Check an order · Antiro Docs

POST https://api.antiro.io/v1/assessments

Body parameters#

Every parameter is optional, but the decision is only as accurate as what you send.

session_token string Recommended: The order reference: the form’s antiro_token field, the _atr_st cookie, or Antiro.token().
order_id string Recommended: Your order number. Sending the same value again returns the first decision and creates nothing new.
phone string Recommended: The customer’s phone number, as typed.
ip string Recommended: The shopper’s real IP address, not your server’s. Behind Cloudflare, read it from the CF-Connecting-IP header.
name string: The customer’s name.
address string: The delivery address.
wilaya string: The wilaya.
commune string: The commune.
total number: The order amount. A value that is not a number is ignored.
sdk_expect forms | collect: Says how this order’s page runs the script. See Tell Antiro which mode you use. Send it only for orders placed on pages that run the script.
sdk_required boolean: Strict mode for this order, read only together with sdk_expect. With true, an order that carries no reference at all is refused instead of held for review. See Strict mode.
client_headers object: Headers of the shopper’s own order request, under lower-case names: user-agent, accept-language, sec-ch-ua, sec-ch-ua-mobile, sec-ch-ua-platform, sec-fetch-site, sec-fetch-mode, sec-fetch-dest, x-requested-with, origin and referer. Other names are dropped.

Example request#

POST /v1/assessments

curl https://api.antiro.io/v1/assessments \
  -H "X-API-Key: $ANTIRO_SECRET_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "session_token": "<antiro_token>",
    "sdk_expect": "forms",
    "order_id": "1042",
    "phone": "0661234567",
    "name": "Yacine Benali",
    "address": "Cite 200 logements, Bab Ezzouar",
    "wilaya": "Alger",
    "total": 4900,
    "ip": "105.101.22.7"
  }'

const API = 'https://api.antiro.io/v1/assessments';

const res = await fetch(API, {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ANTIRO_SECRET_KEY,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    session_token: req.body.antiro_token,
    sdk_expect: 'forms',
    order_id: order.id,
    phone: order.phone,
    name: order.name,
    address: order.address,
    wilaya: order.wilaya,
    total: order.total,
    ip: req.ip,
  }),
  signal: AbortSignal.timeout(6000),
});

const { action, reasons } = await res.json();

$token = $_POST['antiro_token']
    ?? $_COOKIE['_atr_st'] ?? '';

$ch = curl_init('https://api.antiro.io/v1/assessments');

curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 6,
    CURLOPT_HTTPHEADER => [
        'X-API-Key: ' . getenv('ANTIRO_SECRET_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'session_token' => $token,
        'sdk_expect' => 'forms',
        'order_id' => $order['id'],
        'phone' => $order['phone'],
        'name' => $order['name'],
        'address' => $order['address'],
        'wilaya' => $order['wilaya'],
        'total' => $order['total'],
        'ip' => $_SERVER['REMOTE_ADDR'],
    ]),
]);

$answer = json_decode(curl_exec($ch), true);
$action = $answer['action'] ?? null;

Response#

A successful check answers 201 Created.

action string: What to do with the order: allow, review or block. See Act on the decision.
recommended string: Antiro’s own decision. It differs from action in Monitor mode.
probability number: The probability that the order is fake, from 0 to 1.
confidence number: How much Antiro trusts that probability, from 0 to 1.
reasons array: The reasons for the decision, strongest first. See Reasons.
id string: The id of this check. Use it as assessment_id when you report an outcome, or to read the check later.
order_id string: Antiro’s id for the order. It is not your order number.

201 Created

{
  "id": "dfe0a5d8-9284-48d6-a2cd-ec49f2957f3b",
  "order_id": "94074eb2-6c23-42e0-92f9-9f865cf88452",
  "action": "review",
  "recommended": "review",
  "probability": 0.94,
  "confidence": 0.65,
  "reasons": [
    {
      "code": "contact.phone:pattern",
      "group": "contact",
      "weight": 1.36,
      "label": {
        "en": "Fake-looking phone number",
        "ar": "رقم هاتف يبدو وهمياً",
        "fr": "Numéro d’apparence factice"
      }
    },
    {
      "code": "contact.address:weak",
      "group": "contact",
      "weight": 0.51,
      "label": {
        "en": "Incomplete delivery address",
        "ar": "عنوان توصيل ناقص",
        "fr": "Adresse de livraison incomplète"
      }
    }
  ]
}

Reasons#

Each item of reasons has these fields:

code string: A short code for the reason.
group string: The family the reason belongs to.
weight number: How much the reason counted.
label object: A ready-made text for your team, in en, ar and fr.

Read a check later#

GET https://api.antiro.io/v1/assessments/:id

Returns a past check by the id of its answer. The answer has the fields above, plus these three:

kind string: What was checked. For an order check, order.
verdict string: The verdict you reported with POST /v1/outcomes, or null.
created_at string: When the check ran.

GET /v1/assessments/:id

curl https://api.antiro.io/v1/assessments/<id> \
  -H "X-API-Key: $ANTIRO_SECRET_KEY"

200 OK

{
  "id": "dfe0a5d8-9284-48d6-a2cd-ec49f2957f3b",
  "order_id": "94074eb2-6c23-42e0-92f9-9f865cf88452",
  "kind": "order",
  "action": "review",
  "recommended": "review",
  "probability": 0.94,
  "confidence": 0.65,
  "reasons": [],
  "verdict": "fake",
  "created_at": "2026-10-30T10:03:06.493Z"
}