Account Modification Feedback

post

https://api.signifyd.com/v3/accounts/events/modifications/feedback

The Account Modification Feedback API captures the final outcome of sensitive account changes, such as password updates or contact info changes. By sending this feedback, merchants help Signifyd better understand the effectiveness of risk recommendations and enhance future detection.
Use this endpoint once the account modification flow is complete, whether the change was applied, blocked, or required verification. The feedback should reflect what actually happened during the session.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

modificationId

string

required

A unique ID for this account modification that you can use to retrieve this modification event later.

accountId

string

needed Your globally unique identifier for registered user accounts. Use this as the persistent user identifier, consistent across Account Integrity APIs.

outcome

string

enum

required

The final outcome of the event:

ALLOWED - Event was allowed.
DENIED - Event was denied.
STEP_UP_SUCCESSFUL - Event was challenged and step-up challenge was completed successfully.
STEP_UP_FAILED - Event was challenged and step-up challenge was failed.
ALERT_ACKNOWLEDGED - Alert was acknowledged.
OTHER - Other event outcome.

Allowed:

outcomeReason

string

Optional short reason code (e.g., EMAIL_VERIFIED, SMS_TIMEOUT, USER_REPORTED, MANUAL_REVIEW_REQUIRED).

overridden

boolean

required

Set to true if your system took a different action than Signifyd’s recommendation.

recordedAt

date-time

required

The date and time when the feedback was recorded.

Formatted as yyyy-MM-dd'T'HH:mm:ssZ per ISO-8601.

Headers

SIGNIFYD-TEAM-ID

int64

The team id requested for authentication. This should normally be omitted, as it's only relevant when auth credentials allow requests for multiple teams.

Responses

201Response if the feedback was successfully recorded.

400Response if there was a problem with the request, such as when a required field is missing or otherwise fails validation.

401Response if the provided authentication credentials are not known or do not match what is on file for the specified user.

403Response if the authenticated user does not have permission to perform the requested action.

409Response if the Request is considered to conflict with data already on the system.

429Response if the rate limit has been exceeded.

500Response if an unexplained error occurs on the server.