> ## Documentation Index
> Fetch the complete documentation index at: https://docs.signupbear.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Decisions

> Interpret risk levels, recommended actions, reasons, and policy versions.

Every successful API call separates the risk signal from the action your signup
flow should take.

| Field                | Purpose                                                         |
| -------------------- | --------------------------------------------------------------- |
| `risk_level`         | Normalized risk severity: `low`, `medium`, `high`, or `unknown` |
| `recommended_action` | Policy output: `allow`, `flag`, `review`, or `block`            |
| `reasons`            | Machine-readable reason codes with human-readable messages      |
| `policy_version`     | Version of the SignupBear policy that produced the result       |
| `request_id`         | Correlation identifier for logs and support                     |

## Recommended actions

<ResponseField name="allow" type="string">
  Continue account creation.
</ResponseField>

<ResponseField name="flag" type="string">
  Continue only if your own fallback policy permits it. This is also the error
  response default when SignupBear cannot produce a decision.
</ResponseField>

<ResponseField name="review" type="string">
  Hold the signup for another verification step or a manual review.
</ResponseField>

<ResponseField name="block" type="string">
  Reject account creation. Return a generic message to the end user rather than
  exposing detection details.
</ResponseField>

## Current reason codes

| Code                          | Meaning                                                       |
| ----------------------------- | ------------------------------------------------------------- |
| `DISPOSABLE_EMAIL_DOMAIN`     | The email domain appears in the disposable-domain dataset     |
| `EMAIL_SUBADDRESSING`         | Plus-addressing was detected and the account policy blocks it |
| `CUSTOM_BLOCKLIST_EMAIL`      | The exact email is in the account blocklist                   |
| `CUSTOM_BLOCKLIST_DOMAIN`     | The email domain is in the account blocklist                  |
| `IP_CHECK_NOT_AVAILABLE_BETA` | IP input was received but not evaluated                       |
| `TEST_HIGH_RISK`              | Deterministic high-risk fixture used with a test key          |

<Note>
  Integrate against `recommended_action` and reason `code`, not the English
  `message`. Messages may improve without a policy version change.
</Note>