coss.comdocs

Create a rule

POST
/v1/risk/rules

Rules decide after the allow and block lists and before the score thresholds: the first enabled rule (lowest position, then oldest) whose conditions match the event sets the decision to its action. Conditions test the fields listed in the docs; a field without a value (no IP, no email) never matches. At most 50 rules per environment.

Authorization

bearerAuth
headerAuthorizationBearer <token>

A secret API key from the dashboard: coss_live_… for production environments, coss_test_… for sandbox environments.

Header Parameters

Coss-Version?"2026-10-10"

The API version (a date) to use for this request. Defaults to your organization's version, pinned to the latest one when it first used the API and upgraded from the dashboard. The SDK always sends the version it was built for.

Value in"2026-10-10"

Request Body

application/json
  1. body
name*string
Length1 <= length <= 100
enabled?boolean
position?integer

Default 0.

Range0 <= value <= 10000
events?array<>
Itemsitems <= 5
match?string

Default all.

Value in"all""any"
conditions*array<>
Items1 <= items <= 20
action*RiskDecision

allow: go ahead. review: suspicious; let it through with limits, or hold it for a person. block: refuse it.

Value in"allow""review""block"

Response Body

The new rule.

application/json
  1. response
object*"risk_rule"
Value in"risk_rule"
id*string
name*string
enabled*boolean
position*integer

Rules are tried in ascending order.

events*array<>

Events it applies to; empty: every event.

match*string

all: every condition must hold. any: one is enough.

Value in"all""any"
conditions*array<>
action*RiskDecision

allow: go ahead. review: suspicious; let it through with limits, or hold it for a person. block: refuse it.

Value in"allow""review""block"
created_at*string
Formatdate-time
updated_at*string
Formatdate-time
import { Coss } from "coss";const coss = new Coss({  apiKey: process.env.COSS_API_KEY,  baseUrl: "https://api.coss.com",});const { data, error } = await coss.risk.rules.create({  name: "Disposable email from a data center",  events: [    "signup",  ],  conditions: [    {      field: "email.disposable",      operator: "is",      value: true,    },    {      field: "ip.hosting",      operator: "is",      value: true,    },  ],  action: "block",});
{  "object": "risk_rule",  "id": "rskrule_01k7c8m4q2f3e9v6t5r1n0p8yz",  "name": "Disposable email from a data center",  "enabled": true,  "position": 0,  "events": [    "signup"  ],  "match": "all",  "conditions": [    {      "field": "email.disposable",      "operator": "is",      "value": true    },    {      "field": "ip.hosting",      "operator": "is",      "value": true    }  ],  "action": "block",  "created_at": "2026-01-15T09:30:00.000Z",  "updated_at": "2026-01-15T09:30:00.000Z"}