Retrieve the assessment

The browser only ever holds an opaque id. Your backend exchanges it for the authoritative verdict using your secret key, so a client can never forge the result.

The call

GET /api/prism/assessment/<id> with header X-Farox-Secret: <fsk_ key>. Returns 404 for an unknown id and 401 for a bad key.

node

const a = await fetch(
  "https://api.farox.io/api/prism/assessment/" + id,
  { headers: { "X-Farox-Secret": process.env.FAROX_SECRET } })
  .then(r => r.json())

Verdict fields

Field	Type	Meaning
`ip`	string	the client's source IP (taken server-side, not client-reported)
`anonymized`	bool	VPN, proxy, Tor, datacenter or proxy-suspect
`network_type`	string	RESIDENTIAL / MOBILE / DATACENTER / VPN / PROXY / TOR
`is_vpn / is_proxy / is_tor / is_datacenter`	bool	specific network flags
`is_proxy_suspect`	bool	behavioral / ASN-reputation proxy suspicion
`provider`	string	named VPN/proxy service when known
`automation`	bool	headless / webdriver / bot browser
`risk_score`	0-100	combined risk
`webrtc_leak`	string	real IP leaked via WebRTC, if any
`client`	object	browser fingerprint (webgl, cpu, geometry, ...)
`signals`	string[]	the explainable evidence behind the verdict

The verdict is the same object Prism returned to the browser, re-fetched authoritatively. Decision logic (block/allow) belongs on your side, or use Policies.