Overview

If your Implementation Engineer has created a custom version of Forter’s API for your integration, log in to Forter Portal to view your customized API Reference documentation.

API Reference API Reference

Forter's APIs can be leveraged for a variety of use cases throughout the user journey. The API reference documentation includes synchronous API endpoints for real-time decisions as well as supplementary APIs used to provide Forter with subsequent status updates after Forter has provided a binary decision and/or recommendation.

Core API Path Core API Path

Please send all API requests to a dedicated path for your account, by appending your Site ID to the beginning of the URL.

https://{site-id}.api.forter-secure.com/{endpoint}

Note that there is a different path for Forter's Tokenization API.

Authentication Authentication

All requests to Forter’s APIs must be made over HTTPS. In order to authenticate, include both the Site ID and API Key, which can be found in Credentials, in the request headers. Forter uses Basic Authentication credentials in the form of a username and password, where the API key is the username and the password is empty.

Note that your Site ID and API Key are different for your Forter test site and production site.

curl -X POST "https://{site-id}.api.forter-secure.com/{endpoint}"
-u "{api-key}:"
-H "api-version: 10.1"
-H "content-type: application/json"
-H "x-forter-siteid: {site-id}"
-d @filepost.data

Headers Headers

HTTP Codes HTTP Codes

Forter uses conventional HTTP response codes to indicate the success or failure of an API request. In general, codes in the 2xx range indicate success, codes in the 4xx range indicate an error that resulted from the provided information, while codes in the 5xx range indicate an error with Forter's servers.

Timeouts Timeouts

In order to prevent connection failovers due to internet network failures, set a client side timeout of 2 seconds on the HTTP request.

Retries Retries

In the following cases we recommend that you retry the request once:

• Client side timeout
• 5xx error code
• 429 error code

The retry can be immediate or at a later stage if relevant and possible (for example after capturing the money and before shipping). In any case we prefer that you backfill the request to Forter in order for us to have a complete picture of good/bad customers.

In a case of an additional failure on the retry, we recommend that you alert us and diagnose.

Load Testing Load Testing

Your test site is limited to 10 RPS (Requests per seconds). Requests beyond this limit will result in a 429 error code. You can exceed this rate limit by including the header x-forter-disable-persistence = true in your load test requests. Requests made with this header will not be visible in Forter’s decision dashboard, so you should not include this header in real production requests.

TLS Session Reuse TLS Session Reuse

For low-latency applications, every millisecond counts. One common source of unnecessary latency is the repeated TLS handshake process when making API requests. If your application does not reuse TLS sessions, it incurs extra latency and computational overhead for every new connection. To mitigate this, we strongly recommend implementing TLS session reuse and connection pooling.

Conditional Fields Conditional Fields

Note that some fields in the API Reference will be marked as Conditional instead of Required. This is intended to denote that the field is dependentRequired or oneOf. Excluding Conditional fields will not result in an error response, but may be checked during by Forter during the testing phase.

Test Response Handling Test Response Handling

API requests made with your test Site ID will return a randomized decision. In order to test your response handling, you can trigger a specific decision or recommendation by using a specific email address as the customer’s email, a specific credit card number as the payment method, and/or a specific IP address.

Fraud Management Fraud Management

Abuse Prevention Abuse Prevention

3DS Recommendation 3DS Recommendation

3DS Execution 3DS Execution

No challenge required

Challenge executed

Account Protection Account Protection