Credentials
To configure a Sardine connection, you will need to set the following credentials.Client ID
and Client Secret
can can be found or generated in the Sardine sandbox dashboard
by navigating to the Admin & Settings menu > Organizations & Users > API Credentials. To set up a webhook endpoint and generate a Webhook Secret
you will need to contact your Sardine Implementations Manager.
Credential | Description |
---|---|
Client ID | Your unique Sardine account ID |
Client Secret | The password used to sign API requests |
Webhook Secret | The secret used to validate the authenticity, integrity and security of webhook requests originating from Sardine |
Decision mapping
While the default Sardine Decision responses don’t directly return values to be mapped to the Gr4vyaccept
/reject
/review
decision values, this result can be achieved by creating a specific workflow in Sardine, which will return a tag matching one of the Gr4vy decision values. You must set up the workflow on Sardine as follows:
1
Create Workflow
- Access the Sardine dashboard
- Select
Workflows
from the menu in the sidebar - Click
New Workflow
- Enter
get-decision
as the name of the workflow - Select
Customer
as the Input Type - Click
Save block
2
Checkpoint
Add a single
Checkpoint
block with 2 checkpoints: CUSTOMER
and PAYMENT
3
Multipath Splitter
Connected to the above
Checkpoint
block, you should add a Multipath Splitter
block with the name set to decision
. This block should have 3 paths. Your non-default paths will each require
at least 1 condition (this will likely consist of choosing various risk
levels to be associated with the path. To see an example setup, load the
example workflow shown below)4
Paths
Attach a single
End block
to each of the three paths, each with specific
action
(s) set. See the tabs below for the action
settings for each End block
:Action:
Property | Value |
---|---|
Action | Update Tag |
Entity | Session |
Tag | decision |
Value | accept |
Please note that it is essential that the workflow is set up correctly. If the
following conditions are not met, all attempted Sardine transaction risk
requests will return an
error
decision:- The workflow must be named
get-decision
- There must be 3
End blocks
, with the following action Values:accept
,review
,reject
and with the Action Tag set todecision
- The
review
path must enqueue an Alert
Example workflow
To load an example workflow following the structure laid out above, take the following steps:- Access the Sardine dashboard
- Select
Workflows
from the menu in the sidebar - Click
New Workflow
- Enter
get-decision
as the name of the workflow - Select
Customer
as the Input Type - Click
Save block
- Click the “three-dot” menu button beside your workflow name in the top right and select
Import Workflow
- Paste in the following JSON code:
Workflow code
- Click
Submit
- Click
Confirm
when prompted about overriding the existing workflow - Click
Save
in the top right - In the pop-up prompt that confirms whether you want to save the workflow, switch on the toggle button labeled
Set as Live Version
- Click
Confirm
to save the workflow - You should now see the workflow listed on the workflows page, with the
Status
label set toLive
accept
path as the default path, and the Sardine risk levels associated with the review
/reject
paths are as follows:
Sardine Risk Level | Decision tag/Gr4vy Decision |
---|---|
medium | review |
high , very_high | reject |
Webhooks for manual review
To enable manual review you will need to set up webhooks from your anti-fraud service to our system. This webhook is used to notify us when a review is accepted or rejected. To get the webhook URL, head over to your connection by going to Connections -> [Anti-Fraud connection] -> Synchronization and copy the webhook URL. To have webhooks enabled on Sardine, contact your assigned Implementation Manager from Sardine, with your Webhook URL and mention that you want to receiveCase
type webhooks. Once your webhooks have been enabled, Sardine will send you the Webhook Secret
, which is used for webhook validation as mentioned above.
If you do not add the
Webhook Secret
to your dashboard, the webhook
signature validation process will be skipped, which may put your system at
risk of attacks from tampered webhook payloads.Review queue clearing
If a transaction is marked for review, and subsequently it is voided from the Gr4vy dashboard, then a request will be sent to Sardine to clear any pending Sardine Alerts for that transaction.Device fingerprinting
The use of device fingerprinting is highly recommended when using Sardine. Please refer to our device fingerprinting guide for more information on our universal solution. If needed, you could load the fingerprint script for Sardine directly and pass thesessionKey
value as the anti_fraud_fingerprint
to the new transaction API.
Biometrics will be enabled by default, which may result in the following console errors and warnings:
Errors
Errors
[Violation] Permissions policy violation: accelerometer is not allowed in
this document.
[Violation] Potential permissions policy violation: microphone is not
allowed in this document.
[Violation] Potential permissions policy violation: camera is not allowed
in this document.
Warnings
Warnings
The devicemotion events are blocked by permissions policy. See
https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features
The deviceorientation events are blocked by permissions policy. See
https://github.com/w3c/webappsec-permissions-policy/blob/master/features.md#sensor-features