Account protection

Account protection adds the account to an assessment so that the service can label risky behavior across a site’s accounts: a stolen password in use, a burst of fake signups, many accounts from one source. It is part of the Pro plan and above, and off until the site’s flag is set (a closed flag is 403 feature-disabled).

When to use it

Use it at login, signup and sensitive account changes, where you can name the account. It pairs well with email MFA: labels tell you when to ask for a code.

How it works

You pass userInfo with each assessment. The service keeps a small per-site profile of the account, using a per-site hash of the id, and returns accountDefenderAssessment.labels. You then annotate the assessment with what really happened, and you erase the profile on request.

Step by step

const a = await rg.createAssessment({
  token,
  userInfo: { accountId: user.id, createAccountTime: user.createdAt },
});
a.accountDefenderAssessment?.labels; // an open enum: tolerate unknown labels
await rg.annotate(a.name, { annotation: 'LEGITIMATE', accountId: user.id });
await rg.eraseAccount({ accountId: user.id });

Labels you may see: PROFILE_MATCH, SUSPICIOUS_LOGIN_ACTIVITY, SUSPICIOUS_ACCOUNT_CREATION, RELATED_ACCOUNTS_NUMBER_HIGH, CREDENTIAL_STUFFING_SUSPECTED. The list may grow. A label never comes with the rule, count or threshold behind it.

Erase over HTTP:

curl https://api.revokegpt.com/v1/accounts:erase \
  -H 'Authorization: Bearer rgsk_...' -H 'Content-Type: application/json' \
  -d '{"accountId":"user-123"}'

Rules for account ids

• userInfo takes accountId (1 to 256 UTF-8 bytes) or hashedAccountId (base64 of 32 bytes), never both.
• The service hashes the id per site. Send the same form everywhere (assess, annotate, erase): the two forms are different accounts.
• Without account protection on for the site, userInfo is accepted and ignored.

Erasure

eraseAccount (POST /v1/accounts:erase) deletes the stored profile and related-account entries. It needs only your secret key, needs no feature flag, and no kill switch stops it, so a deletion request is always served. It answers 200 whether or not anything was stored.

Errors

Status and code	Meaning	What to do
400 bad-request	Both id forms, or neither (erase), or a bad id.	Send exactly one.
401 unauthorized	Bad secret.	Check the key.
403 feature-disabled	Account protection is off (assessments).	Enable it.
429 rate-limited	Too fast.	Wait, then retry.
503 service-unavailable	Assessments off or unavailable.	Treat the labels as unknown, not as clean.

Security notes

• Labels are signals. Combine them with your own rules and offer a way back to the person, such as an email code.
• Put an erase call in your account-deletion flow, so privacy requests cover RevokeGPT too.