--- title: Context signals description: REST API reference for the fraud risk assessment (self-fraud or social engineering) of a completed credit transaction in Card Not Present Verification. canonical: https://developer.unico.io/dual-api/developers/regional-solutions/card-not-present-verification/integration/apis/api-reference/context-signals locale: en generated_by: markdown-export --- - [/](/) - Regional Solutions - [Card Not Present Verification](/dual-api/developers/regional-solutions/card-not-present-verification) - [Integration](/dual-api/developers/regional-solutions/card-not-present-verification/integration/overview) - [APIs](/dual-api/developers/regional-solutions/card-not-present-verification/integration/apis) - [API Reference](/dual-api/developers/regional-solutions/card-not-present-verification/integration/apis/api-reference) - Context signals **On this page# Context signals ### Before you begin​ Context signals evaluate completed credit transactions and return a risk assessment — self-fraud or social engineering — to enrich your own anti-fraud decision. They are complementary to Card Not Present Verification: they do not change the contract or the behavior of the transaction endpoints you already use. You keep receiving the terminal state of the transaction (`approved`, `inconclusive`, and so on) as usual, and then query the context signals. Your API requests are authenticated using an access token. Any request that does not include a valid access token will return an error. Learn more in [Authentication](/developers/regional-solutions/card-not-present-verification/integration/authentication). Permission-controlled accessAccess to this endpoint is controlled by a permission (role) assigned to your company. Without it, the endpoint returns `403`. Request enablement from the Unico team. Base URL **UAT**: `https://transactions.transactional.uat.unico.app/api/public/v1` **Production**: `https://transactions.transactional.unico.app/api/public/v1` ### Get context signals​ `GET /transactions/{transaction_id}/signals` — returns the risk assessment of a completed transaction. The result is pre-computed asynchronously as soon as the transaction reaches its terminal state, so this endpoint is only a lookup of a result that is already available. Path parameters ParameterTypeRequiredDescription`transaction_id`stringyesTransaction ID (UUID v4). For example, `6ab1771e-dfab-4e47-8316-2452268e5481`. Headers HeaderValue`Authorization``Bearer {token}` — a valid access token.`Accept``application/json` Request example ``` GET /api/public/v1/transactions/6ab1771e-dfab-4e47-8316-2452268e5481/signals HTTP/1.1Host: transactions.transactional.uat.unico.appAuthorization: Bearer {token}Accept: application/json ``` 200 OK ``` { "signals": { "auto_fraud_risk": "high", "more_info": { "limited_data": false, "holder_identified": true } }} ``` FieldTypePresenceDescription`signals.auto_fraud_risk`string (enum)optionalSelf-fraud risk level. Present only when detected.`signals.social_eng_risk`string (enum)optionalSocial engineering risk level. Present only when detected.`signals.more_info.limited_data`booleanalways`true` when there is not enough data for a robust assessment.`signals.more_info.holder_identified`booleanalways`false` when the cardholder could not be identified. Possible risk values: `very_low`, `low`, `medium`, `high`, `very_high`. info`auto_fraud_risk` and `social_eng_risk` are mutually exclusive — they never appear together in the same response. When `limited_data` is `true`, both risk fields are expected to be absent, since there is not enough data for an assessment. Response examples Social engineering risk detected: ``` { "signals": { "social_eng_risk": "very_high", "more_info": { "limited_data": false, "holder_identified": true } }} ``` No risk identified — a regular transaction: ``` { "signals": { "more_info": { "limited_data": false, "holder_identified": true } }} ``` Not enough data: ``` { "signals": { "more_info": { "limited_data": true, "holder_identified": true } }} ``` Cardholder not identified: ``` { "signals": { "more_info": { "limited_data": false, "holder_identified": false } }} ``` Other response codes Errors are returned in the standard error format described in [Errors](/dual-api/developers/regional-solutions/card-not-present-verification/integration/apis/errors). HTTP CodeCodeSituationWhat to do202—The result has not been computed yet — asynchronous processing is still in progress.Repeat the call (polling) until you get a `200`.40040004`transaction_id` is invalid (not a UUID v4) or a parameter is malformed.Fix the ID format before sending the request again.40340305The company does not have the permission (role) enabled for this endpoint.Request enablement from the Unico team.40440401The transaction was not found.Check the transaction ID.40440484The transaction was not found for assessment.Treat it as "there will be no result" and stop querying.40940983The transaction has not reached its terminal state yet.Wait for the terminal state before querying again.500—Internal service error.Retry with backoff. If it persists, contact Unico support. ### Rules and best practices​ Query the endpoint only after the transaction reaches its terminal state. Querying earlier returns `409`. Only credit transactions are assessed. Transactions captured in silent mode are not. On a `202`, repeat the call until you get a `200`. Send the first request 1 second after the transaction response, then back off: 2s, 4s, 8s, 16s — up to 5 attempts. The service level objective is 10 seconds after the transaction response. Treat a `404` as "there will be no result" and stop querying. `auto_fraud_risk` and `social_eng_risk` are mutually exclusive. Last updated on Oct 8, 2026**