QareShield API
Fraud protection for creator campaign networks. Verify identity, confirm engagement, and gate payouts — across Instagram, TikTok, YouTube, and Twitter/X.
Base URL:
https://api.qareshield.qamply.net/v1 · All requests require Authorization: Bearer <API_KEY>Quick start
Get your first fraud score in under 5 minutes. Register for a free API key →
const res = await fetch('https://api.qareshield.qamply.net/v1/user/risk-score', { method: 'POST', headers: { 'Authorization': 'Bearer fg_live_your_key_here', 'Content-Type': 'application/json', }, body: JSON.stringify({ user_id: 'creator_8821', platform: 'instagram', social_handle: '@thecreator', ip_address: '203.0.113.42', device_id: 'fp_a8f3bc9d1e', checks: ['identity', 'ip_reputation', 'velocity'], }), }); const { score, verdict, signals } = await res.json(); // → score: 82, verdict: "block", signals: [...]
Authentication
All API requests require a Bearer token in the Authorization header. Keys come in two forms:
| Prefix | Environment | Notes |
|---|---|---|
| fg_test_... | Sandbox | Returns simulated data. Safe to use in development. |
| fg_live_... | Production | Real checks. Counts against your monthly quota. |
Live keys are shown once at creation and cannot be retrieved. Store them in environment variables — never commit them to source control.
POST
/user/risk-score
Free+
Returns a composite fraud risk score (0–100) for a user. Combines signals from IP intelligence, device fingerprinting, social profile analysis, and behavioral velocity. The primary endpoint for real time fraud decisions.
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
| user_id | string | required | Your internal ID for the user being checked |
| platform | string | required | instagram tiktok youtube twitter |
| ip_address | string | optional | IPv4 or IPv6. Enables IP reputation + VPN detection |
| device_id | string | optional | FingerprintJS visitor ID. Enables device + multi-account detection |
| social_handle | string | optional | Creator's platform handle. Enables profile quality checks |
| campaign_id | string | optional | Used for velocity checks across actions in same campaign |
| checks | string[] | optional | Subset to run: identity ip_reputation device velocity. Default: all |
Response
Verdict values
approve — score < 35
review — score 35–70
block — score > 70
{
"request_id": "req_9xLpQ2mK7nT",
"score": 82,
"verdict": "block",
"confidence": 0.94,
"recommendation": "Block action. Hold payout. Request re-verification.",
"signals": [
{ "id": "vpn_detected", "severity": "high", "weight": 0.35 },
{ "id": "bot_click_pattern", "severity": "high", "weight": 0.38 }
],
"latency_ms": 64
}
POST
/identity/verify
Free (basic) · Pro (liveness+ID)
Multi-layer identity verification. Free tier covers social profile, device, IP, and geo. Pro+ adds liveness detection and government ID document matching.
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
| user_id | string | required | Your internal user ID |
| platform | string | required | Social platform |
| social_handle | string | required | Creator's handle on the platform |
| ip_address | string | optional | User's IP address |
| device_id | string | optional | FingerprintJS visitor ID |
| selfie_base64 | string | Pro+ | Base64 encoded selfie image for liveness check |
| id_doc_base64 | string | Pro+ | Base64 encoded government ID document |
| claimed_country | string | optional | ISO 3166-1 alpha-2 country code for geo-consistency check |
POST
/engagement/verify
Pro+
Verify a creator actually performed a specific campaign action. Uses direct platform API confirmation where OAuth tokens are provided, combined with timing analysis and velocity checks.
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
| user_id | string | required | Your internal user ID |
| platform | string | required | Social platform |
| campaign_id | string | required | Your campaign ID |
| action_type | string | required | like share follow view comment post retweet |
| target_content_id | string | required | The post/video/account ID the action was performed on |
| access_token | string | optional | Creator's OAuth token. Enables direct API confirmation (strongest signal) |
| submission_timestamp | number | optional | Unix ms when creator claimed to complete the action |
| task_start_timestamp | number | optional | Unix ms when the task was assigned. Used for timing analysis |
POST
/payout/gate
Pro+
Call this endpoint immediately before releasing any payout. Runs a full fraud check and returns a gate decision. High value payouts and crypto payouts automatically go to review regardless of score.
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
| user_id | string | required | Creator receiving the payout |
| platform | string | required | Social platform |
| campaign_id | string | required | Campaign the payout relates to |
| payout_amount | number | required | Amount in major currency units (e.g. 49.99 for $49.99) |
| currency | string | required | USD NGN GBP EUR USDT BTC |
| payout_method | string | required | paystack paypal btc usdt bank |
Error codes
| HTTP | Error code | Meaning |
|---|---|---|
| 400 | validation_error | Missing or invalid request body field |
| 401 | missing_api_key | No Authorization header provided |
| 401 | invalid_api_key | Key not found, revoked, or wrong format |
| 403 | tier_restriction | Endpoint requires a higher plan |
| 429 | rate_limit_exceeded | Too many requests per second |
| 429 | monthly_quota_exceeded | Monthly call limit reached |
| 500 | internal_error | Something went wrong on our end |
Rate limits
| Plan | Monthly calls | Per second | Overage |
|---|---|---|---|
| Free | 1,000 | 2 req/s | Blocked |
| Pro | 50,000 | 50 req/s | $0.004/call |
| Scale | Unlimited | 500 req/s | Included |
Remaining quota is returned on every response in the X-RateLimit-Remaining-Month header.
Guide — creator onboarding flow
The recommended integration pattern when a creator joins your platform for the first time:
// Step 1 — Collect device fingerprint on the frontend // Install: npm install @fingerprintjs/fingerprintjs const fp = await FingerprintJS.load(); const { visitorId } = await fp.get(); // Step 2 — Send to your backend, which calls QareShield const identity = await qareshield.post('/identity/verify', { user_id: creator.id, platform: creator.platform, social_handle: creator.handle, ip_address: req.ip, device_id: visitorId, claimed_country: creator.country, }); // Step 3 — Route based on result if (identity.result === 'verified') { // Activate account } else if (identity.result === 'review') { // Queue for manual review, restrict to low-value campaigns } else { // Reject onboarding, show reason flags }
QareShield by Qamply · hello@qamply.net · qareshield.qamply.net