Security Events

These events track security-related activity including anti-fraud detection, two-factor authentication, and player restrictions.

Related Documentation

• Use Anti-fraud Check Type Codes to decode incident types
• Use Anti-fraud Incident Status Codes to track incident lifecycle

---

Anti-Fraud Events

OnFraudIncidentCreated

Triggered when a new anti-fraud incident is detected.

When it fires:

• Anti-fraud system detects suspicious activity
• New incident created based on configured rules

Field	Type	Description
incidentId	integer	Incident ID
checkTypesId	array	Array of check type codes
incidentConfidence	integer	Confidence level (0-100%)
createdAt	string	Creation timestamp (YYYY-MM-DD HH:MM:SS)
participants	array	Array of participant objects

Participant Object

Field	Type	Description
playerId	integer	Player ID in EvenBet system
playerConfidence	integer	Player's confidence level (0-100%)
externalId	string	External system player ID
ip	string	Player's last known IP address

Example:

{
  "incidentId": 12345,
  "checkTypesId": [1, 4],
  "incidentConfidence": 85,
  "createdAt": "2024-01-15 14:30:00",
  "participants": [
    {
      "playerId": 81622,
      "playerConfidence": 90,
      "externalId": "EXT123",
      "ip": "192.168.1.100"
    },
    {
      "playerId": 81623,
      "playerConfidence": 80,
      "externalId": "EXT456",
      "ip": "192.168.1.101"
    }
  ]
}

---

OnFraudIncidentUpdated

Triggered when an anti-fraud incident is updated.

When it fires:

• Incident status changed manually
• Incident details modified
• New information added to incident

Field	Type	Description
incidentId	integer	Incident ID
checkTypesId	array	Array of check type codes
incidentConfidence	integer	Confidence level (0-100%)
updatedAt	string	Update timestamp
participants	array	Array of participant objects
status	integer	Incident status code
managerId	integer/string	Admin ID who updated, or "System" if automatic

Incident Status Codes

Code	Status	Description
1	Open	New incident, pending review
2	Resolved	Issue addressed
3	Closed	Incident closed
4	False Alarm	Determined to be false positive
5	Reopened	Previously closed, now reopened
6	Expired	Incident expired without action
7	Duplicated	Duplicate of another incident

Example:

{
  "incidentId": 12345,
  "checkTypesId": [1, 4],
  "incidentConfidence": 85,
  "updatedAt": "2024-01-15 15:00:00",
  "participants": [
    {
      "playerId": 81622,
      "playerConfidence": 90,
      "externalId": "EXT123",
      "ip": "192.168.1.100"
    }
  ],
  "status": 2,
  "managerId": 100
}

---

OnFraudAutoReactionApplied

Triggered when an automatic reaction is applied to players due to a fraud incident.

When it fires:

• Configured auto-reaction rule triggered
• Players affected by automatic action

Field	Type	Description
action	string	Action taken: "kick", "block", "forbid cash", "forbid tournament"
appliedAt	string	Timestamp when action was applied
playersId	array	Array of affected player IDs

Example:

{
  "action": "kick",
  "appliedAt": "2024-01-15 14:35:00",
  "playersId": [81622, 81623]
}

---

OnFraudIncidentStatusChangedAutomatically

Triggered when an incident status changes automatically.

When it fires:

• Incident auto-expires
• System automatically closes or updates incident

Field	Type	Description
incidentId	integer	Incident ID
previousStatus	integer	Status before change
changedStatus	integer	Status after change
changedAt	string	Timestamp of change

Example:

{
  "incidentId": 12345,
  "previousStatus": 1,
  "changedStatus": 6,
  "changedAt": "2024-01-22 14:30:00"
}

---

OnCooperativeBlockUpdated

Triggered when a cooperative (team) block is updated.

When it fires:

• Block created between two players
• Block settings modified

Field	Type	Description
recordId	integer	Block record ID
playerId1	integer	First player ID
externalId1	string	First player external ID
externalSystemCode1	string	First player external system
skinId1	integer	First player skin ID
playerId2	integer	Second player ID
externalId2	string	Second player external ID
externalSystemCode2	string	Second player external system
skinId2	integer	Second player skin ID
block_cash	boolean	Block cash games between players
block_mtt	boolean	Block scheduled tournaments
block_sng	boolean	Block Sit & Go tournaments
block_transfer	boolean	Block P2P transfers
externalSessionId	string	External session identifier

Example:

{
  "recordId": 123,
  "playerId1": 1001,
  "externalId1": "PLR-1001",
  "externalSystemCode1": "SYS",
  "skinId1": 0,
  "playerId2": 1002,
  "externalId2": "PLR-1002",
  "externalSystemCode2": "SYS",
  "skinId2": 1,
  "block_cash": true,
  "block_mtt": false,
  "block_sng": false,
  "block_transfer": false
}

---

OnCooperativeBlockDeleted

Triggered when a cooperative block is removed.

When it fires:

• Block between two players deleted

Field	Type	Description
recordId	integer	Block record ID
playerId1	integer	First player ID
externalId1	string	First player external ID
externalSystemCode1	string	First player external system
skinId1	integer	First player skin ID
playerId2	integer	Second player ID
externalId2	string	Second player external ID
externalSystemCode2	string	Second player external system
skinId2	integer	Second player skin ID
externalSessionId	string	External session identifier

Example:

{
  "recordId": 123,
  "playerId1": 1001,
  "externalId1": "PLR-1001",
  "externalSystemCode1": "SYS",
  "skinId1": 0,
  "playerId2": 1002,
  "externalId2": "PLR-1002",
  "externalSystemCode2": "SYS",
  "skinId2": 1
}

---

Authentication Events

OnTFAPreLogin

Triggered when a player initiates two-factor authentication.

When it fires:

• Player enters login credentials
• 2FA process begins

Required action: Your system should send or prepare an SMS code, email code, or other confirmation method.

Field	Type	Description
login	string	Login used for entry
playerId	integer	User ID (resolved from login)
skinId	integer	User's skin ID
tfaType	integer	2FA type code (see below)

2FA Type Codes

Code	Type	Description
83	tfaSMS	SMS verification
69	tfaEmail	Email verification
71	tfaGoogleAuthenticator	Google Authenticator
84	tfaOneTimePassword	One-time password
73	tfaIdentityVerificationCode	Identity verification
67	tfaExtraClientCheck	Additional client-side verification (e.g., Xpoint)

Type Override

For tfaOneTimePassword, if the server matches the login with an email or phone, it may change the type to tfaEmail or tfaSMS.

Example:

{
  "login": "john",
  "playerId": 6158,
  "skinId": 2,
  "tfaType": 83
}

---

OnTFALogin

Triggered when a player submits their 2FA verification code.

When it fires:

• Player enters SMS/email code
• Player submits authenticator code

Required action: Validate the auth field and respond by calling the poker_player_tfa_login_result method.

Field	Type	Description
login	string	Login used for entry
playerId	integer	User ID
skinId	integer	User's skin ID
tfaType	integer	2FA type code
auth	string	Verification code submitted by player

Example:

{
  "login": "john",
  "playerId": 6158,
  "skinId": 2,
  "tfaType": 83,
  "auth": "1234"
}

---

OnExternalLogin

Triggered when a skin or player account requires external authentication.

When it fires:

• Skin configured for external login validation
• Player account requires external verification

Required action: Validate credentials and respond by calling the poker_external_login_validation_result method.

Field	Type	Description
login	string	Login used for entry
password	string	Password used for entry
skinKey	string	Skin key
ip	string	User's IP address
auth	string	Token for subsequent logins

Example:

{
  "login": "john",
  "password": "123456",
  "skinKey": "evenbet",
  "ip": "127.0.0.1",
  "auth": "BDAAB7E52ED69D597CA96CDFFCA68324"
}

---

Related Events

• Player & Session Events — For OnUpdatePlayerBlockStatus and account events
• Anti-fraud Check Type Codes — Complete reference for check types