Security

5 endpoints. Each needs an API key or OAuth token with the scope shown; the key already names its store, so paths start at /v1/store. Generated from the live contract; also in openapi.json.

Fraud rules, blocklist and recent checkout checks

GET/v1/store/security

Or name the store: GET /v1/stores/{storeId}/security

security:readrole: fraud:readgetSecurity

Response SecurityOverview

settingsFraudSettingsrequired
blocklistBlocklistEntry[]required
recentChecksFraudCheck[]required
statsobjectrequired
- checks30dintegerrequired
- reviewed30dintegerrequired
- blocked30dintegerrequired

Example

curl "https://api.shopfa.st/v1/store/security" \
  -H "Authorization: Bearer $SHOPFAST_API_KEY"

const res = await fetch('https://api.shopfa.st/v1/store/security', {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.SHOPFAST_API_KEY}`,
  },
});
if (!res.ok) throw new Error((await res.json()).detail);
const data = await res.json();

import os, requests

res = requests.request(
    "GET",
    "https://api.shopfa.st/v1/store/security",
    headers={"Authorization": f"Bearer {os.environ['SHOPFAST_API_KEY']}"},
)
res.raise_for_status()
data = res.json()

req, _ := http.NewRequest("GET", "https://api.shopfa.st/v1/store/security", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("SHOPFAST_API_KEY"))
res, err := http.DefaultClient.Do(req)

Try it with your key

API base URLAPI key or token

Use a test key on a development store. The key stays in this tab (sessionStorage) and is sent only to the base URL above.

VPN policy, IP velocity limit, risk thresholds and email rules

PUT/v1/store/security/settings

Or name the store: PUT /v1/stores/{storeId}/security/settings

security:writerole: fraud:writeupdateFraudSettings

Body

vpnPolicy"allow" | "review" | "block"required
maxOrdersPerIpPerHourinteger | nullrequired
reviewScoreintegerrequired
blockScoreintegerrequired
blockDisposableEmailbooleanrequired
flagCountryMismatchbooleanrequired
usePlatformBlocklistboolean
platformListAction"block" | "review"
torPolicy"allow" | "review" | "block"
datacenterPolicy"allow" | "review" | "block"
checkEmailMxboolean
maxCheckoutsPerEmailPerDayinteger | null
maxCheckoutsPerDevicePerDayinteger | null
reviewNewAccountsDaysinteger | null

Response SecurityOverview

settingsFraudSettingsrequired
blocklistBlocklistEntry[]required
recentChecksFraudCheck[]required
statsobjectrequired
- checks30dintegerrequired
- reviewed30dintegerrequired
- blocked30dintegerrequired

Example

curl -X PUT "https://api.shopfa.st/v1/store/security/settings" \
  -H "Authorization: Bearer $SHOPFAST_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "vpnPolicy": "allow",
  "maxOrdersPerIpPerHour": 1,
  "reviewScore": 1,
  "blockScore": 1,
  "blockDisposableEmail": false,
  "flagCountryMismatch": false,
  "usePlatformBlocklist": false,
  "platformListAction": "block",
  "torPolicy": "block",
  "datacenterPolicy": "review",
  "checkEmailMx": true,
  "maxCheckoutsPerEmailPerDay": null,
  "maxCheckoutsPerDevicePerDay": null,
  "reviewNewAccountsDays": null
}'

const res = await fetch('https://api.shopfa.st/v1/store/security/settings', {
  method: 'PUT',
  headers: {
    Authorization: `Bearer ${process.env.SHOPFAST_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "vpnPolicy": "allow",
    "maxOrdersPerIpPerHour": 1,
    "reviewScore": 1,
    "blockScore": 1,
    "blockDisposableEmail": false,
    "flagCountryMismatch": false,
    "usePlatformBlocklist": false,
    "platformListAction": "block",
    "torPolicy": "block",
    "datacenterPolicy": "review",
    "checkEmailMx": true,
    "maxCheckoutsPerEmailPerDay": null,
    "maxCheckoutsPerDevicePerDay": null,
    "reviewNewAccountsDays": null
  }),
});
if (!res.ok) throw new Error((await res.json()).detail);
const data = await res.json();

import os, requests

res = requests.request(
    "PUT",
    "https://api.shopfa.st/v1/store/security/settings",
    headers={"Authorization": f"Bearer {os.environ['SHOPFAST_API_KEY']}"},
    json={
      "vpnPolicy": "allow",
      "maxOrdersPerIpPerHour": 1,
      "reviewScore": 1,
      "blockScore": 1,
      "blockDisposableEmail": False,
      "flagCountryMismatch": False,
      "usePlatformBlocklist": False,
      "platformListAction": "block",
      "torPolicy": "block",
      "datacenterPolicy": "review",
      "checkEmailMx": True,
      "maxCheckoutsPerEmailPerDay": None,
      "maxCheckoutsPerDevicePerDay": None,
      "reviewNewAccountsDays": None
    },
)
res.raise_for_status()
data = res.json()

req, _ := http.NewRequest("PUT", "https://api.shopfa.st/v1/store/security/settings", strings.NewReader(`{
  "vpnPolicy": "allow",
  "maxOrdersPerIpPerHour": 1,
  "reviewScore": 1,
  "blockScore": 1,
  "blockDisposableEmail": false,
  "flagCountryMismatch": false,
  "usePlatformBlocklist": false,
  "platformListAction": "block",
  "torPolicy": "block",
  "datacenterPolicy": "review",
  "checkEmailMx": true,
  "maxCheckoutsPerEmailPerDay": null,
  "maxCheckoutsPerDevicePerDay": null,
  "reviewNewAccountsDays": null
}`))
req.Header.Set("Authorization", "Bearer "+os.Getenv("SHOPFAST_API_KEY"))
req.Header.Set("Content-Type", "application/json")
res, err := http.DefaultClient.Do(req)

Try it with your key

API base URLAPI key or token

Body

Use a test key on a development store. The key stays in this tab (sessionStorage) and is sent only to the base URL above.

Block emails, email domains, IPs, IP ranges or countries (values are normalized; duplicates skipped)

POST/v1/store/security/blocklist

Or name the store: POST /v1/stores/{storeId}/security/blocklist

security:writerole: fraud:writeaddBlocklistEntries

Body

kind"email" | "email_domain" | "ip" | "ip_range" | "country" | "asn" | "device" | "discord_id" | "card_fingerprint"required
valuesstring[]required
reasonstringrequired

Response AddBlocklistEntriesResponse

addedBlocklistEntry[]required
skippedobject[]required
- valuestringrequired
- reasonstringrequired

Example

curl -X POST "https://api.shopfa.st/v1/store/security/blocklist" \
  -H "Authorization: Bearer $SHOPFAST_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "kind": "email",
  "values": [
    "string"
  ],
  "reason": "string"
}'

const res = await fetch('https://api.shopfa.st/v1/store/security/blocklist', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.SHOPFAST_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "kind": "email",
    "values": [
      "string"
    ],
    "reason": "string"
  }),
});
if (!res.ok) throw new Error((await res.json()).detail);
const data = await res.json();

import os, requests

res = requests.request(
    "POST",
    "https://api.shopfa.st/v1/store/security/blocklist",
    headers={"Authorization": f"Bearer {os.environ['SHOPFAST_API_KEY']}"},
    json={
      "kind": "email",
      "values": [
        "string"
      ],
      "reason": "string"
    },
)
res.raise_for_status()
data = res.json()

req, _ := http.NewRequest("POST", "https://api.shopfa.st/v1/store/security/blocklist", strings.NewReader(`{
  "kind": "email",
  "values": [
    "string"
  ],
  "reason": "string"
}`))
req.Header.Set("Authorization", "Bearer "+os.Getenv("SHOPFAST_API_KEY"))
req.Header.Set("Content-Type", "application/json")
res, err := http.DefaultClient.Do(req)

Try it with your key

API base URLAPI key or token

Body

Use a test key on a development store. The key stays in this tab (sessionStorage) and is sent only to the base URL above.

Unblock one entry

DELETE/v1/store/security/blocklist/{entryId}

Or name the store: DELETE /v1/stores/{storeId}/security/blocklist/{entryId}

security:writerole: fraud:writeremoveBlocklistEntry

Parameters

entryIdblk_…pathrequired

Response Ok

okbooleanrequired

Example

curl -X DELETE "https://api.shopfa.st/v1/store/security/blocklist/blk_0123456789abcdefghjk" \
  -H "Authorization: Bearer $SHOPFAST_API_KEY"

const res = await fetch('https://api.shopfa.st/v1/store/security/blocklist/blk_0123456789abcdefghjk', {
  method: 'DELETE',
  headers: {
    Authorization: `Bearer ${process.env.SHOPFAST_API_KEY}`,
  },
});
if (!res.ok) throw new Error((await res.json()).detail);
const data = await res.json();

import os, requests

res = requests.request(
    "DELETE",
    "https://api.shopfa.st/v1/store/security/blocklist/blk_0123456789abcdefghjk",
    headers={"Authorization": f"Bearer {os.environ['SHOPFAST_API_KEY']}"},
)
res.raise_for_status()
data = res.json()

req, _ := http.NewRequest("DELETE", "https://api.shopfa.st/v1/store/security/blocklist/blk_0123456789abcdefghjk", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("SHOPFAST_API_KEY"))
res, err := http.DefaultClient.Do(req)

Try it with your key

API base URLAPI key or token

entryId

Use a test key on a development store. The key stays in this tab (sessionStorage) and is sent only to the base URL above.

Run the fraud rules on a pretend checkout (logged as a test, never counted toward limits)

POST/v1/store/security/test

Or name the store: POST /v1/stores/{storeId}/security/test

security:writerole: fraud:readtestFraudCheck

Body

emailstringrequired
ipstringrequired
countrystringrequired
ipCountrystring | nullrequired

Response FraudCheck

idFraudCheckIdrequired
emailstringrequired
ipstringrequired
countryCountryCoderequired
ipCountrystringrequired
scoreintegerrequired
actionFraudActionrequired
reasonsFraudReason[]required
isTestbooleanrequired
createdAtTimestamprequired

Example

curl -X POST "https://api.shopfa.st/v1/store/security/test" \
  -H "Authorization: Bearer $SHOPFAST_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "email": "[email protected]",
  "ip": "string",
  "country": "string",
  "ipCountry": "string"
}'

const res = await fetch('https://api.shopfa.st/v1/store/security/test', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.SHOPFAST_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "email": "[email protected]",
    "ip": "string",
    "country": "string",
    "ipCountry": "string"
  }),
});
if (!res.ok) throw new Error((await res.json()).detail);
const data = await res.json();

import os, requests

res = requests.request(
    "POST",
    "https://api.shopfa.st/v1/store/security/test",
    headers={"Authorization": f"Bearer {os.environ['SHOPFAST_API_KEY']}"},
    json={
      "email": "[email protected]",
      "ip": "string",
      "country": "string",
      "ipCountry": "string"
    },
)
res.raise_for_status()
data = res.json()

req, _ := http.NewRequest("POST", "https://api.shopfa.st/v1/store/security/test", strings.NewReader(`{
  "email": "[email protected]",
  "ip": "string",
  "country": "string",
  "ipCountry": "string"
}`))
req.Header.Set("Authorization", "Bearer "+os.Getenv("SHOPFAST_API_KEY"))
req.Header.Set("Content-Type", "application/json")
res, err := http.DefaultClient.Do(req)

Try it with your key

API base URLAPI key or token

Body

Use a test key on a development store. The key stays in this tab (sessionStorage) and is sent only to the base URL above.