DEV Community

Cover image for Designing Identity Guardrails: Input Validation vs. Risk Scoring
eKYC Pro
eKYC Pro

Posted on

Designing Identity Guardrails: Input Validation vs. Risk Scoring

When building user onboarding flows, developers often face a critical architectural decision: where to place identity verification checks. Should you validate inputs at the point of entry, or should you rely on aggregated risk signals before granting access? Understanding the distinction between per-service signals and unified scoring is essential for building robust, operator-safe onboarding guardrails.

The Anatomy of an Identity Check

In a single-identifier workflow, you are typically verifying a phone number or email against specific platform registries.

Per-Call Service Signals

Per-call services, such as the Instagram Checker API, provide a direct, synchronous account-presence signal. When you submit an identifier via POST /v1/check, you receive a boolean response indicating whether that identifier is registered on the selected platform.

// Example of a per-call service check
{
 "service_type": "instagram",
 "identifier": "+1234567890"
}
Enter fullscreen mode Exit fullscreen mode

This approach is ideal for granular, service-specific validation. However, because it is a point-in-time check, it serves as a supporting signal rather than a definitive proof of identity.

Aggregated Risk Scoring

Alternatively, the Unified Score API provides a broader perspective by combining supported signals into a 0–1000 PTS score, accompanied by a risk label (LOW, MEDIUM, or HIGH). While per-call services tell you if an account exists on a specific platform, the Unified Score offers a synthesized metric that acts as a decision-support tool for your internal logic.

Architectural Considerations: Input vs. Output Guardrails

When implementing these checks, consider the "Guardrails" pattern:

  1. Input Filtering (Pre-Check): Use basic validation to ensure the identifier (e.g., E.164 phone format) is well-formed before hitting the API. This prevents unnecessary 400 Bad Request errors and reduces operational noise.
  2. Output Filtering (Post-Check): Once you receive a response, treat the result (e.g., data.registered) as a variable in your decision engine.

Error Handling and Resilience

Because these checks are synchronous, your application must be prepared to handle various failure modes gracefully:

  • 401 Unauthorized: Ensure your X-API-Key is managed via secure environment variables and rotated periodically.
  • 500 Server Error: Implement a fallback mechanism. If the verification service is unreachable, your system should fail closed or open based on your specific risk tolerance for that onboarding step.

Decision Checklist

When choosing between these approaches, ask yourself:

  • Do I need platform-specific presence? Use Per-call services (e.g., Instagram, WhatsApp) to confirm if an account exists.
  • Do I need a normalized risk metric? Use the Unified Score API to obtain a PTS score for broader decision support.
  • Is the check critical? If the check is a mandatory guardrail, ensure your application logic accounts for potential API downtime by having a clear policy for when a check fails to return a success: true status.

By separating your concerns—using per-call signals for specific platform verification and unified scores for aggregate risk assessment—you create a more maintainable and resilient onboarding pipeline.

This article was drafted with AI assistance and reviewed before publishing.


Explore eKYC Pro per-call APIs

Top comments (0)