目录

Obtaining the Risk Level

To ensure secure network access, use the TLS 1.2 protocol and supported cipher suites. If your app server accesses Account Kit using TLS 1.0, TLS 1.1, or unsupported cipher suites, the connection may fail.

For details about TLS 1.2 and supported cipher suites, please refer to TLS Protocol and Cipher Suites.

Functions

This API is called by your app server from the Account Kit server to obtain the risk level of a HUAWEI ID user.

Use Cases

After your app obtains an access token through an authorization code, it can use the access token to obtain the user's risk level.

Constraints

If your app does not request the riskLevel scope or does not include this scope when requesting the authorization code, an error will be returned, and errCode=403 will be contained in the response body.

Prototype

Request Parameters

[h2]Request Header

Parameter Mandatory Type Description
Content-Type Yes String

Content type. The value is application/json;charset=utf-8.

NOTE

The request body parameters must follow the format defined in the request header. Otherwise, the request may fail. For details on how to pass these parameters, please refer to Sample Code.

[h2]Request Query Parameter

Parameter Mandatory Type Description
clientID Yes String Unique ID allocated by AppGallery Connect to a newly-created app. For details about the value, please refer to the Client ID field under OAuth 2.0 client ID in Viewing App Basic Information.
transactionID Yes String

Transaction ID. This parameter is mandatory for every message.

Format: YYYYMMDDhhmmssxxxxxxxxxx, where YYYYMMDDhhmmss indicates the request generation time (14 digits), and xxxxxxxxxx is a random number of 10 to 20 digits.

Example: 202502121546232352164151

[h2]Request Body

Parameter Mandatory Type Description
accessToken Yes String Access token obtained by calling the API for obtaining a user-level credential. Ensure that the app includes the riskLevel scope when requesting the authorization code, so that the authorization code carries this scope when it is used to obtain the access token.
scene Yes String

Service scenario of obtaining a user's risk level.

- registration: registration.

- marketing: marketing campaign.

Request Example

Send a POST request. Example:

POST /user/getuserrisklevel?clientID=<clientID>&transactionID=<transactionID> HTTP/1.1
Host: account.cloud.huawei.com
Content-Type: application/json;charset=utf-8

{"accessToken":"<Access Token>", "scene":"<scene>"}

Response Parameters

[h2]Response Header

Parameter Mandatory Type Description
Content-Type Yes String Content type. The value is application/json;charset=utf-8.

[h2]Response Body

Parameter Mandatory Type Description
errCode Yes Int Error code. If the API is successfully called, 0 will be returned. Otherwise, an error code will be returned.
errMsg Yes String Error message. If the API is successfully called, an empty string will be returned. Otherwise, an error message will be returned.
riskLevel No Int

Risk level, which is returned only upon request success. (See Appendix 1 below for details.)

0: no obvious risks detected

1: low risk

2: medium risk

3: high risk

4: undetermined
riskTag No String[] Risk tag, which is returned only upon request success. (See Appendix 2 below for details.)

Appendix 1: Risk levels and handling suggestions

Level Description Handling Suggestion
0 No obvious risks detected. For example, a user legally registers an account and uses a Huawei phone properly, without engaging in abnormal activities such as performing batch operations, using automation tools, and farming accounts. Lift restrictions upon confirmation of no risks.
1 Low risk. Risk factors are identified, and the overall assessment indicates a low level of risk. Implement simple verification through methods such as verification code and SMS or manual review.
2 Medium risk. Risk factors are identified, and the overall assessment indicates a medium level of risk. Implement measures to avoid damage based on the service scenario. For example, reduce the likelihood of granting high-level rewards in marketing campaigns, downweight votes in ranking campaigns, and require secondary verification for registration and sign-in.
3 High risk. Risk factors are identified, and the overall assessment indicates a high level of risk. Intercept the behavior. For example, award no prize or only the minimum red envelope in red envelope campaigns, exclude votes in ranking campaigns, require secondary verification for registration and sign-in, or restrict the current high-risk operation.
4 Undetermined. The risk level is undetermined. Make the final decision by taking into account the account's historical behavior and the service context.

Appendix 2: Risk tags and their descriptions

riskTag Name Description
spamMailbox Binding to a spam email address Suspected of binding to a spam email address.
riskPhoneNumber Binding to a mobile number purchased from a SIM card vendor Suspected of binding to a mobile number purchased from a SIM card vendor.
riskDevice Using a device with risks Suspected of using abnormal devices such as an automation tool or bulk control device for registration or sign-in.
ipCluster IP clustering Suspected of IP clustering within half a year.
deviceCluster Device clustering Suspected of device clustering within half a year.
batchBehavior Batch operations Suspected of batch synchronization operations with a large number of junk accounts within half a year.
illegalLogin Unauthorized sign-in Suspected of unauthorized sign-in using the current HUAWEI ID.
activityFraud Fraud Suspected of engaging in fraudulent activities in marketing campaigns within half a year.

Response Example

[h2]Request Success

HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8

{
    "errCode": 0,
    "errMsg": "",
    "riskLevel": 2,
    "riskTag": [
        "spamMailbox"
    ]
}

[h2]Request Failure

HTTP/1.1 200 OK
Content-Type: application/json;charset=utf-8

{
    "errCode": 403,
    "errMsg": "access forbidden;no basePermission"
}

Sample Code

The Java sample code is as follows. Before running it, set up the environment for the sample code. (Place this sample code and the CallUtils utility class in the same directory. If not, manually add the corresponding import statement to the sample code.)

import com.alibaba.fastjson2.JSONArray;
import com.alibaba.fastjson2.JSONObject;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpPost;
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;
import java.util.Objects;

/**
 * Obtain a user's risk level.
 */
public class GetUserRiskLevelDemo {
    public static void main(String[] args) throws IOException {
        // URL of the API for obtaining a user's risk level.
        String url = "https://account.cloud.huawei.com/user/getuserrisklevel";
        // Replace it with the client ID of your app.
        String clientID = "<Client ID>";
        // Replace it with the actual transaction ID.
        String transactionID = "<transactionID>";
        // Replace it with the obtained user-level access token.
        String accessToken = "<Access Token>";
        // Replace it with the actual scene.
        String scene = "<scene>";
        JSONObject result = getUserRiskLevel(url, clientID, transactionID, accessToken, scene);
        // Parse the result to obtain errCode.
        Integer errCode = result.getInteger("errCode");
        // Parse the result to obtain errMsg.
        String errMsg = result.getString("errMsg");
        // Parse the result to obtain riskLevel.
        Integer riskLevel = result.getInteger("riskLevel");
        // Parse the result to obtain riskTag.
        JSONArray riskTag = result.getJSONArray("riskTag");
    }

    private static JSONObject getUserRiskLevel(String url, String clientID, String transactionID,
        String accessToken, String scene) throws IOException {
        HttpPost httpPost = new HttpPost(url + "?" + "clientID=" + clientID + "&transactionID=" + transactionID);
        Map<String, String> reqBody = new HashMap<>();
        reqBody.put("accessToken", accessToken);
        reqBody.put("scene", scene);
        httpPost.setHeader("Content-Type", "application/json;charset=utf-8");
        httpPost.setEntity(CallUtils.wrapJsonEntity(reqBody));
        return CallUtils.toJsonObject(CallUtils.remoteCall(httpPost, (CloseableHttpResponse response, String rawBody) -> {
            int statusCode = response.getStatusLine().getStatusCode();
            // If the returned HTTP status code is not 200, the request fails.
            if (statusCode != 200) {
                return new IOException("call failed! http status code: " + statusCode + ", response data: " + rawBody);
            }
            // If the returned HTTP status code is 200, parse the response body and check the service error code.
            JSONObject errorResponseBody = CallUtils.toJsonObject(rawBody);
            // Error code.
            Integer errCode = errorResponseBody.getInteger("errCode");
            // The value 0 of errCode indicates a success, and a value other than 0 indicates a failure.
            if (Objects.nonNull(errCode) && errCode != 0) {
                return new IOException("call failed! http status code: " + statusCode + ", response data: " + rawBody);
            }
            return null;
        }));
    }
}

HTTP Response Codes

HTTP Response Code Description Solution
200 The API call is successful. (A successful API call does not mean successful service processing. The actual service processing result is indicated by errCode in the response body.) -
400 Parameter error. Ensure that the request parameters comply with the specifications.
403 No access permission. Check the network environment configuration to see if the access is blocked by the caller's network security policy. If the error persists, submit a ticket online.
404 Service not found. Ensure that the request URI is correct.
405 Unsupported HTTP request method. Ensure that the method for the HTTP request complies with the API specifications.
415 Unsupported media type. Ensure that the content type (contentType) for the HTTP request complies with the API specifications.
500 Internal service error. Submit a ticket online.
502 Connection error. This typically occurs when network connectivity is unstable. Try again later. If the error persists, submit a ticket online.
504 Connection timed out. This typically occurs when network connectivity is unstable. Try again later. If the error persists, submit a ticket online.
590 Internal service error. Submit a ticket online.
errCode Description Solution
6

The session is invalid or has timed out (session timeout).

Possible causes:

- The access token is invalid or has expired.

- The access token format is incorrect.

- Other internal causes.

- Check whether the passed parameters are correct. If yes, try to obtain a new access token.

- The request data format of this API is application/json;charset=utf-8. When constructing a request body, ensure that the URL encoding is not performed on the access_token parameter. For details on parameter assembly, please refer to Sample Code.

- Rectify the error based on the returned error description. If the error persists, submit a ticket online.
403 No access permission. Go to AppGallery Connect to request scopes for your app. For details, please refer to Requesting Scopes.
503 System rate limiting triggered. Try again later.
70001201 Request parameter error. Modify the parameters in the request URL or request body.
70001402 System authentication error. The authentication system is abnormal. If the error persists after retry, submit a ticket online.
70020002 Internal API request timeout. Try again later.
70001401 Internal API error. Rectify the error based on the returned error description. If the error persists, submit a ticket online.