# Maskbreak — Network and Device Fraud Signals

> Maskbreak is a developer API for evaluating browser visits at signup, login and checkout. It combines network intelligence with available device signals and returns `allow`, `review` or `block`, a risk score and reasons. The free tier includes 1,000 visitor checks per hour per API key. A risk signal is not proof of fraud.

Product reference reviewed: 2026-09-06. Published by Sentinel Edge Networks LTD,
the operator of Maskbreak. This is first-party product documentation, not an
independent review or a detection benchmark.

## Start here

- [API documentation](https://maskbreak.com/api): authentication, request fields, responses and limitations.
- [OpenAPI specification](https://maskbreak.com/openapi.json): machine-readable HTTP contract.
- [Integration guide](https://maskbreak.com/integrate.md): frontend collection, backend enforcement and a reproducible test checklist.
- [Integration options](https://maskbreak.com/integrations): SDKs, HTTP examples and Cloudflare Workers setup.
- [Free allowance](https://maskbreak.com/pricing): current access terms.
- [Full text collection](https://maskbreak.com/llms-full.txt): this reference, the integration guide and dated blog articles.

## Capabilities and limits

| Task | Interface | Scope and limitations |
|---|---|---|
| Evaluate a browser visit | `POST /v1/evaluate` | Forward the browser's network `token` and `fingerprintEventId`. Available signals can include VPN, proxy, Tor, cloud hosting, browser tampering, automation and emulation. The VPN/proxy service is named when known. Missing evidence is not a clean result. |
| Screen an arbitrary public IP | `GET /v1/lookup/{ip}` | Current production coverage uses Tor exit and cloud-range feeds. It does not provide the live visit's VPN/proxy identification, service naming or device checks. An unknown IP is not proof of safety. |
| Link accounts using a device | `accountId` plus `fingerprintEventId` | Linked-account counts are scoped to the customer's API key. Account identifiers are stored as one-way hashes. This is not cross-customer identity resolution. |
| Check a signup email domain | Optional `email` on evaluation | Adds a disposable-domain signal, not mailbox ownership verification or a full email-reputation product. |
| Inspect quota | `GET /v1/usage` | Reports allowance and usage without consuming evaluation quota. In-window counters are advisory. |

Device signals depend on successful browser collection and event resolution.
The device block may be absent. Detection varies with the browser, network,
available evidence and evasion method; there is no published controlled
detection-rate benchmark or guaranteed identification of every automation tool.
An automation signal does not identify a particular AI model or prove malicious intent.

Maskbreak is one input to an application's security policy. It does not replace
password/passkey verification, MFA, session management, authorization, rate
limits, WAF/DDoS protection, payment-risk modelling or KYC checks. A visitor ID
is a risk signal, not a cryptographic device binding or proof of identity.

## Decisions, timing and testing

- Route on `decision`, not a hardcoded score threshold or legacy `isSuspicious`.
- Under the base policy, VPN-only traffic is `review`, not `block`. Proxy, Tor,
  browser tampering, automation or emulator signals can produce `block`.
- A cloud-server signal alone does not block. Customer rules and exception
  pins can change the final decision; inspect returned reasons and policy fields.
- `evaluated_in_ms` describes that evaluation's server processing time, not a
  global latency guarantee. Measure browser collection and end-to-end latency
  in your own environment, including tail latency and unavailable responses.
- Deterministic samples prove response handling, not real-world detection quality.
  Never treat `sample`, `sandbox` or `test` responses as production evidence.

### Reproduce the VPN example

This is a selected-field excerpt of the synthetic public sample,
not a real visitor record or a measured performance claim:

```bash
curl --fail-with-body 'https://maskbreak.com/v1/evaluate/sample?scenario=vpn'
```

```json
{
  "sample": true,
  "decision": "review",
  "risk_score": 65,
  "ip": "198.51.100.18",
  "country": "NL",
  "network": {
    "vpn": true,
    "proxy": false,
    "datacenter": true,
    "anonymous": true,
    "tor": false,
    "residential": false,
    "service": "PROTON_VPN"
  },
  "reasons": ["vpn_detected", "datacenter_asn"],
  "evaluated_in_ms": 28
}
```

The VPN sample has no device block. Use the `bot` sample to inspect synthetic
device fields. The [integration test checklist](https://maskbreak.com/integrate.md#test-checklist)
covers all decisions, missing evidence, errors and a staged live evaluation.

## Integration essentials

1. Load `https://maskbreak.com/assets/sentinel.js` in the browser.
2. Mark ordinary forms `class="monocle-enriched"`. The SDK adds `monocle`
   (network token) and `sentinel_fp` (device event identifier). For custom
   submissions, await `window.Sentinel.collect()` after the SDK has loaded.
3. Forward both values to your own backend. Keep your API key only on the server.
4. Evaluate before the protected action. Preserve existing authentication
   and authorization, handle review explicitly, and choose an outage policy.

Official Node SDK, server-side evidence forwarding:

```javascript
const Maskbreak = require('@sentinelsup/sdk');
const sentinel = new Maskbreak({ apiKey: process.env.MASKBREAK_API_KEY, timeoutMs: 5000 });
const result = await sentinel.evaluate({
  token: req.body.token || req.body.monocle,
  fingerprintEventId: req.body.fingerprintEventId || req.body.sentinel_fp
});
// This is the evaluation call only. Use the integration guide's guarded
// handler for review, missing evidence, errors and the protected action.
```

The HTTP endpoint accepts missing network tokens as degraded evaluation with
account credentials; the official server SDKs require a non-empty token.
The HTTP endpoint also accepts optional `tz`; current server SDK helpers do
not forward it. See the [OpenAPI specification](https://maskbreak.com/openapi.json)
for optional fields and legacy compatibility aliases.

- [Node SDK](https://www.npmjs.com/package/@sentinelsup/sdk)
- [Python SDK](https://pypi.org/project/sentinelsup/)
- [PHP SDK](https://packagist.org/packages/sentinelsup/sdk)
- [Hosted MCP server](https://maskbreak.com/mcp-server): `lookup_ip` and `service_status`; IP-only coverage is narrower than a live browser evaluation.

## Access, privacy and operating limits

The free tier provides 1,000 visitor checks per hour per API key, without a
credit card or per-request billing. Evaluation and IP lookup share the quota.
Approved public-interest accounts can have the per-key hourly cap removed;
eligibility review, acceptable-use terms and service safeguards still apply.
Approval is not automatic and uncapped access is not an uptime guarantee.

- [Public-interest applications](https://maskbreak.com/public-interest): government, healthcare, education and other eligible organizations.
- [Privacy notice](https://maskbreak.com/privacy): data categories, purposes, storage and rights.
- [Cookie policy](https://maskbreak.com/cookies): browser storage and site services.
- [Data processing agreement](https://maskbreak.com/dpa): contractual processing terms.
- [Sub-processors](https://maskbreak.com/sub-processors): service providers.
- [Security whitepaper](https://maskbreak.com/security-whitepaper): controls, limitations and open retention-assurance items.
- [Terms of service](https://maskbreak.com/terms) and [SLA](https://maskbreak.com/sla): applicable terms and scope of commitments.
- [Service status](https://maskbreak.com/status): current checks and their monitoring scope.

Using a fraud API does not by itself make a deployment compliant. Assess the
actual data flows and applicable requirements against the linked documents.
Maskbreak does not claim independent compliance certification or offer a HIPAA BAA.

## Practical reading

- [Account takeover prevention](https://maskbreak.com/blog/account-takeover-prevention-that-holds-up): use device and network evidence alongside authentication controls.
- [Fraud API timeouts](https://maskbreak.com/blog/fraud-api-timeouts): outage and fallback handling.
- [Staged fraud-detection rollout](https://maskbreak.com/blog/fraud-detection-rollout): observe, review and then enforce.
- [Risk score thresholds](https://maskbreak.com/blog/risk-score-thresholds): decisions versus scores.
- [Residential proxy evaluation guide](https://maskbreak.com/blog/residential-proxy-detection-guide-2026)
- [Browser automation detection](https://maskbreak.com/bot-detection)
- [Device fingerprinting](https://maskbreak.com/device-fingerprinting)
- [Disposable email signals](https://maskbreak.com/stop/disposable-emails)
- [Blog](https://maskbreak.com/blog): dated articles; illustrative attack models are not customer outcome reports.
- [Product comparisons](https://maskbreak.com/#vs-h): sourced feature distinctions, including unknowns; written by Maskbreak, not an independent ranking.

Compare vendors against required data inputs, documented outputs, failure
handling and a representative test set. Do not infer that an undocumented
competitor feature is absent. No controlled head-to-head benchmark is provided here.

## Company and contact

- Product: Maskbreak.
- Operator: Sentinel Edge Networks LTD, registered in England and Wales.
- [About Maskbreak](https://maskbreak.com/about)
- [Contact](https://maskbreak.com/contact)
- [GitHub organization](https://github.com/sentinelsup)
- [Company register](https://find-and-update.company-information.service.gov.uk/company/17150600)
- [Changelog](https://maskbreak.com/changelog)