_id.
128Promoted from payload.bonus_id.
128Promoted from payload.affiliate_code.
128Payment reference from transaction_context.payment_reference_id or payload.payment_reference_id.
255Retention class. Payment and dispute events are monetary_or_compliance; security and responsible-gambling events are risk_relevant; session.page_view, session.sdk_heartbeat, session.sdk_loaded, session.device_seen, session.bot_signal_observed, bonus.promotion_viewed and affiliate.referral_clicked are low_value; everything else is standard. An event an active rule matched is promoted to risk_relevant (never demoted).
low_value, standard, risk_relevant, monetary_or_compliance Number of rules that matched the event, including rules in TEST mode (which record evidence but apply no actions).
x >= 0true while an asynchronous rule (cross-subject correlation, or a sequence longer than 24 hours) still has to run for this event. It resolves within minutes and status, score and rules_matched_count update in place.
Whether an SDK under backpressure may drop events of this kind. false for every security, payment, dispute and responsible_gambling event and for gameplay.bet_placed, gameplay.bet_settled and gameplay.p2p_settlement.
The category fields you sent in payload.
The scalar custom_values you sent. Didit adds vpn_or_proxy_detected: true or is_data_center: true when IP enrichment flags the address and you did not set them.
The device context as stored: your device_context (including fingerprint, persistent_device_id and bot_score when sent) with network_context completed by IP enrichment (ip_country, ip_country_code, ip_city, asn_number, asn_organization, is_vpn_or_tor, is_data_center, proxy_type, connection_type) for keys you left empty.
Field path to provenance: customer (sent by your backend), sdk (sent through the device lane) or server (derived by Didit, such as received_at and enriched network fields). Check it before acting on a match.
Show child attributes
Show child attributes
session.sequence sent with the event.
Promoted from payload.table_id.
128Promoted from payload.hand_id.
128Promoted from payload.match_id.
128Promoted from payload.market_id.
128Promoted from payload.side.
64Promoted from payload.role.
64Promoted from payload.net_result_amount, as a decimal string with 18 decimal places.
"-120.000000000000000000"
Promoted from payload.payment_fingerprint.
255Promoted from payload.instrument_reference_hash.
255Promoted from payload.withdrawal_address_hash (or payload.destination_reference_hash).
255Promoted from payload.dispute_id.
255Promoted from payload.chargeback_id.
255Promoted from payload.changed_field (security change events).
128Promoted from payload.identity_match_ref (responsible-gambling registry matches).
255Version of the event envelope schema. Currently 1.
1
When the event expires under its retention class and is deleted: occurred_at plus the class period (14, 30 or 90 days by default, adjustable per application). Null for monetary_or_compliance events, which follow transaction retention.
Number of event rules evaluated for this event.
x >= 0Every rule that matched the event, newest first.
Show child attributes
Show child attributes
Enrichment of the event's IP address, or null when the address was not enriched. See IP enrichment.
Show child attributes
Show child attributes
Cached email and phone risk signals of the subject, or null when no profile exists for the subject.
Show child attributes
Show child attributes
Names of the tags attached to the event (rule add_tags actions).