> Toden documentation. For the full index fetch /llms.txt. Every page is available as Markdown by appending .md to its URL. Identity verification uses /api/kyc, Risk Intelligence uses /api/v1; they are separate contracts with different error shapes. Never invent an endpoint, field or enum value: read the API reference page for the operation first.

# Activity decisions

> Receive decisions for logins, account changes and other customer activity.

Fraud rules can assess transactions and non-transaction activity through the same outcome contract.

## Events

| Event                            | Use it for                                                     |
| -------------------------------- | -------------------------------------------------------------- |
| `fraud.activity.assessed`        | Apply the first decision for a non-transaction activity.       |
| `fraud.decision.changed`         | Replace the previous decision with the new effective decision. |
| `entity.step_up_requested`       | Send or display the hosted reauthentication challenge.         |
| `entity.step_up_completed`       | Continue only when `passed` is true.                           |
| `entity.biometric_enrolled`      | Record that biometric reauthentication is available.           |
| `entity.biometric_authenticated` | Apply the resolved biometric result.                           |

## Assessment example

```json
{
  "id": "evt_activity_01",
  "event": "fraud.activity.assessed",
  "createdAt": "2026-08-15T14:20:09.000Z",
  "data": {
    "externalActivityId": "login_928401",
    "activityId": "act_01",
    "decisionId": "dec_01",
    "decision": "review",
    "summary": {
      "outcome": "review",
      "title": "Review required",
      "reason": "A new device and unusual location were detected.",
      "score": 78,
      "riskLevel": "high",
      "matchedRules": 2,
      "nextAction": {
        "type": "review_activity",
        "label": "Review activity"
      }
    }
  }
}
```

Use the summary for the immediate answer. Detailed rule and screening evidence remains available in the activity response for audit and investigation.

## Step-up example

```json
{
  "event": "entity.step_up_requested",
  "data": {
    "stepUpId": "stu_01",
    "externalUserId": "customer_1",
    "url": "https://api.toden.co/reauth/stu_01",
    "expiresAt": "2026-08-15T14:35:09.000Z",
    "environment": "SANDBOX"
  }
}
```

Treat the hosted challenge URL as sensitive. Deduplicate every webhook by its envelope `id` and use the related read API whenever current state matters.