Mock Request Tokens

A request_token parameter is required to be sent with every request to the Filter and Risk API endpoints. In order to test Castle without having a client-side integration in place, you can use Mock Request Tokens to evaluate different risk scenarios.

Format

test|<parameter>:<value>|<parameter>:<value>...

The device parameter is required. All other parameters are optional. A Mock Request Token without a device parameter is rejected as invalid.

Usage

Mock Request Tokens will streamline your testing process by giving you a way to force certain aspects and characteristics of a request, without doing a full integration. For example, if you want to simulate a user using Firefox on a Windows device in the US, you can use the following Mock Request Token value:

request_token: "test|device:firefox_on_windows|ip:us-ca"

🚧
Reminder
Test tokens are only supported on Sandbox environments.

Test Token Parameters & Values

Parameter	Possible Values	Description
`device`	`chrome_on_mac` `safari_on_mac` `firefox_on_mac` `chrome_on_windows` `firefox_on_windows` `bot_on_linux`	Pre-determined device combinations to represent various device types
`ip`	`se` `us-ca` `jp`	IP location of the request
`policy.action`	`allow` `challenge` `deny`	Force a policy action to be returned by Castle
`risk`	value from `0-1.0`	Set the Castle Abuse score to a specific value. The Bot score is not affected, and is still calculated from the device you select

The risk and policy.action parameters are independent. A high risk value on its own does not force a deny action, because your policies still decide the action. Set both parameters when you want a specific score and a specific action in the same response.

Examples

Mac computer using a Chrome browser, connecting from California, US:

test|device:chrome_on_mac|ip:us-ca

Headless browser, connecting from Japan:

test|device:bot_on_linux|ip:jp