canonical: https://jentic.com/apis/maskbreak.com/maskbreak

# Maskbreak Fraud Detection API

The Maskbreak Fraud Detection API scores visitor sessions and IP addresses for fraud signals such as VPNs, residential proxies, datacenter hosts, antidetect browsers, Tor exits, and bots, and returns an allow, review, or block verdict with a 0-100 risk score. Live visitor evaluation combines a client-side token with network and device evidence, while bare IP lookups check Tor exit lists and published cloud-server ranges with more limited coverage. A usage route reports the calling key's hourly and monthly quota position, and keyless free lookup routes check a single IP or a batch of up to 20.

## For AI agents

Evaluate a visitor session or IP address for VPN, proxy, datacenter, Tor, and bot signals and get an allow, review, or block verdict with a risk score. Check quota usage and run keyless single or bulk IP checks.

## Scope

Does not handle payment processing, chargeback disputes, user authentication, or IP geolocation down to city level. Use for fraud, proxy, VPN, and bot risk verdicts only.

## Capabilities

- Evaluate a visitor session from the client-side token, fingerprintEventId, email, and timezone to get an allow, review, or block decision
- Look up any public IP for Tor exit and cloud-server range matches and read its ASN, AS name, and registration country
- Check up to 20 public IPs in one keyless bulk call for quick triage
- Read the key's hourly quota, monthly allowance, and lookups used without consuming evaluation quota
- Exchange an account email and API key for a short-lived bearer token through the OAuth client_credentials grant
- Fetch deterministic sample evaluation responses by scenario to build and test decision logic before going live

## Use cases

### Agent-driven fraud triage through Jentic

An agent reviewing signups or orders can call Maskbreak through Jentic to triage each one: it evaluates the session when a client-side token is available, falls back to an IP lookup when only an address is known, and routes review verdicts to a human. The verdict and 0-100 risk score give the agent a clear decision field instead of raw network data.

Example prompt: For each new signup in the queue, look up its IP with the Maskbreak lookup operation, flag any result with a review or block verdict, and post the flagged signups with their risk scores to the review channel

### Checkout and signup bot screening

Sites that see fake accounts or card testing evaluate each visitor session server-side by forwarding the Maskbreak client-side token along with the email and timezone. The decision reflects network, device, and email signals, and when the client token is missing the API returns a degraded answer flagged with degraded: true so the caller knows the network layer could not run.

Example prompt: POST the visitor's Maskbreak token, fingerprintEventId, and email to the evaluate operation, block the signup if the decision is block, and require email verification if it is review

### Quota-aware monitoring

Teams on the Free plan get 10,000 visitor checks a month, up to 1,000 an hour, and a used-up monthly allowance answers with the monthly_quota_exceeded code. Reading the usage route, which consumes no evaluation quota, lets an integration slow down or alert before checks start failing.

Example prompt: Call the usage operation, compare month_used to monthly_limit, and send an alert when the remaining monthly allowance is running low

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `/v1/evaluate` | Evaluate a visitor session |
| GET | `/v1/lookup/{ip}` | Look up an arbitrary IP address |
| GET | `/v1/usage` | Quota position for the calling key |
| POST | `/oauth/token` | Exchange an API key for a short-lived bearer token |
| POST | `/api/lookup-bulk` | Free bulk IP check |
| GET | `/v1/evaluate/sample` | Sample evaluation response |

## Key resources

- **Evaluations** — Score a visitor session and fetch sample responses by scenario.
- **IP lookups** — Keyed lookup of any public IP, plus keyless single and bulk checks.
- **Usage** — Hourly and monthly quota position for the calling key.
- **OAuth tokens** — Exchange an account email and API key for a short-lived bearer token.
- **Service status** — Service health and aggregate threat counts.

## AI readiness

This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.

- **Score:** 67 / 100
- **Maturity:** AI-Aware
- **Dimensions:**
  - Foundational Compliance: 90 / 100
  - Developer Experience & Jentic Compatibility: 68 / 100
  - AI-Readiness & Agent Experience: 46 / 100
  - Agent Usability: 94 / 100
  - Security: 73 / 100
  - AI Discoverability: 68 / 100
- **View full report:** https://jentic.com/apis/maskbreak.com/maskbreak/scorecard
- **How the score is calculated:** https://docs.jentic.com/reference/api-readiness-framework/overview/
- **More about the dimensions:** https://docs.jentic.com/reference/api-readiness-framework/specification/#dimensional-model-overview

### Score it yourself

Every API in the directory is allowlisted, so you can re-score it with no key required.

- **Score your own API:** https://jentic.com/scorecard.md
- **Scoring CLI agent skill:** https://github.com/jentic/jentic-api-scorecard/blob/main/skills/jentic-api-scorecard/SKILL.md

```sh
npx @jentic/api-scorecard-cli score <openapi-url>
```

## Why Jentic

- **Setup:** Wiring Maskbreak by hand means choosing between a bearer API key and the OAuth client_credentials exchange, keeping live and test keys apart, and tracking hourly and monthly quotas yourself. Through Jentic you install once, import Maskbreak from the API Directory, store the key once, and your agent calls it.
- **Permission scoping:** Maskbreak carries the session details in the request body, so rules bound which operations your agent may call rather than which visitor. You choose the operations it may call, such as IP lookups and usage reads, so session evaluations that spend your visitor-check allowance are not included unless you add them.
- **Credential handling:** Your Maskbreak API key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'detect a VPN user' or 'score a visitor for fraud', and Jentic returns the matching Maskbreak operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Fingerprint** — Fingerprint identifies devices and returns bot and VPN signals from its own client agent.
- **ipdata** — ipdata returns IP geolocation with threat and proxy flags.
- **MaxMind** — MaxMind provides IP intelligence and transaction risk scoring.
- **Sift** — Sift scores user behaviour and payment events across an account's lifetime.

## FAQ

### What authentication does the Maskbreak Fraud Detection API use?

Per its OpenAPI spec, the Maskbreak API accepts your API key as a bearer token, with live keys starting sk_live_, or a short-lived token from the OAuth client_credentials grant at `/oauth/token`, where client_id is your account email and client_secret is your API key. The device-evidence challenge accepts the bearer key, while the free lookup, sample, status, and threat-feed routes need no credential. Through Jentic the key is stored encrypted on your own instance and injected at call time.

### Is there a Maskbreak MCP server?

You don't need an MCP server to give your agent Maskbreak. Jentic connects it directly from the API Directory: import it, store your credential once, and your agent calls it. Operations are discovered on demand, so no extra server's tool definitions sit in your agent's context.

### Can I limit what my agent is allowed to do with the Maskbreak API?

Yes. For a triage agent, write a rule that allows only the IP lookup and usage operations, so it can score addresses and check remaining quota but cannot run session evaluations that draw on your visitor-check allowance. Every call it makes is logged.

### What are the rate limits for the Maskbreak API?

The spec states the Free plan allows 10,000 visitor checks a month, up to 1,000 an hour, and that the keyed IP lookup has its own monthly allowance of 10 times the plan's visitor checks. The keyless bulk check takes up to 20 IPs and is limited to 3 batches an hour per caller IP. A used-up monthly allowance returns the monthly_quota_exceeded code. See https://maskbreak.com/pricing for paid plan limits.

### What is the difference between evaluating a session and looking up an IP?

Evaluating a session uses the client-side Maskbreak token for full network and device intelligence, so it can detect VPNs, residential proxies, antidetect browsers, and bots. A bare IP lookup only checks Tor exit lists and published cloud-server ranges, keeps country and city null, and known: false means neither list matched, not that the address is safe.

### How do I check an IP address with Maskbreak through Jentic?

Search Jentic for an intent like 'check if an IP is a VPN or proxy', import the Maskbreak API, and store your API key once. Your agent then calls GET `/v1/lookup/{ip}` and reads the verdict and risk score. To run it on your own infrastructure, install Jentic One from its GitHub repo.