To define the risk configuration, the risk API uses a risk policy set with risk policy conditions defined within the policy set.

Risk policy sets

Risk policy sets are containers for specific risk logic. You can define multiple risk policy sets and deploy them to initiate different authentication flow actions based on the calculated risk. For example, you can define a risk policy set that includes condition logic to block all high-risk IP addresses. Risk policy sets contain a list of ordered risk policies.

Risk policies

Risk policies are made up of the following three components:

• Condition

  Policy logic to define when the policy is evaluated to true and when it is evaluated to false.

• Result

  Policy logic to define what should be returned in case the condition is evaluated to true.

• Priority

  A priority ranking to define the execution order of the different policies contained in the policy set.

Value comparison rules

Value comparison rules compare a placeholder to a value, as shown in the following example:

{
  "value": "${some.placeholder}",
  "equals": "some value"
}

The following table shows supported placeholders and identifies whether the placeholder can be used in value comparison conditions.

IP range rule

IP range rule designates IP addresses for whitelisting and blacklisting.

{
  "ipRange": ["1.1.1.1/16", "2.2.2.2/24"],
  "contains": "${transaction.ip}"
}

Weighted average condition

The rule is evaluated as true if the weighted average calculates between the minimum score and the maximum score.

A weight value is assigned to each rule according to its significance, which is determined by the organization’s administrator. The following sample rule shows the weight for two rules: ipRisk at 9 and the weight for geoVelocity at 4. The maximum and minimum scores are set at 60 and 90, respectively.

{
  "aggregatedWeights": [
    {
      "value": "${details.aggregatedWeights.ipRisk}",
      "weight": 9
    },
    {
      "value": "${details.aggregatedWeights.geoVelocity}",
      "weight": 4
    }
  ],
  "between": {
    "minScore": 60,
    "maxScore": 90
  }
}

The following table shows supported placeholders and identifies whether the placeholder can be used in weighted average conditions.

Risk policy set data model

Risk policy data model

Risk policy limitations

There are limitations on the arrangement of the policies in the risk policy set. These limitations enforce separation between override policies and weighted policies.

Override policies

Override policies are the ones with the highest priority. They should be listed at the beginning of the riskPolicies array. They can have value comparison condition rules or IP range condition rules. The risk policy array can have no override policies or multiple override policies.

Weighted policies

Weighted policies determine risk based on aggregated weighted risk score. These policies must be listed in the riskPolicies array after all override policies are specified. An aggregated risk score involves two weighted policies, and these policies must be the last policies in the riskPolicies array.

The weighted policies that determine the aggregated risk score complement each other and are subject to these restrictions:

• The first weighted policy should have result.level=MEDIUM and the second should have result.level=HIGH.

• The value for the condition.aggregatedWeights attribute for both policies must be the same.

• The value for the condition.between.maxScore attribute for the HIGH weighted policy must be 100.

• The value of the condition.between attribute for the two policies must be complementary. For example, if the HIGH policy has condition.between.minScore = 70, the MEDIUM policy should have condition.between.maxScore = 70.