CyborgNetics API

A single REST endpoint scores any visitor, session, or API call. Send the raw signals your SDK collects; receive a trust decision. All scoring happens server-side — a client-computed score is never trusted.

Base URL: https://api.cyborgnetics.com. All requests and responses are JSON. Every response carries an X-Request-ID and a Server-Timing header for tracing.

Authentication

Authenticate every request with your API key in the X-API-Key header. Publishable keys (cbx_live_…) are safe to embed in browser SDKs and may only submit analyses. Secret keys are used server-side for dashboard and management endpoints and must never ship to the client.

X-API-Key: cbx_live_9f2a…

Missing or invalid keys return 401 Unauthorized. Each key is scoped to one organization; data is fully isolated per tenant.

Rate limits

Requests are limited per API key using a token bucket. Exceeding the limit returns 429 Too Many Requests with a Retry-After header (seconds). Default developer limit is 120 requests/minute; production tiers raise this.

Errors

Standard HTTP status codes are used.

Analyze a session

The core decisioning call. Submit the raw signals collected by the SDK across four groups — device, behavior, automation, and network — plus request context. All fields are optional; the more you send, the higher the confidence.

curl -s https://api.cyborgnetics.com/v1/analyze \
  -H "X-API-Key: cbx_live_9f2a…" \
  -H "Content-Type: application/json" \
  -d '{
    "device":     { "fingerprint_hash": "a4c0…", "cpu_cores": 8, "gpu_renderer": "Apple M2" },
    "behavior":   { "pointer_events": 140, "velocity_variance": 0.09, "curvature": 3.4,
                    "keystrokes": 12, "keystroke_variance_ms": 42, "session_seconds": 14 },
    "automation": { "webdriver": false, "plugins": 3, "languages_count": 2 },
    "network":    { "ip": "203.0.113.9" },
    "context":    { "user_agent": "Mozilla/5.0 (Macintosh)" }
  }'

The response returns two independent scores. trust_score and suspect_score are separate 0–100 scales — not complements — plus a classification, a recommended decision, the contributing signals, and a per-engine breakdown.

{
  "visitor_id": "cbx_ba7816bf8f",
  "request_id": "ed16f1f9b3054f31…",
  "trust_score": 88,
  "suspect_score": 12,
  "classification": "human",
  "decision": "allow",
  "signals": ["stable_fingerprint", "normal_behavior", "no_automation_artifacts", "clean_ip"],
  "engines": {
    "device_confidence": 62,
    "human_probability": 86,
    "automation_risk": 3,
    "network_risk": 15
  }
}

Look up a visitor

Returns the stored record for a visitor, including how many times they’ve been seen and their most recent verdict. Visitor IDs are derived from the device fingerprint, so repeat sessions from the same device converge to one identity.

{
  "visitor_id": "cbx_ba7816bf8f",
  "org": "org_demo",
  "last_seen": "2026-07-05T18:51:26+00:00",
  "seen_count": 4,
  "last_verdict": { "trust_score": 88, "decision": "allow", "...": "…" }
}

List recent threats

Returns recent high-suspect verdicts (challenged or blocked), newest first — the feed powering the dashboard threat view.

[
  {
    "visitor_id": "cbx_b3627bb255",
    "suspect_score": 69,
    "classification": "automation",
    "decision": "block",
    "last_seen": "2026-07-05T18:51:26+00:00"
  }
]

Aggregate stats

Rolled-up counters for analytics: totals, average trust, threat rate, and breakdowns by decision and classification.

{
  "total_analyzed": 10,
  "unique_visitors": 10,
  "avg_trust_score": 65,
  "threat_rate": 30.0,
  "by_decision": { "allow": 5, "monitor": 2, "challenge": 0, "block": 3 },
  "by_classification": { "human": 5, "automation": 3, "suspicious": 2 },
  "active_threats": 3
}

Ingest events

Stream supplementary behavioral or business telemetry tied to a visitor (e.g. signup, purchase, login). Events enrich the identity graph and future scoring.

{ "visitor_id": "cbx_ba78…", "type": "signup", "payload": { "plan": "growth" } }

Replay a decision

Fetch the last cached decision for a visitor without re-running analysis — useful for edge enforcement where a full analyze round-trip isn’t needed.

{ "visitor_id": "cbx_ba78…" }

SDKs

The Web SDK collects signals and submits them for you. Initialize once; gate on the returned decision. React, Node, iOS, and Android SDKs share the same contract.

import { cyborgnetics } from "@cyborgnetics/web";

cyborgnetics.init({
  apiKey: "cbx_live_9f2a…",   // publishable key — safe in the browser
  mode: "enforce",            // "observe" to learn, "enforce" to act
  onDecision: (v) => {
    if (v.decision === "block") return showChallenge();
    proceed(v);
  }
});

In observe mode the SDK reports without acting — use it to calibrate thresholds before switching to enforce.