Decisions & reasons

Every event gets an answer in the same call, typically in under 50 ms.

200 OK

{
  "id": "evt_W79r7Mh2ywQkhm8baqHr",
  "object": "decision",
  "decision": "block",
  "verdict": "block",
  "score": 96,
  "risk_level": "high",
  "fraud_probability": 0.94,
  "probability": {
    "value": 0.94,
    "interval": [0.83, 0.98],
    "confidence": "high",
    "prior": 0.008,
    "calibrated": true,
    "expected_loss": { "amount": 27730, "currency": "KES" },
    "without_strongest_signal": 0.61,
    "evidence": [
      { "signal": "pattern:new_account_cashout", "kind": "pattern", "reason": "Pattern: New-account cash-out", "likelihood_ratio": 31.2, "applied_ratio": 31.2, "support": 118, "probability_after": 0.2 },
      { "signal": "rule:payout_to_new_destination:.02", "kind": "rule", "reason": "Payout account added 5 minutes ago", "likelihood_ratio": 14.9, "applied_ratio": 3.3, "support": 96, "probability_after": 0.45 }
    ],
    "anomaly": {
      "score": 8.1, "band": "high", "basis": "customer",
      "unusual": [{ "dimension": "method", "reason": "First payment by bank", "surprise": 3.5 }, { "dimension": "device", "reason": "Device first seen 26 hours ago (this customer rarely changes it)", "surprise": 1.8 }]
    },
    "near_misses": [{ "rule": "account_drain", "name": "Account drain", "closeness": 0.94, "reason": "Withdrawing 85% of the balance (flags at 90%)" }],
    "model_version": 12
  },
  "reasons": [
    { "rule": "details_changed_after_signup", "reason": "Phone number and payout account changed 16 minutes after signup", "mode": "enforce", "contribution": 35 },
    { "rule": "payout_to_new_destination",    "reason": "Payout account added 5 minutes ago",                            "mode": "enforce", "contribution": 25 },
    { "rule": "account_drain",                "reason": "Withdrawing 99% of the balance",                                "mode": "enforce", "contribution": 21 }
  ],
  "patterns": [
    { "pattern": "new_account_cashout", "name": "New-account cash-out", "outcome": "block", "points": 139, "alert_at": 75, "block_at": 100 }
  ],
  "customer": { "id": "cus_1001", "status": "held", "risk_level": "high", "screening": "clear" },
  "livemode": false,
  "latency_ms": 16
}

`decision`	What your app should do. In alert-only mode this is always `allow`.
`verdict`	What Sieve concluded, regardless of mode. Drives cases and alerts.
`score`	0–100. About 50 = review line, about 80 = block line.
`fraud_probability`	0–1: how likely this event is fraud, calibrated on your own verdicts. `probability` shows how the figure was reached. See Probability of fraud.
`reasons`	The rules that fired, strongest first, in plain English. `mode: "watch"` means the rule is being trialled and didn’t count toward the score.
`patterns`	Fraud stories that matched, with their points against the alert and block lines.
`customer`	Their standing after this event: `held` or `frozen` customers should not be paid out.

How the verdict is reached

Every rule that applies to the event is evaluated. Each returns a band: how strongly it fired, from 0 to 1.
Enforce rules add weight × band to the risk score. Crossing the review line (default 0.5) sends the event to review; crossing the block line (0.8) blocks it.
Each pattern adds up points from its steps. Crossing its alert line means review; crossing its block line means block.
Hard rules override everything: a blocklist hit or a confirmed sanctions match always blocks; an allowlisted customer is always allowed.
Trust relief raises the lines for verified, long-standing customers with clean history, so your best users are bothered least.