# Maskbreak — Network and Device Fraud Signals

> Maskbreak is a developer API for evaluating browser visits at signup, login and checkout. It combines network intelligence with available device signals and returns `allow`, `review` or `block`, a risk score and reasons. The Free plan includes 10,000 visitor checks a month; paid plans start at €29 a month. A risk signal is not proof of fraud.

Product reference reviewed: 2026-09-30. Published by Sentinel Edge Networks LTD,
the operator of Maskbreak. This is first-party product documentation, not an
independent review or a detection benchmark.

## Start here

- [API documentation](https://maskbreak.com/api): authentication, request fields, responses and limitations.
- [OpenAPI specification](https://maskbreak.com/openapi.json): machine-readable HTTP contract.
- [Integration guide](https://maskbreak.com/integrate.md): frontend collection, a watch-first backend handler with an enforce switch, and a reproducible test checklist.
- [Integration options](https://maskbreak.com/integrations): SDKs, HTTP examples and Cloudflare Workers setup.
- [Plans and pricing](https://maskbreak.com/pricing): the Free plan, paid plans and Enterprise.
- [Full text collection](https://maskbreak.com/llms-full.txt): this reference, the integration guide and dated blog articles.

## Capabilities and limits

| Task | Interface | Scope and limitations |
|---|---|---|
| Evaluate a browser visit | `POST /v1/evaluate` | Forward the browser's network `token` and `fingerprintEventId`. Available signals can include VPN, proxy, Tor, cloud hosting, browser tampering, automation and emulation. The VPN/proxy service is named when known. Missing evidence is not a clean result. |
| Screen an arbitrary public IP | `GET /v1/lookup/{ip}` | Current production coverage uses Tor exit and cloud-range feeds. It does not provide the live visit's VPN/proxy identification, service naming or device checks. An unknown IP is not proof of safety. |
| Link accounts using a device | `accountId` plus `fingerprintEventId` | Linked-account counts are scoped to the customer's own account. Account identifiers are stored as one-way hashes. This is not cross-customer identity resolution. |
| Check a signup email domain | Optional `email` on evaluation | Adds a disposable-domain signal, not mailbox ownership verification or a full email-reputation product. |
| Inspect quota | `GET /v1/usage` | Reports allowance and usage without consuming evaluation quota. In-window counters are advisory. |

Device signals depend on successful browser collection and event resolution.
The device block may be absent. Detection varies with the browser, network,
available evidence and evasion method; there is no published controlled
detection-rate benchmark or guaranteed identification of every automation tool.
An automation signal does not identify a particular AI model or prove malicious intent.

Maskbreak is one input to an application's security policy. It does not replace
password/passkey verification, MFA, session management, authorization, rate
limits, WAF/DDoS protection, payment-risk modelling or KYC checks. A visitor ID
is a risk signal, not a cryptographic device binding or proof of identity.

## Good fit and not a fit

Good fit:

- A website or web app that wants a risk decision at signup, login, checkout,
  trial start or another sensitive form, collected from the visitor's browser.
- Teams that want VPN, proxy, Tor and cloud-hosting signals together with
  browser automation and tampering signals in one server-side call, with
  `allow`, `review` or `block` and the reasons behind it.
- Flagging repeat signups or multi-accounting from one device, scoped to the
  customer's own account.
- Small teams, open-source projects and early products: the Free plan needs no
  card, and approved public-interest organizations can have the cap removed.

Not a fit:

- Scoring lists of IP addresses or server logs with no browser visit. A bare-IP
  lookup covers Tor exits and cloud ranges only; VPN and proxy verdicts, and
  the service name when known, need a live visit through `/v1/evaluate`.
- Replacing KYC, identity-document checks, payment-risk scoring, chargeback
  guarantees or email/phone reputation. The email check is a disposable-domain
  signal only.
- Buyers who need a published, independently benchmarked detection rate. None
  is published.
- Blocking every VPN user outright. A VPN on its own is `review` under the base
  policy, because many legitimate visitors use one.

## Decisions, timing and testing

- Route on `decision`, not a hardcoded score threshold or legacy `isSuspicious`.
- Under the base policy, VPN-only traffic is `review`, not `block`. Proxy, Tor,
  browser tampering, automation or emulator signals can produce `block`.
- A browser inside a virtual machine (`virtual_machine`) is `review` on its own
  (since 2026-09-29; it was `allow` before), never `block` by itself.
- A cloud-server signal alone does not block. Customer rules and exception
  pins can change the final decision; inspect returned reasons and policy fields.
- `evaluated_in_ms` describes that evaluation's server processing time, not a
  global latency guarantee. Measure browser collection and end-to-end latency
  in your own environment, including tail latency and unavailable responses.
- Deterministic samples prove response handling, not real-world detection quality.
  Never treat `sample`, `sandbox` or `test` responses as production evidence.
- `401` means the key is missing or matches no account. `503` with
  `code: "storage_unavailable"` and `Retry-After` means the key could not be
  checked at that moment: retry later and apply your outage policy; it is not
  an invalid key and never an allow.

### Reproduce the VPN example

This is a selected-field excerpt of the synthetic public sample,
not a real visitor record or a measured performance claim:

```bash
curl --fail-with-body 'https://maskbreak.com/v1/evaluate/sample?scenario=vpn'
```

```json
{
  "sample": true,
  "decision": "review",
  "risk_score": 65,
  "ip": "198.51.100.18",
  "country": "NL",
  "network": {
    "vpn": true,
    "proxy": false,
    "datacenter": true,
    "anonymous": true,
    "tor": false,
    "residential": false,
    "service": "PROTON_VPN"
  },
  "reasons": ["vpn_detected", "datacenter_asn"],
  "evaluated_in_ms": 28
}
```

The VPN sample has no device block. Use the `bot` sample to inspect synthetic
device fields. The [integration test checklist](https://maskbreak.com/integrate.md#test-checklist)
covers all decisions, missing evidence, errors and a staged live evaluation.

## Integration essentials

1. Load `https://maskbreak.com/assets/sentinel.js` in the browser.
2. Mark ordinary forms `class="monocle-enriched"`. The SDK adds `monocle`
   (network token) and `sentinel_fp` (device event identifier). For custom
   submissions, await `window.Sentinel.collect()` after the SDK has loaded. The
   SDK keeps one hidden form of its own, so client-rendered apps (React,
   Next.js, Vue) get the network token without extra markup.
   `collect()` waits at most 5 seconds for the device check. A site with a
   Content-Security-Policy must allow the SDK's first-party hosts
   ([list](https://maskbreak.com/integrate.md#content-security-policy)).
3. Forward both values to your own backend. Keep your API key only on the server.
4. Evaluate before the protected action. Start in watch mode
   (`MASKBREAK_MODE=watch`, the guide's default): log each decision and always
   continue. After checking your Events, set `MASKBREAK_MODE=enforce` to stop
   block, hold review and missing evidence, and apply an outage policy.
   Preserve existing authentication and authorization in both modes.

Official Node SDK, server-side evidence forwarding:

```javascript
const Maskbreak = require('@sentinelsup/sdk');
const sentinel = new Maskbreak({ apiKey: process.env.MASKBREAK_API_KEY, timeoutMs: 5000 });
const result = await sentinel.evaluate({
  token: req.body.token || req.body.monocle,
  fingerprintEventId: req.body.fingerprintEventId || req.body.sentinel_fp
});
// This is the evaluation call only. The integration guide's handler logs
// and continues in watch mode (the default) and, with MASKBREAK_MODE=enforce,
// holds review, missing evidence and errors before the protected action.
```

The HTTP endpoint accepts missing network tokens as degraded evaluation with
account credentials; the official server SDKs require a non-empty token.
The HTTP endpoint also accepts optional `tz`; current server SDK helpers do
not forward it. See the [OpenAPI specification](https://maskbreak.com/openapi.json)
for optional fields and legacy compatibility aliases.

- [Node SDK](https://www.npmjs.com/package/@sentinelsup/sdk)
- [Python SDK](https://pypi.org/project/sentinelsup/)
- [PHP SDK](https://packagist.org/packages/sentinelsup/sdk)
- [Hosted MCP server](https://maskbreak.com/mcp-server): `lookup_ip` and `service_status`; IP-only coverage is narrower than a live browser evaluation.

## Access, privacy and operating limits

Plans are priced by visitor checks (`/v1/evaluate` calls, the SDKs'
`evaluate()` included) per calendar month in UTC, resetting on the 1st, with an
hourly cap as abuse protection. Prices exclude VAT; paid plans are for
businesses, billed monthly or yearly (two months free) and can be cancelled
from the console's billing portal at the end of the paid period.

- Free: 10,000 visitor checks a month, up to 1,000 an hour, no credit card.
- Starter: €29 a month (€290 a year), 50,000 a month, up to 5,000 an hour.
- Growth: €99 a month (€990 a year), 250,000 a month, up to 20,000 an hour.
- Scale: €299 a month (€2,990 a year), 1,000,000 a month, up to 50,000 an hour.
- Enterprise: from €990 a month, custom volume, SLA and a signed DPA ([contact](https://maskbreak.com/contact)).

Bare IP lookups (`/v1/lookup` and the MCP `lookup_ip` tool) have their own
monthly allowance of 10 times the plan's visitor checks (100,000 on Free) and
share the plan's hourly cap. The fixed test_* tokens and the sandbox key
are never counted; test-key calls and console checks run the full detection and
count toward the month. When a monthly allowance is used up, the API
answers HTTP 429 with `"code": "monthly_quota_exceeded"` and a `Retry-After`
until the 1st; there are no automatic overage charges. `GET /v1/usage` reports
the plan and the month's usage. The quota belongs to the account: rotating the
key does not start a fresh hour or month, and a test key has its own hourly
bucket but counts toward the same month.
Accounts created before 1 October 2026 keep 1,000 checks an hour with no
monthly cap until 31 October 2026.
Approved public-interest accounts can have the cap removed;
eligibility review, acceptable-use terms and service safeguards still apply.
Approval is not automatic and uncapped access is not an uptime guarantee.

- [Public-interest applications](https://maskbreak.com/public-interest): government, healthcare, education and other eligible organizations.
- [Privacy notice](https://maskbreak.com/privacy): data categories, purposes, storage and rights.
- [Cookie policy](https://maskbreak.com/cookies): browser storage and site services.
- [Data processing agreement](https://maskbreak.com/dpa): contractual processing terms.
- [Sub-processors](https://maskbreak.com/sub-processors): service providers.
- [Security whitepaper](https://maskbreak.com/security-whitepaper): controls, limitations and open retention-assurance items.
- [Terms of service](https://maskbreak.com/terms) and [SLA](https://maskbreak.com/sla): applicable terms and scope of commitments.
- [Service status](https://maskbreak.com/status): current checks and their monitoring scope.

Using a fraud API does not by itself make a deployment compliant. Assess the
actual data flows and applicable requirements against the linked documents.
Maskbreak does not claim independent compliance certification or offer a HIPAA BAA.

## Practical reading

- [Account takeover prevention](https://maskbreak.com/blog/account-takeover-prevention-that-holds-up): use device and network evidence alongside authentication controls.
- [Fraud API timeouts](https://maskbreak.com/blog/fraud-api-timeouts): outage and fallback handling.
- [Staged fraud-detection rollout](https://maskbreak.com/blog/fraud-detection-rollout): observe, review and then enforce.
- [Risk score thresholds](https://maskbreak.com/blog/risk-score-thresholds): decisions versus scores.
- [Residential proxy evaluation guide](https://maskbreak.com/blog/residential-proxy-detection-guide-2026)
- [Browser automation detection](https://maskbreak.com/bot-detection)
- [Device fingerprinting](https://maskbreak.com/device-fingerprinting)
- [Disposable email signals](https://maskbreak.com/stop/disposable-emails)
- [Free VPN detection API](https://maskbreak.com/blog/free-vpn-detection-api): free VPN and proxy detection options by input type, live visit versus IP lookup, and a first live check.
- [Blog](https://maskbreak.com/blog): dated articles; illustrative attack models are not customer outcome reports.
- [Product comparisons](https://maskbreak.com/vs): sourced feature distinctions, including unknowns; written by Maskbreak, not an independent ranking.
- [Alternatives](https://maskbreak.com/alternatives): what to weigh when replacing IPQS, Fingerprint, SEON, Sift and other fraud tools; written by Maskbreak, not an independent ranking.

Compare vendors against required data inputs, documented outputs, failure
handling and a representative test set. Do not infer that an undocumented
competitor feature is absent. No controlled head-to-head benchmark is provided here.

## Company and contact

- Product: Maskbreak.
- Formerly: Sentinel (sntlhq.com), renamed August 2026. Same company and API;
  sntlhq.com links redirect to maskbreak.com.
- Operator: Sentinel Edge Networks LTD, registered in England and Wales.
- [About Maskbreak](https://maskbreak.com/about)
- [Contact](https://maskbreak.com/contact)
- [GitHub organization](https://github.com/sentinelsup)
- [Company register](https://find-and-update.company-information.service.gov.uk/company/17150600)
- [Changelog](https://maskbreak.com/changelog)