Detect session-hijacking signals API
Identify suspicious session changes and reuse patterns from caller-supplied session, device, IP, and user-agent fields. Indicators only—not confirmed hijacking.
The Detect session-hijacking signals operation is part of the Identity & Access Security API on BRAINIAC.software. Identify suspicious session changes and reuse patterns from caller-supplied session, device, IP, and user-agent fields. Indicators only—not confirmed hijacking. It is exposed as POST /api/v1/identity-security/session-hijacking-signal-detect and priced at $0.04 USDC on Base. Payment uses the x402 exact scheme: an unpaid call returns HTTP 402 with payment requirements; after paying the exact USDC amount, retry the same request with a payment-signature header and Idempotency-Key. No account and no API key are required. Data sources for this product: Caller-supplied authentication logs, access events, account inventory, and policy exports processed locally Limitations: Identity providers are not contacted and OAuth is not used. VPN, proxy, shared-network, and legitimate-travel labels reduce confidence when supplied. A single unusual login is never treated as proof of account compromise. Observed facts are separated from inferred threats. Events are not labeled confirmed compromise without sufficient multi-signal evidence. Missing geolocation or MFA fields are reported as missing, not invented. Outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Related operations in this group include Analyze authentication patterns, Detect impossible travel, Detect MFA fatigue, Detect account sharing. Open the group documentation for the full request schema, field notes, and response examples before integrating.
/api/v1/identity-security/session-hijacking-signal-detectExample request
curl -i -X POST "https://www.brainiac.software/api/v1/identity-security/session-hijacking-signal-detect" \
-H 'content-type: application/json' \
-H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
--data-binary @- <<'JSON'
{
"asOf": "2026-11-04T21:00:00.000Z",
"events": [
{
"id": "E1",
"at": "2026-11-04T19:00:00.000Z",
"userId": "u3",
"outcome": "success",
"sessionId": "S1",
"ip": "203.0.113.10",
"deviceId": "laptop-1",
"userAgent": "Chrome/120",
"source": "Caller-supplied"
},
{
"id": "E2",
"at": "2026-11-04T19:20:00.000Z",
"userId": "u3",
"outcome": "success",
"sessionId": "S1",
"ip": "198.51.100.55",
"deviceId": "phone-9",
"previousDeviceId": "laptop-1",
"userAgent": "MobileSafari/17",
"source": "Caller-supplied"
}
]
}
JSONAn unpaid probe returns HTTP 402 with x402 payment requirements. After paying the exact USDC amount on Base, retry the identical request with a payment-signature header.
FAQ
- Do I need an API key? No. Pay the listed USDC amount with x402.
- What network? Base (eip155:8453), USDC.
- Is this an official determination? No. Results are for human review against the cited sources.
Related operations
- Analyze authentication patterns — $0.04 USDC
- Detect impossible travel — $0.05 USDC
- Detect MFA fatigue — $0.04 USDC
- Detect account sharing — $0.04 USDC