JoshDavisFromNC's account

No sensitive data here, all test data.

These are the register, login, and validate payloads I used for the original path.

To simulate the phishing attempt, I changed clientIP to "95.173.136.71" in login and validate, and I changed sessionID to "00000002" in validate.

Thank you for your response. When I change the eventType to LoginAttempt, the Russian IP address gets the riskResponseCode of 2 and a sessionStatus of unknown, and I can see that the rule was fired in the Risk Analytics dashboard. So that answers my original question, and now I see that the parent rule's campaign criteria is set up to trigger on LoginAttempt, so I understand why it needed to change.

I do get the 409 response from the generate-secure-challenge API, but that's expected behavior. I haven't yet installed your Android app on my phone and performed the activation. That's next on my list.

The AdaptiveRegisterUserInput works fine for me. However, when I try to log in with the AdaptiveLoginInput, I get a 500 error code response, and I didn't see any indication of what I might have done wrong. I attached the JSON payloads for both calls.

Yes, that was it. Thanks again.

Request and response bodies for /user/register are attached.

My question is more about what workflow to follow to activate a digipass. The API sandbox lists all of the API's, but I can't find a doc that says what order I need to call them to implement specific workflows, and I have questions about what I'm supposed to pass in for some of the arguments.

Thanks