Developer documentation

curl -X POST "$REMORANT_API_URL/api/v2/transactions/score" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "transaction": {
      "transaction_id": "txn_9x8K2",
      "amount": 750.0,
      "currency": "USD",
      "transaction_time": "2026-09-02T03:15:00Z",
      "channel": "ecommerce",
      "merchant": {
        "id": "merchant_123",
        "category": "electronics",
        "country": "US"
      },
      "customer": { "id": "customer_456", "country": "US" },
      "device": { "ip_address": "203.0.113.10" }
    }
  }'

{
  "request_id": "5de12db5-6dc0-477b-80bb-e0d13f06116e",
  "transaction_id": "txn_9x8K2",
  "fraud_probability": 0.734,
  "risk_score": 734,
  "risk_band": "high",
  "decision": "block",
  "recommended_action": "BLOCK",
  "decision_id": "dec_5de12db5-6dc0-477b-80bb-e0d13f06116e",
  "audit_reference": "prediction:5de12db5-6dc0-477b-80bb-e0d13f06116e",
  "reason_codes": [
    {
      "code": "MODEL_SCORE_ABOVE_THRESHOLD",
      "message": "Model fraud probability exceeded the active decision threshold.",
      "severity": "high",
      "evidence": { "fraud_probability": 0.734, "threshold": 0.5 }
    }
  ],
  "policy_rules_triggered": ["ACTIVE_THRESHOLD_EXCEEDED"],
  "threshold": 0.5,
  "threshold_source": "global"
}

import hmac, hashlib, os
from flask import Flask, request

def verify_signature(payload_bytes: bytes, header_sig: str, secret: str) -> bool:
    """Return True if the webhook signature is valid."""
    expected = hmac.new(
        secret.encode(),
        payload_bytes,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, header_sig)

app = Flask(__name__)

@app.route("/remorant-webhook", methods=["POST"])
def handle_webhook():
    ok = verify_signature(
        request.get_data(),                              # raw bytes: before JSON parsing
        request.headers.get("X-Remorant-Signature", ""),
        os.environ["REMORANT_WEBHOOK_SECRET"],
    )
    if not ok:
        return {"error": "Invalid signature"}, 401

    event = request.json
    if event["event_type"] == "transaction.fraud_detected":
        handle_fraud_alert(event["data"])
    elif event["event_type"] == "transaction.blocked":
        handle_blocked(event["data"])
    elif event["event_type"] == "drift.detected":
        notify_ops_team(event["data"])

    return {"received": True}, 200

import crypto from 'crypto';
import express from 'express';

function verifySignature(rawBody, headerSig, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  // timingSafeEqual prevents timing-based attacks
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(headerSig));
}

const app = express();

// Use express.raw() to preserve raw bytes for signature verification
app.post('/remorant-webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = req.headers['x-remorant-signature'] ?? '';
  if (!verifySignature(req.body, sig, process.env.REMORANT_WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const event = JSON.parse(req.body);
  switch (event.event_type) {
    case 'transaction.fraud_detected': handleFraudAlert(event.data); break;
    case 'transaction.blocked':        handleBlocked(event.data);    break;
    case 'drift.detected':             notifyOps(event.data);        break;
  }
  res.json({ received: true });
});