Documentation

Everything you need to integrate with and get the most out of the Argus Mesh fraud prevention platform.

Async API — Real-time Scoring

Submit an order for asynchronous fraud scoring. The API immediately acknowledges receipt while the order flows through the full scoring pipeline (normalization, entity resolution, velocity checks, and rule evaluation).

POST/api/v1/orders

RequestcURL

curl -X POST https://api.argusmesh.ai/api/v1/orders \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{
    "order_id": "ORD-2024-78432",
    "amount": 1249.99,
    "currency": "USD",
    "customer": {
      "id": "CUST-90210",
      "email": "john.doe@example.com",
      "name": "John Doe",
      "phone": "+1-555-0142"
    },
    "shipping_address": {
      "street": "742 Evergreen Terrace",
      "city": "Springfield",
      "state": "IL",
      "zip": "62704",
      "country": "US"
    },
    "billing_address": {
      "street": "1200 Industrial Ave, Apt 4B",
      "city": "Shelbyville",
      "state": "IL",
      "zip": "62565",
      "country": "US"
    },
    "items": [
      {
        "sku": "ELEC-MBP-16",
        "name": "MacBook Pro 16\"",
        "quantity": 1,
        "price": 1149.99,
        "category": "electronics"
      },
      {
        "sku": "ACC-USB-HUB",
        "name": "USB-C Hub Adapter",
        "quantity": 1,
        "price": 100.00,
        "category": "accessories"
      }
    ],
    "payment": {
      "method": "credit_card",
      "last4": "4242",
      "bin": "424242"
    },
    "device": {
      "ip": "203.0.113.42",
      "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_0)",
      "fingerprint": "fp_a1b2c3d4e5f6"
    },
    "session": {
      "id": "sess_xK9mW2pL",
      "duration_seconds": 342,
      "pages_viewed": 7
    }
  }'

Response202 Accepted

{
  "order_id": "ORD-2024-78432",
  "status": "processing",
  "received_at": "2024-11-15T09:23:41.128Z"
}

This endpoint is asynchronous. The order enters the scoring pipeline and results are published to the scoring-results Kafka topic. You can also configure a webhook URL in your account settings to receive scoring results via HTTP callback.

Sync API — Evaluate with Immediate Response

Use the synchronous evaluate endpoint when you need an immediate fraud decision before completing a checkout. The response includes the full risk breakdown: score, matched rules, velocity checks, and a recommended action.

POST/api/v1/orders/evaluate

RequestcURL

curl -X POST https://api.argusmesh.ai/api/v1/orders/evaluate \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{
    "order_id": "ORD-2024-78433",
    "amount": 4899.00,
    "currency": "USD",
    "customer": {
      "id": "CUST-00117",
      "email": "totallylegit99@tempmail.org",
      "name": "Test User",
      "phone": "+1-555-0000",
      "account_age_days": 2
    },
    "shipping_address": {
      "street": "PO Box 1337",
      "city": "Las Vegas",
      "state": "NV",
      "zip": "89101",
      "country": "US"
    },
    "billing_address": {
      "street": "PO Box 1337",
      "city": "Las Vegas",
      "state": "NV",
      "zip": "89101",
      "country": "US"
    },
    "items": [
      {
        "sku": "ELEC-GPU-4090",
        "name": "NVIDIA RTX 4090",
        "quantity": 2,
        "price": 2449.50,
        "category": "electronics"
      }
    ],
    "payment": {
      "method": "credit_card",
      "last4": "9999",
      "bin": "510510"
    },
    "device": {
      "ip": "185.220.101.34",
      "user_agent": "python-requests/2.31.0",
      "fingerprint": "fp_000000000000"
    },
    "session": {
      "id": "sess_anonBot01",
      "duration_seconds": 8,
      "pages_viewed": 1
    }
  }'

Response200 OK

{
  "order_id": "ORD-2024-78433",
  "risk_score": 872,
  "risk_level": "CRITICAL",
  "recommendation": "block",
  "matched_rules": [
    {
      "rule_id": "rule_high_value_new_account",
      "name": "High-value order from new account",
      "score_contribution": 320,
      "condition": "amount > 2000 AND customer.account_age_days < 7"
    },
    {
      "rule_id": "rule_tor_exit_node",
      "name": "Known Tor exit node IP",
      "score_contribution": 250,
      "condition": "device.ip IN list:tor_exit_nodes"
    },
    {
      "rule_id": "rule_bot_user_agent",
      "name": "Non-browser user agent",
      "score_contribution": 180,
      "condition": "device.user_agent REGEX '^python-requests|^curl|^wget'"
    },
    {
      "rule_id": "rule_session_too_short",
      "name": "Suspiciously short session",
      "score_contribution": 122,
      "condition": "session.duration_seconds < 15 AND session.pages_viewed < 3"
    }
  ],
  "velocity_checks": [
    {
      "name": "orders_per_ip_1h",
      "description": "Orders from same IP in last hour",
      "current_value": 12,
      "threshold": 5,
      "exceeded": true
    },
    {
      "name": "amount_per_email_24h",
      "description": "Total spend from email in 24 hours",
      "current_value": 9798.00,
      "threshold": 5000.00,
      "exceeded": true
    }
  ],
  "evaluated_at": "2024-11-15T09:24:02.047Z",
  "latency_ms": 38
}

The synchronous endpoint adds ~20-50ms latency compared to the async flow since it waits for scoring to complete. Use it at checkout for real-time decisioning; use the async endpoint for post-order analysis and batch processing.

Core Concepts

Understand the key building blocks of the platform.

Real-time Scoring

Every transaction is scored in under 50ms through a multi-stage Kafka pipeline. Orders enter via the API Gateway, get normalized, enriched with entity data, and evaluated against your rules.

Rule Engine & DSL

Define fraud rules using an intuitive domain-specific language. Supported operators include eq, neq, gt, lt, in, not_in, regex, and exists. Rules can be combined with AND/OR logic and weighted scoring.

Graph Entity Resolution

Neo4j maps relationships between emails, phones, devices, IPs, and addresses. Graph traversal reveals hidden fraud rings that isolated rule checks would miss.

Velocity Checks

Redis sorted sets track transaction rates over sliding time windows. Define thresholds like "max 5 orders per 10 minutes per email" to catch automated fraud patterns.

Risk Levels & Actions

Scores range from 0 to 1000: LOW (0-150), MEDIUM (150-400), HIGH (400-800), CRITICAL (800+). Each level triggers configurable actions — approve, flag for review, or block.

Architecture Overview

Argus Mesh uses an event-driven microservices architecture for high-throughput, low-latency fraud detection.

OrderAPI GatewayKafkaIngestion

GraphAnalyticsScoring

Result

PostgreSQL — Source of truth for rules, cases, users

Redis — Real-time velocity tracking and caching

Neo4j — Graph entity resolution and fraud ring detection

Elasticsearch — Transaction analytics and search

API Reference

Full API documentation with interactive endpoints and data models.

Swagger UI