Skip to main content
POST https://api.tracenow.io/trace The trace endpoint runs all provided signals (IP, email, phone, device token) in parallel, evaluates your configured policies against the enriched result, tracks velocity counters, and returns a single verdict: allow, challenge, or deny. Use /trace when you want a single API call to drive an access decision — at login, signup, checkout, or any other risk checkpoint.

​
Request

{
  "event": "login",
  "status": "attempted",
  "ip": "1.2.3.4",
  "email": "user@example.com",
  "phone": "+14155552671",
  "device_token": "dt_..."
}
FieldTypeRequiredDescription
eventstringYesEvent type (e.g. login, signup, checkout).
statusstringYesEvent status (e.g. attempted, succeeded, failed).
ipstringNoIPv4 or IPv6 address to enrich.
emailstringNoEmail address to enrich.
phonestringNoPhone number to enrich (any format).
device_tokenstringNoDevice token (dt_...) from /identify.
At least one of ip, email, phone, or device_token must be provided.

​
Response

{
  "request_id": "tr_01J9ZQK2XVBP3N7M4FGHD8R5TW",
  "verdict": "allow",
  "policy_triggered": null,
  "signals_complete": true,
  "privacy_mode": false,
  "ip": { ... },
  "email": { ... },
  "phone": { ... },
  "device": { ... }
}
FieldTypeDescription
verdictallow | challenge | denyPolicy evaluation result. allow if no policy matched.
policy_triggeredstring | nullName of the policy that set the verdict. Null if no policy matched.
signals_completebooleanFalse if any async signal was not yet available (first-call cache miss). Retry or use the device block directly.
privacy_modebooleanTrue when IP anonymization signals and device canvas randomization indicate intentional privacy tooling.
ipobject | nullFull IP intelligence result. Null if ip was not provided.
emailobject | nullFull email intelligence result. Null if email was not provided.
phoneobject | nullFull phone intelligence result. Null if phone was not provided.
deviceobjectDevice signals. Always present; derived from device_token if provided, otherwise from IP signals only.

​
Policies

Policies are configured in your dashboard under Guard. Each policy defines conditions (e.g. is_tor = true, is_disposable = true) and an action (challenge or deny). Policies are evaluated in priority order — the first match sets the verdict. If no policy matches, the verdict is allow.