Radar

Radar allows you to detect, verify, and block harmful behavior in real time. The Radar API supports the management of WorkOS Radar block and allow lists as well as standalone Radar use-cases. While Radar is natively integrated with AuthKit, you can also leverage Radar’s risk decisioning engine outside of AuthKit to detect fraudulent sign-in and signup attempts in your own custom authentication flows using the attempts API.

The Radar standalone API is currently in preview, contact us to request access.

A Radar attempt represents a sign-in or signup attempt and includes context such as IP address and user agent. The Radar engine assesses attempts for risk and returns a decision that you can use to drive behavior in your application.

Evaluates an authentication attempt based on the parameters provided and returns a verdict.

curl https://api.workos.com/radar/attempts \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  --request POST \
  --data '{
    "ip_address": "192.168.1.1",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36",
    "email": "test@example.com",
    "auth_method": "Password",
    "action": "signup"
  }'

You may optionally inform Radar that an authentication attempt or challenge was successful using this endpoint. Some Radar controls depend on tracking recent successful attempts, such as impossible travel.

curl https://api.workos.com/radar/attempts/01E4ZCR3C56J083X43JQXF3JK5 \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  --request PUT \
  --data '{
    "attempt_status": "success"
  }'

Radar supports explicitly blocking and allowing attempts based on attempt attributes. You can manage these lists via the Radar list management APIs

Adds an entry to a Radar list

curl https://api.workos.com/radar/lists/ip_address/block \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  --request POST \
  --data '{
    "entry": "49.78.240.97"
  }'

Removes an entry from a Radar list

curl https://api.workos.com/radar/lists/ip_address/block \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  --request DELETE \
  --data '{
    "entry": "49.78.240.97"
  }'