This activity shows you how to create a new risk evaluation. This scenario illustrates the following common operations supported by the PingOne APIs:

• Get a list of risk policy set resources
• Create a risk evaluation resource that uses a specific risk policy set

Prerequisites

Get an access token from the worker application that you created in Getting Started with the PingOne APIs. To get a token from a different worker application in an alternate sandbox environment, run the token request endpoint using the client ID and client secret of your chosen worker app to authenticate the request. For more information, see GET a Worker Application Access Token.

Workflow order of operations

To create the new risk evaluation, the following tasks must be completed successfully:

1. Make a GET request to /environments/{{envID}}/riskPolicies to return the list of risk policy set resources associated with the environment.

2. Make a POST request to /environments/{{envID}}/riskEvaluations to create a new risk evaluation resource that references a risk policy set resource.

Click the Run in Postman button below to download the Postman collection for this use case.

Defining the risk evaluation resource

For the POST request to /environments/{{envID}}/riskEvaluations, the risk evaluation resource definition lets you specify the risk policy set to apply to the evaluation. If a particular risk policy set is not specified, the risk evaluation uses the environment’s default risk policy set to determine the risk levels for the event. In this use case, the risk evaluation sets theriskPolicySet.id property to the {{riskPolicySetID}} Postman variable, which should contain the ID of the risk policy set that you created in the USE CASE: Create a risk policy set activity.

The risk evaluation definition must include an event object that specifies details about the authentication action to evaluate against the risk policies defined in the risk policy set. In its most basic form, the event object defines a user (user.id and user.type) and an IP address (ip). From this information, the risk evaluation can provide a meaningful risk response for all supported risk predictors (anonymousNetwork, ipRisk, geoVelocity, userRiskBehavior) except the user risk behavior predictor, which requires the targetResource and UserAgent properties. For more information about the risk evaluation event data model, see Risk Evaluations in the PingOne API Reference.

The risk evaluation process follows these steps:

1. The risk service receives an event that it is configured to monitor and evaluate.

2. A risk calculation is made for the event based on the configured risk policies.

3. The risk service returns the risk result to the client.