Reference · built on requestConnectorPayments, billing & fraud

Riskified

Order fraud decisions, decision notifications, and post-order status updates through the Riskified API.

Request accessPricing ↗

About

Riskified reviews ecommerce orders for fraud and returns a decision of approved, declined, or captured. Its REST API, version 2.0.0, takes an order at /api/decide for a synchronous answer or at /api/submit for a review whose result arrives later at your notification URL. After the order is placed, you report what happened to it: cancellations, refunds, fulfillment, chargebacks, and your own final decision when it differs from the recommendation.

An operator on Fibric reads each decision and the status behind it, then proposes the follow-up you would otherwise type by hand: report a refund, cancel a declined order, or submit a chargeback with its dispute details. You approve. Each call is made once and leaves a receipt.

This is a reference listing. It documents what Fibric would read from Riskified and what it could propose, based on the vendor's published interfaces. Fibric builds it under a managed deployment when you request it; selecting it here installs nothing.

Inputs

  • Synchronous decisions from POST /api/decide: order.status of approved, declined, or captured, with order.description
  • Risk category on declined orders: High-Risk, Considerable Risk, Fraudulent, Business Policy, or Technical Issue
  • Decision notifications posted to your notification URL for /api/submit orders, signed with X-RISKIFIED-HMAC-SHA256
  • 3DS and PSD2 recommendations in advice.recommendations, typed three_ds or psd2 with sca, tra, low_value, or out_of_scope
  • Acknowledgements for status updates: order.status and order.old_status, such as chargeback replacing approved
  • HTTP 429 on an order that receives too many update requests, and 504 when a retry is advised

Proposed actions

  • Target capability: propose reporting a full cancellation through POST /api/cancel with cancel_reason and cancelled_at
  • Target capability: propose reporting a full or partial refund through POST /api/refund with refund_id, amount, currency, and refunded_at
  • Target capability: propose submitting a chargeback through POST /api/chargeback with chargeback_details, fulfillment, and dispute_details
  • Target capability: propose recording your final outcome through POST /api/decision with external_status approved, declined, cancelled, declined_fraud, or declined_business

Proposed actions are target capabilities. Every action runs propose-first and needs a validated deployment and the appropriate permissions.

What you can build

  • Hold an order Riskified declined

    A decline arrives with its risk category. The operator matches it to the open order, proposes a hold and a cancel report to /api/cancel, and shows you the category before you approve.

    With Order Risk, Cancellation Window

  • File a chargeback on a guaranteed order

    When a chargeback lands on an order Riskified approved, the operator assembles chargeback_details, fulfillment tracking, and dispute_details, then proposes one /api/chargeback submission.

    With Chargeback Evidence

  • Keep refunds in sync

    A support refund is issued in your commerce platform. The operator proposes the matching /api/refund report so the order record at Riskified carries the amount and reason.

    With Refund Policy, Concession Review

Requirements

  • A Riskified account with an authentication token and registered shop domain
  • The Chargeback Guarantee endpoints on sandbox.riskified.com for testing and wh.riskified.com for production
  • A notification endpoint on a named host, not an IP address, that answers 2xx to POSTed decisions
  • The API-VERSION: 2 header on /decide and /advise calls, and Accept: application/vnd.riskified.com; version=2 on every call
Authentication
An authentication token issued during Riskified onboarding, used to HMAC-SHA256 sign each request body into the X-RISKIFIED-HMAC-SHA256 header, with X-RISKIFIED-SHOP-DOMAIN naming the shop.

Limits

  • The signed body must match the request byte for byte. A changed space or line break returns 401.
  • Decisions for /api/submit orders are asynchronous. Riskified advises holding the order in a queue until the notification arrives.
  • Failed notifications are retried up to 10 times at 5-minute intervals, then up to 10 more at 1-hour intervals.
  • Policy Protect claim endpoints and Account Secure login events use api.riskified.com and are outside this listing.

Access and pricing

Reference listing. Fibric builds the connector under a managed deployment when you request it. Your quote covers the build, capabilities, usage, and support.

Request Riskified ↗

Questions and answers

What is the difference between /api/decide and /api/submit?
/api/decide returns the decision in the response: approved, declined, or captured. /api/submit answers with status submitted and the decision is posted later to your notification URL. The notification body has the same shape as the synchronous response.
How does the connector check a Riskified notification?
Each notification carries an X-RISKIFIED-HMAC-SHA256 header computed over the payload with your authentication token, the same method used for requests you send. Your endpoint returns a 2xx status to confirm receipt.
Which hosts does the connector call?
Chargeback Guarantee traffic goes to sandbox.riskified.com for testing and wh.riskified.com for live orders. Adaptive Checkout, Policy Protect, and Account Secure use api-sandbox.riskified.com and api.riskified.com, which vary by product and endpoint.
Ask about Riskified

Ask about the capabilities and requirements in this listing.

For project-specific requirements, contact Fibric.

This connector listing is developed, published, and supported by Fibric. It describes integration with Riskified through published interfaces. Third-party names and logos identify the systems an integration connects to; they are the property of their respective owners, who are not affiliated with Fibric and do not sponsor or endorse this listing. Trademark policy