Policy Rules

The default policy applies the shared HCS thresholds used everywhere else: >= 0.35 Allow, 0.30–0.35 grey zone, < 0.30 confirmed synthetic — combined with whether you flagged the call as critical. See the Policy Engine concept page for what each action does.

How to use it

GET /v1/session/{session_id}?critical=true
Authorization: Bearer certilayer_live_sk_xxx

Omit critical (or set it false) for routine calls — non-critical low scores get tarpitted rather than terminated, preserving UX on lower-stakes pages. Per-organization custom thresholds aren't yet configurable from the dashboard — contact [email protected] if you need custom boundaries before that ships.

When to use SilentTarpit instead of TerminateSession

TerminateSession tells an attacker immediately that they've been caught, which teaches them to adjust. SilentTarpit slows the response without any signal that detection occurred — useful on endpoints where you'd rather waste an attacker's time than reveal your defenses.

{
  "min_hcs": 0.00,
  "max_hcs": 0.15,
  "action": "SilentTarpit",
  "tarpit_delay_ms": 8000
}