Navigation
View as Markdown

Verdicts

A verdict is Rupt's decision on an evaluation. It's the output of the policy that matched, and it tells your server what to do with the user's action. The verdict is the matched policy's terminal verdict, so the set below is exactly the set of verdicts a policy can carry.

The verdicts

VerdictWhat it meansServer action
allowNothing matched, or the matched policy says let it through.Honor the action.
denyA policy matched and blocks outright.Block the action.
challengeIdentity needs to be verified before you trust the action.Block until the linked challenge reaches completed. Otherwise keep blocking.
reviewA person needs to look before the action goes through. Used for content a user wrote.Hold the action and wait for the review.decided webhook, then honor or block based on its decision.
suspendThe user has been suspended on this project.Block. The suspension stays in place until you lift it.
add_to_listThe matched value was added to a list.Honor the action. Rupt has already applied the list change.
remove_from_listThe mirror of add_to_list.Honor the action. The list change is already done.

The value behind add_to_list / remove_from_list depends on the list: it can be the user, IP, email, fingerprint, or another field the list is keyed on.

Soft vs hard verdicts

allow, deny, and suspend are final: the verdict is the answer. challenge and review are not. With a challenge, the real answer depends on whether the user passes, so treat challenge like deny until you've confirmed the challenge reached completed. Any other state (failed, skipped, or still in progress) should stay blocked. With a review, the answer depends on a person: hold the action until review.decided arrives, or deliver it and retract on a deny if your product can live with that.

add_to_list and remove_from_list never block the action. They let a policy maintain state without interrupting the user, and they usually ride along with a verdict on the same policy: you get the verdict back and the list change is already applied. A policy carrying nothing but list verdicts reports the mutation itself as its verdict.

Confirming server-side

The verdict that reaches the client is advisory. A determined attacker can strip it before it gets back to your server, so don't trust the client copy for anything that matters. Confirm the verdict by fetching the evaluation directly from Rupt, then check that the action, user, email, phone, and metadata on it match what your server expected before you honor the action. The wiring is in Quick start step 3.