Behavioral fraud detection for marketplaces, rental platforms, and gig economy apps. One API call per message — risk score back in under 50ms.
Driftline plugs into your existing infrastructure. No data migration. No model training. No content access.
Built for any platform where users connect, transact, or communicate.
Content-based fraud detection has a fundamental flaw: scammers adapt. Behavioral metadata doesn't lie.
Real-time view of every flagged account across your platform.
Install our official SDK or use the REST API directly. Works with any language, any stack.
Start free, scale as you grow. No setup fees. No long-term contracts. Cancel anytime.
30 days free. No card required. Integrates in under 10 minutes.
Driftline detects fraudulent behavior on digital platforms by analyzing messaging metadata in real time. You send us events — we return risk scores. No message content ever leaves your server.
Base URL: https://driftline-api-production.up.railway.app
All endpoints require an X-API-Key header with your API key. Get your key by creating a free account.
Get up and running in under 5 minutes. Every time a user sends a message on your platform, call the /event endpoint. We return a risk score immediately.
# pip install requests import requests response = requests.post( "https://driftline-api-production.up.railway.app/event", headers={"X-API-Key": "your_api_key"}, params={ "user_id": "user_123", "conversation_id": "conv_456", "platform": "your_platform", "reply_speed": 2.3, "message_length": 45 } ) result = response.json() if result["risk_level"] == "critical": suspend_user(result["user_id"])
All API requests must include your API key in the X-API-Key header.
curl https://driftline-api-production.up.railway.app/stats \
-H "X-API-Key: your_api_key_here"
If your API key is missing or invalid, you'll receive a 401 Unauthorized response.
The core endpoint. Call this every time a user sends a message on your platform. Returns a real-time risk score in under 50ms.
| Parameter | Type | Required | Description |
|---|---|---|---|
user_id | string | Required | Your platform's unique identifier for the user |
conversation_id | string | Required | Unique ID for the conversation or chat thread |
platform | string | Required | Your platform name (e.g. "myapp") |
reply_speed | float | Optional | Seconds since user's last message in this conversation |
message_length | integer | Optional | Character count of the message |
ip_address | string | Optional | User's IP — enables cross-platform network intelligence |
device_fingerprint | string | Optional | Device ID — enables cross-platform network intelligence |
{
"user_id": "user_123",
"risk_score": 87.0,
"risk_level": "critical",
"flags": ["45 msgs/hr", "Bot-like reply speed: avg 1.2s"],
"recommendation": "Suspend account immediately",
"analyzed_at": "2026-04-16T22:00:00"
}
Returns all flagged accounts for your platform, ordered by risk score descending.
| Parameter | Type | Description |
|---|---|---|
level | string | Filter by: critical, high, medium, low |
limit | integer | Max results to return (default: 50) |
Returns aggregate statistics — total scanned, flagged counts by risk level, overall flag rate.
Returns the current risk score for a specific user on your platform.
Free fraud audit endpoint — no API key required. Upload a CSV of historical message events and get a full behavioral analysis. Perfect for evaluating Driftline before integrating.
CSV columns: user_id, conversation_id, timestamp (optional), reply_speed (optional), message_length (optional)
curl -X POST \ https://driftline-api-production.up.railway.app/audit \ -F "file=@your_data.csv" \ -F "platform_name=YourPlatform"
Removes a user's event history and flagged status. Use after reviewing and taking action on a flagged account.
import requests, time KEY = "your_api_key" URL = "https://driftline-api-production.up.railway.app" last_times = {} def on_message(user_id, convo_id, msg_text): now = time.time() speed = now - last_times.get(convo_id, now) last_times[convo_id] = now result = requests.post(f"{URL}/event", headers={"X-API-Key": KEY}, params={"user_id": user_id, "conversation_id": convo_id, "platform": "myplatform", "reply_speed": speed, "message_length": len(msg_text)} ).json() if result["risk_level"] == "critical": flag_for_review(user_id)
async function checkMessage(userId, convId, replySpeed) { const params = new URLSearchParams({ user_id: userId, conversation_id: convId, platform: 'myplatform', reply_speed: replySpeed }); const r = await fetch( `https://driftline-api-production.up.railway.app/event?${params}`, { method: 'POST', headers: { 'X-API-Key': 'your_key' } } ); const result = await r.json(); if (result.risk_level === 'critical') suspendUser(userId); }
curl -X POST \ "https://driftline-api-production.up.railway.app/event" \ -H "X-API-Key: your_api_key" \ --data-urlencode "user_id=user_123" \ --data-urlencode "conversation_id=conv_456" \ --data-urlencode "platform=myapp" \ --data-urlencode "reply_speed=2.3" curl "https://driftline-api-production.up.railway.app/flagged" \ -H "X-API-Key: your_api_key"
We're here to help you get integrated and running. Most questions are answered in the docs — or just email us directly.
Whether you're evaluating Driftline, having trouble integrating, or have a question — reach out. Every email goes directly to Leo, the founder.
✉️ leocohen@trydriftline.com ⚡ Typical response time: a few hoursDigital platforms lose billions to fraud every year. Most detection tools act after the fact. Driftline acts at the moment it matters — during the conversation, before any payment is made.
To make digital platforms safe for everyone. Trust is the foundation of every marketplace — protecting it should be simple, affordable, and automatic.
We never read message content. We analyze only metadata — timestamps, reply speeds, simultaneity, conversation patterns. GDPR and CCPA compliant by default.
Our API processes events in under 50ms. Whether you have 1,000 users or 10 million, Driftline scales without any configuration changes or infrastructure overhead.
Every platform using Driftline contributes to a shared scammer fingerprint network. A device flagged on one platform is immediately flagged across all platforms.