Decisions

Every successful API call separates the risk signal from the action your signup flow should take.

Field	Purpose
`risk_level`	Normalized risk severity: `low`, `medium`, `high`, or `unknown`
`recommended_action`	Policy output: `allow`, `flag`, `review`, or `block`
`reasons`	Machine-readable reason codes with human-readable messages
`policy_version`	Version of the SignupBear policy that produced the result
`request_id`	Correlation identifier for logs and support

Recommended actions

string

Continue account creation.

string

Continue only if your own fallback policy permits it. This is also the error response default when SignupBear cannot produce a decision.

string

Hold the signup for another verification step or a manual review.

string

Reject account creation. Return a generic message to the end user rather than exposing detection details.

Code	Meaning
`DISPOSABLE_EMAIL_DOMAIN`	The email domain appears in the disposable-domain dataset
`EMAIL_SUBADDRESSING`	Plus-addressing was detected and the account policy blocks it
`CUSTOM_BLOCKLIST_EMAIL`	The exact email is in the account blocklist
`CUSTOM_BLOCKLIST_DOMAIN`	The email domain is in the account blocklist
`IP_CHECK_NOT_AVAILABLE_BETA`	IP input was received but not evaluated
`TEST_HIGH_RISK`	Deterministic high-risk fixture used with a test key

Integrate against recommended_action and reason code, not the English message. Messages may improve without a policy version change.