> ## Documentation Index
> Fetch the complete documentation index at: https://docs.deepidv.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Real-time iGaming anti-fraud checks on a verification session

The iGaming checks are a set of real-time anti-fraud endpoints that run **against an existing verification session**. Each check is a `POST /v1/igaming/*` call that takes a `session_id` belonging to your org, plus a small check-specific payload. Results are persisted to the session and can be reviewed later alongside the rest of the session's data.

All four checks:

* Are session-scoped — the `session_id` must belong to a session in your org
* Accept `application/json` request bodies using **snake\_case** field names (no camelCase aliases)
* Are driven by the session's **workflow step configuration** — if the corresponding step isn't configured on the session's workflow, VPN detection, IP jurisdiction, and anti-cheat return `UNAVAILABLE`; injection detection instead scores with the default config (see [Injection detection](/api-reference/igaming/injection))
* Persist their result to the session for later retrieval

## Verdict and action model

Every check returns a `verdict` (the raw finding) and an `action` (what your integration should do about it). The `action` values are:

| Action          | Meaning                                                           |
| --------------- | ----------------------------------------------------------------- |
| `allow`         | No issue found — proceed normally                                 |
| `flag`          | Soft signal — proceed, but surface it for review                  |
| `step-up`       | Route the applicant to additional verification (see `escalation`) |
| `manual-review` | Hold for a human reviewer before deciding                         |
| `block`         | Reject the applicant — **the session is marked as failed**        |

<Note>
  These checks fail **soft**. If an internal error occurs or an input can't be
  used (a non-IPv4 address, no detectable face), the endpoint still returns
  `200` with `verdict: "UNAVAILABLE"` and `action: "allow"` — it never blocks
  the applicant or returns a 5xx for this reason. Design your integration to
  treat `UNAVAILABLE` as "no signal," not as an error. A body that fails schema
  validation (a missing `session_id` or `ip_address`) returns `400` for
  injection, VPN detection, and IP jurisdiction; anti-cheat returns `200` /
  `UNAVAILABLE` even then.
</Note>

A `404` response means the `session_id` either doesn't exist or doesn't belong to your org — the two cases are indistinguishable from the response. A request with no `x-api-key` header returns `403`; an invalid key returns `401`.

Each check persists its result onto the session, and the persisted record is often richer than the response (settings snapshot, checked IP, anti-cheat similarity and links). Read it back from `analysis_data` on [Retrieve session](/api-reference/sessions/retrieve-session#igaming-check-data). Run the checks **sequentially** — each one read-modify-writes the session's analysis data, so concurrent calls can overwrite each other's persisted result.

## Endpoints

| Endpoint                                                                     | Purpose                                                                             |
| ---------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
| [`POST /v1/igaming/injection`](/api-reference/igaming/injection)             | Detect virtual cameras, emulators, and injected media during liveness capture       |
| [`POST /v1/igaming/vpn-detection`](/api-reference/igaming/vpn-detection)     | Detect VPNs, proxies, Tor exit nodes, and datacenter IPs                            |
| [`POST /v1/igaming/ip-jurisdiction`](/api-reference/igaming/ip-jurisdiction) | Resolve the applicant's IP to a jurisdiction and check it against allow/block lists |
| [`POST /v1/igaming/anti-cheat`](/api-reference/igaming/anti-cheat)           | Face-based dedup, multi-accounting, and self-exclusion enforcement                  |