- Check an email address POST
- Check an IP address POST
- Check a rate limit POST
- Classify content POST
- Assess an event POST
- Report an assessment's outcome POST
- Create a rate limit bucket POST
- Add an allow or block list entry POST
- Create a rule POST
- Delete a rate limit bucket DELETE
- Remove a list entry DELETE
- Delete a rule DELETE
- Forget a user DELETE
- Retrieve an assessment GET
- Retrieve the calibration GET
- Retrieve a rate limit bucket GET
- Retrieve a list entry GET
- Retrieve a rule GET
- Retrieve the risk settings GET
- List assessments GET
- List rate limit buckets GET
- List allow and block list entries GET
- List rules GET
- Update a rate limit bucket PATCH
- Update a rule PATCH
- Update the risk settings PATCH
Check a rate limit
Takes cost tokens (default 1) from key's share of one of your buckets and says whether to let the request through: a 200 either way, with allowed. Denied requests take nothing. Each key has its own bucket of burst tokens refilling at limit per period_seconds (GCRA, the algorithm COSS limits its own API with). COSS keeps only a keyed hash of key. While COSS can't count, the bucket's on_failure answers and degraded is true.
bearerAuthAuthorizationBearer <token>A secret API key from the dashboard: coss_live_… for production environments, coss_test_… for sandbox environments.
Idempotency-Key?stringMakes retries safe: a repeated allowed check with the same key is answered again without taking more tokens, for an hour. 1-256 characters.
1 <= length <= 256Coss-Version?"2026-10-10"The API version (a date) to use for this request. Defaults to your organization's version, pinned to the latest one when it first used the API and upgraded from the dashboard. The SDK always sends the version it was built for.
"2026-10-10"application/json- body
- body
- …
bucket*stringThe bucket's name.
^[a-z0-9][a-z0-9._-]{0,63}$key*stringWho or what is limited: a user id, an email address, an IP address… COSS keeps only a keyed hash of it.
1 <= length <= 512cost?integerTokens this request takes. Default 1.
1 <= value <= 1000000The answer for this request.
application/json- response
- response
- …
object*"risk_limit""risk_limit"bucket*stringallowed*booleanWhether to let the request through. Denied requests take no tokens.
limit*integerThe bucket's size (burst).
remaining*integerTokens left for this key.
reset_ms*integerMilliseconds until the key's bucket is full again.
retry_after_ms*|When denied: milliseconds until the same request would be allowed; null when it never would (cost above the bucket's size). 0 when allowed.
degraded*booleanCOSS couldn't count (its store was unavailable): allowed is the bucket's on_failure.
import { Coss } from "coss";const coss = new Coss({ apiKey: process.env.COSS_API_KEY, baseUrl: "https://api.coss.com",});const { data, error } = await coss.risk.limit({ bucket: "password_reset", key: "ada@example.com",});{ "object": "risk_limit", "bucket": "password_reset", "allowed": true, "limit": 5, "remaining": 4, "reset_ms": 720000, "retry_after_ms": 0, "degraded": false}