SDK integration for account update

DataDome Account Protect detects account takeover threats and protects you against them

Account Protect can be integrated into your backend through SDK packages available on multiple platforms.

📘

Prerequisites for Account Protect

Account Protect is separate from Bot Protect and is not available on your account by default.
Please contact your account manager to enable it.

This service requires a dedicated API key, which will be available on your dashboard once it is enabled.

Main concepts

DataDome Account Protect monitors all profile update attempts and evaluates their legitimacy in real time. By analyzing behavioral and contextual signals, DataDome can recommend whether to allow or block the update—helping prevent unauthorized changes to sensitive account information.

Overview of the implementation flow for an account update.

Overview of the implementation flow for an account update.

Installation

The Account Protect SDK is distributed on multiple platforms:

You can use one of the commands below to install the relevant package for your application:

npm i @datadome/fraud-sdk-node
dotnet add package DataDome.AspNetCore.Fraud.SDK
<!-- insert in the pom.xml file of the project -->
<dependency>
  <groupId>co.datadome.fraud</groupId>
  <artifactId>fraud-sdk-java</artifactId>
  <!-- <version>1.0.1</version> --> <!-- compatible with Spring Boot 2.x -->
  <version>2.2.2</version>          <!-- compatible with Spring Boot 3.x -->
</dependency>
libraryDependencies += "co.datadome.fraud" % "fraud-sdk-java" % "2.2.1"
pip install datadome-fraud-sdk-python
composer require datadome/fraud-sdk-symfony
# 1. add `datadome/fraud-sdk-laravel` to your project
composer require datadome/fraud-sdk-laravel
# 2. Generate an autoloader
composer dump-autoload
# 3. Edit `config/app.php` to add `DataDomeServiceProvider`
# config/app.php
use DataDome\FraudSdkLaravel\Providers\DataDomeServiceProvider;
[...]
 'providers' => ServiceProvider::defaultProviders()->merge([
 [...]
 DataDomeServiceProvider::class
 
# 4. publish `datadome.php` in the `config` folder
php artisan vendor:publish
gem install datadome_fraud_sdk_ruby
go get github.com/datadome/fraud-sdk-go-package

Usage

Using the Account Protect SDK requires changes in your application to send signals regarding account updates and handle the recommendations provided by DataDome's Account Protect API.

Example for an Account Update event

package main

import (
  "log"
  "net/http"
  "time"

  dd "github.com/datadome/fraud-sdk-go"
)

func accountHandler(client *dd.Client) http.HandlerFunc {
  return func(w http.ResponseWriter, r *http.Request) {
    if r.Method == http.MethodPut {
      // Address field
      name := "Élysée Palace"
      line1 := "55 Rue du Faubourg Saint-Honoré"
      line2 := "2nd floor"
      city := "Paris"
      countryCode := "FR"
      regionCode := "75"
      zipCode := "75008"
      userAddress := dd.Address{
        City:        &city,
        CountryCode: &countryCode,
        Line1:       &line1,
        Line2:       &line2,
        Name:        &name,
        RegionCode:  &regionCode,
        ZipCode:     &zipCode,
      }

      // Authentication field
      authenticationMode := dd.Password
      authenticationSocialProvider := dd.Google
      authenticationType := dd.Social
      authentication := dd.Authentication{
        Mode:           &authenticationMode,
        SocialProvider: &authenticationSocialProvider,
        Type:           &authenticationType,
      }

      // User field
      createdAt := time.Now().Format(time.RFC3339)
      firstName := "Data"
      lastName := "Dome"
      title := "mr"
      phone := "+33978787878"
      email := "[email protected]"
      paymentMeanUpdated := true
      displayName := "DataDome 🤖"
      description := "Some Description / Некоторое описание"
      user := dd.User{
        ID:                 "fake_user_id",
        Address:            &userAddress,
        CreatedAt:          &createdAt,
        Email:              &email,
        FirstName:          &firstName,
        LastName:           &lastName,
        Phone:              &phone,
        Title:              &title,
        PaymentMeanUpdated: &paymentMeanUpdated,
        Authentication:     &authentication,
        DisplayName:        &displayName,
        Description:        &description,
        ExternalURLs: &[]string{
          "https://example.org/external1",
          "https://example.org/external2",
          "https://example.org/external3",
        },
        PictureURLs: &[]string{
          "https://example.org/image1.png",
          "https://example.org/image2.png",
          "https://example.org/image3.png",
        },
      }

      // Session field
      sessionId := "fake_session_id"
      session := dd.Session{
        ID:        &sessionId,
        CreatedAt: &createdAt,
      }

      validate, err := client.Validate(r, dd.NewAccountUpdateEvent(
        email,
        dd.AccountUpdateWithUser(user),
        dd.AccountUpdateWithSession(session),
      ))
      if err != nil {
        log.Printf("error during validation: %v\n", err)
      }
      if validate.Action == dd.Allow {
        w.WriteHeader(http.StatusOK)
        return
      } else {
        // Business Logic here
        // MFA
        // Challenge
        // Notification email
        // temporarly lock account
        http.Error(w, "failed", http.StatusForbidden)
        return
      }
    } else {
      http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
    }
  }
}

func main() {
  client, _ := dd.NewClient("FRAUD_API_KEY")

  mux := http.NewServeMux()
  mux.HandleFunc("/account", accountHandler(client))

  _ = http.ListenAndServe(":8080", mux)
}

API Reference

AccountUpdateEvent

The SDK exposes methods to validate account updates that require a AccountUpdateEvent instance to be sent to the Account Protect API along with the client request itself.

Properties available for this event type are listed below:

NameDescriptionDefault valuePossible valuesOptional
accountThe unique account identifier used for the login attemptAny string value.No
session.createdAtCreation date of the sessionFormat ISO 8601 YYYY-MM-DDThh:mm:ssTZDYes
session.idA unique session identifier from your systemAny string value.Yes
user.address.cityCity of the addressAny string value.Yes
user.address.countryCodeCountry of the addressFormat ISO-3166-1-alpha-2Yes
user.address.line1Line 1 of the addressAny string value.Yes
user.address.line2Line 2 of the addressAny string value.Yes
user.address.nameName of the addressAny string value.Yes
user.address.regionCodeRegion codeYes
user.address.zipCodeZip codeYes
user.authentication.authenticationModeAuthentication modebiometric, mail mfa, otp, password, otherYes
user.authentication.authenticationSocialProviderAuthentication social provideramazon, apple, facebook, github, google, linkedin, microsoft, twitter, yahoo, otherYes
user.authentication.authenticationTypeAuthentication typelocal, socialProvider, otherYes
user.createdAtCreation date of the userFormat ISO 8601 YYYY-MM-DDThh:mm:ssTZDYes
user.descriptionDescription or biography of the userAny string value.Yes
user.displayNameDisplay name of the userAny string value.Yes
user.emailEmail of the userValid email addressYes
user.externalUrlsExternal URLs of the userAn array of valid URL address (max 10 items)Yes
user.firstNameFirst name of the userAny string value.Yes
user.idA unique customer identifier from your system. It has to be the same for all other event sentAny string value.No
user.lastNameLast name of the userAny string value.Yes
user.paymentMeanUpdatedPayment mean updatedA boolean valueYes
user.phonePhone of the userE.164 format including + and a region code
Example : example +33978787878
Yes
user.pictureUrlsPictures of the userAn array of valid URL address (max 10 items)Yes
user.titleTitle of the usermr, mrs, mxYes

Validation response

Validating an account update event should result in a response that can include the following properties:

NameDescriptionPossible ValuesAlways Defined
actionThe recommended action to perform on the login attempt.allow, denyYes
errorsA list of objects representing each error with details.
Each object will have the properties listed below.
errors[i].errorA short description of the error.
errors[i].fieldThe name of the value that triggered the error.
eventIdEvent identifier associated to this validate event.A valid UUID.Yes
messageA description of the error if the status is failure or timeout.Invalid header / Request timed out...
reasonsA list of reasons to support the recommended action.List of reasons (Any string value.)
statusThe status of the request to the Account Protect API.ok, failure, timeoutYes
scoreThe level of confidence when identifying a request as coming from a fraudster.
Only available in Ruby SDK 2.1.0+ and Go SDK v1.1.0+
Integer

Options

Options can be applied to the SDK during its instantiation.

Option NameDescriptionDefault Value
endpointThe endpoint to call for the Account Protect API.https://account-api.datadome.co
timeoutA timeout threshold in milliseconds.
When an API request times out, the SDK will allow it by default.
1500

You can find usage examples for each platform below:

client, err := dd.NewClient(
  "FRAUD_API_KEY",
  dd.ClientWithEndpoint("account-api.datadome.co"),
  dd.ClientWithTimeout(1500),
)

FAQ

What happens if there is a timeout on API request?

The SDK has been designed to have minimal impact on the user experience. If the configured timeout is reached, the SDK will cancel its pending operation and allow the application to proceed.

What happens if the API returns an error?

Errors and timeouts are handled the same way by the SDK: it will not interrupt the application and allow it to proceed.

What happens if my API key is incorrect?

Invalid keys are detected when calling the account protect API. The SDK will return an allow response to avoid blocking any login or registration attempt on the application. This response will also have a failure status and a message that describes the problem.