> ## Documentation Index > Fetch the complete documentation index at: https://docs.tuteliq.ai/llms.txt > Use this file to discover all available pages before exploring further. # Detect app fraud and financial scam patterns > Analyzes text content for app fraud indicators including payment coercion, account takeover, safe account scams, invoice fraud, impersonation, investment pressure, and emotional financial exploitation. ## OpenAPI ````yaml https://api.tuteliq.ai/docs/json post /api/v1/fraud/app-fraud openapi: 3.1.0 info: title: Tuteliq API description: > # AI-Powered Child Safety API You're building a chat feature for a kids' learning app. A user sends a message that looks innocuous on the surface but contains subtle grooming escalation patterns. Tuteliq catches it, scores the risk by the child's age group, and gives your trust & safety team an actionable report — all in under 400ms. One API call replaces months of in-house ML work. --- ## KOSA Harm Categories Coverage | Harm Category | Endpoint | Status | |--------------|----------|--------| | Eating Disorders | `/safety/unsafe` | ✅ Covered | | Substance Use | `/safety/unsafe` | ✅ Covered | | Suicidal Behaviors | `/safety/unsafe` | ✅ Covered | | Depression & Anxiety | `/safety/unsafe` + `/analysis/emotions` | ✅ Covered | | Compulsive Usage | `/safety/unsafe` | ✅ Covered | | Harassment & Bullying | `/safety/bullying` | ✅ Covered | | Sexual Exploitation | `/safety/grooming` + `/safety/unsafe` | ✅ Covered | | Voice & Audio Threats | `/safety/voice` | ✅ Covered | | Visual Content Risks | `/safety/image` | ✅ Covered | --- ## Key Features - **Age-Calibrated Severity** — Risk scores adjust across four age brackets (under 10, 10–12, 13–15, 16–17) so moderation matches developmental context. - **Nuanced Context Recognition** — Distinguishes hyperbolic teen language from genuine crisis signals, dramatically reducing false positives. - **Grooming Pattern Detection** — Identifies multi-stage grooming tactics: trust escalation, secrecy requests, isolation attempts, and boundary violations. - **Emotional Trend Analysis** — Tracks persistent mood patterns across conversations to surface early indicators of declining mental health. - **Voice & Image Analysis** — Upload audio or images for transcription, OCR, and full safety analysis in a single call. - **Real-time Voice Streaming** — WebSocket endpoint for live audio moderation with configurable flush intervals and per-category alerts. - **Guidance & Reports** — Generate age-appropriate action plans and professional incident reports ready for handoff to human reviewers. - **Batch Processing & Webhooks** — Analyze up to 50 items per batch call, with HMAC-signed webhook alerts for critical incidents. --- ## Credits per Action | Endpoint | Credits | Notes | |----------|---------|-------| | `detectBullying` | 1 | Single text analysis | | `detectUnsafe` | 1 | Single text analysis | | `detectGrooming` | 1 per 10 msgs | `ceil(messages / 10)`, min 1 | | `analyzeEmotions` | 1 per 10 msgs | `ceil(messages / 10)`, min 1 | | `getActionPlan` | 2 | Longer generation | | `generateReport` | 3 | Structured output | | `analyzeVoice` | 5 | Transcription + analysis | | `analyzeImage` | 3 | Vision + OCR + analysis | Every response includes a `credits_used` field. Credit balance is also available via the `X-Credits-Remaining` response header. --- ## Quick Start **1.** Get your API key at [tuteliq.ai/dashboard](https://tuteliq.ai/dashboard) **2.** Install the SDK: ```bash npm install @tuteliq/sdk ``` **3.** Make your first call: ```typescript import Tuteliq from '@tuteliq/sdk' const tuteliq = new Tuteliq({ apiKey: 'YOUR_API_KEY' }) const result = await tuteliq.detectUnsafe({ content: "Don't talk to your parents about us meeting up", context: { age_group: "13-15" } }) console.log(result.unsafe) // true console.log(result.categories) // ["grooming_adjacent", "secrecy"] console.log(result.severity) // "high" console.log(result.recommended_action) // "Escalate to moderator" ``` --- ## Performance | Metric | Value | |--------|-------| | Average latency | ~400ms | | p95 latency | ~800ms | | Uptime SLA | 99.9% | Check real-time status at [tuteliq.ai/status](https://tuteliq.ai/status) version: 1.0.0 contact: name: Tuteliq Support url: https://tuteliq.ai email: support@tuteliq.ai license: name: Proprietary url: https://tuteliq.ai/terms servers: - url: https://api.tuteliq.ai description: Production server - url: http://localhost:3000 description: Development server security: - bearerAuth: [] - apiKeyHeader: [] tags: - name: Safety description: >- Core detection endpoints for all nine KOSA harm categories. Supports text, voice, and image input with age-calibrated severity scoring. - name: Fraud description: >- Financial and social fraud detection — social engineering, app fraud, romance scams, and money mule recruitment. Identifies tactics targeting minors and vulnerable users with evidence-based scoring. - name: Safety Extended description: >- Extended safety detection — gambling harm, coercive control, vulnerability exploitation with cross-endpoint modifiers, and radicalisation. Requires Indie tier or above. - name: Analyse description: >- Multi-endpoint analysis. Fan-out a single text to up to 10 detection endpoints in parallel with aggregated results, vulnerability modifier support, and per-endpoint breakdowns. - name: Analysis description: >- Emotional intelligence endpoints. Analyze conversations for dominant emotions, sentiment trends (improving/stable/worsening), and early indicators of depression or anxiety. Designed to surface mental health risks before they escalate. - name: Guidance description: >- Post-detection action plans tailored by audience. Generate age-appropriate guidance for children, parents, or platform trust & safety teams — complete with reading-level calibration and tone adjustment. Goes beyond "here's a risk score" to answer "what do we do about it?" - name: Reports description: >- Professional incident report generation for schools, counselors, and moderators. Converts raw conversation data into structured reports with risk levels, categorized findings, and recommended next steps — ready for handoff to human reviewers. - name: Batch description: >- Analyze up to 50 items in a single request with optional parallel processing. Supports all analysis types (bullying, grooming, unsafe, emotions). Built for production pipelines that need to process backlogs or moderate content in bulk. - name: Webhooks description: >- Real-time notification endpoints for receiving alerts when critical incidents are detected. Full CRUD management with HMAC-SHA256 signed payloads, automatic retry on failure, secret regeneration, and test delivery — everything you need for production event-driven architectures. - name: Usage description: >- API usage tracking, quota monitoring, and rate limit status. View daily summaries, historical trends, per-tool breakdowns, and monthly billing period usage. Includes upgrade recommendations when approaching limits. - name: Policy description: >- Customize detection behavior for your use case. Configure sensitivity thresholds, category weights, and moderation rules without changing your integration code. - name: Pricing description: >- Public pricing plan information. Browse available tiers, features, and limits. The public endpoint requires no authentication; detailed plan info requires an API key. - name: Account description: >- GDPR-compliant account data management. Exercise the Right to Erasure (Article 17), Right to Data Portability (Article 20), and Right to Rectification (Article 16). Manage consent records and access your full audit trail. Available to all tiers — privacy is not a premium feature. - name: Compliance description: >- Public transparency endpoints for GDPR compliance. Machine-readable Data Processing Agreement (DPA), current sub-processor list, and data retention schedules. No authentication required — anyone can verify our data practices. - name: Admin description: >- Administrative endpoints for breach management and data retention. Log, track, and manage data breach incidents with full audit trails and notification status tracking. Trigger manual data retention cleanup when needed. - name: Health description: >- Health check and monitoring endpoints. Liveness and readiness probes for Kubernetes/Cloud Run, full dependency health checks, and detailed component status for debugging. - name: Status description: >- Public API status and uptime monitoring. Component-level health (API, database, cache, AI engine), uptime percentages, and an embeddable status page. Use /status/ping for external monitoring services like UptimeRobot. externalDocs: description: KOSA Compliance Documentation url: https://tuteliq.ai/docs/kosa-compliance paths: /api/v1/fraud/app-fraud: post: tags: - Fraud summary: Detect app fraud and financial scam patterns description: >- Analyzes text content for app fraud indicators including payment coercion, account takeover, safe account scams, invoice fraud, impersonation, investment pressure, and emotional financial exploitation. requestBody: content: application/json: schema: type: object required: - text properties: text: type: string maxLength: 10000 description: The text content to analyze context: type: object properties: language: type: string description: Language code (e.g., "en"). Auto-detected if omitted. age_group: type: string description: Age group (e.g., "13-15") ageGroup: type: string description: Age group (camelCase alias, e.g., "under 18") platform: type: string description: Platform name (e.g., "Discord", "Telegram") country: type: string description: >- ISO 3166-1 alpha-2 country code (e.g., "GB", "US", "SE") for geo-localised helpline data. Falls back to user profile country if omitted. conversation_history: type: array maxItems: 100 items: type: object required: - role - text properties: role: type: string description: >- Role of the sender (e.g., "user", "contact", "adult", "child") text: type: string maxLength: 10000 description: Message text timestamp: type: string description: ISO 8601 timestamp of the message (optional) description: Conversation history for context-aware analysis options: type: object properties: include_evidence: type: boolean default: true description: Include evidence excerpts in response support_threshold: type: string enum: - low - medium - high - critical default: high description: >- Minimum severity level to include crisis support resources. Defaults to "high". Note: "critical" severity always includes support resources regardless of this setting. verdict_only: type: boolean default: false description: >- Fast mode: omit the per-message `message_analysis` array from the response. All other fields are unchanged. Cuts output length (and therefore latency) significantly on multi-turn input. support_threshold: type: string enum: - low - medium - high - critical description: >- Top-level alias for options.support_threshold. Minimum severity to show crisis support resources (default: high). Critical always shows. include_evidence: type: boolean description: >- Top-level alias for options.include_evidence. When false, the `evidence` array is omitted from the response. Default: true. continuation_token: type: string description: >- Opaque, signed token returned by a previous call to this endpoint. Pass it back here to continue the analysis with prior context — no need to re-send conversation_history. The token IS the state; we store nothing. reset_conversation: type: boolean description: >- When true, discard any continuation_token and treat this call as the first turn of a new conversation. message_id: type: string maxLength: 128 description: >- Optional customer-side identifier for this turn. If provided, evidence pointers in the continuation_token will reference this id so you can map detections back to your own messages. If omitted we use a deterministic short hash of the text. bypass_cache: type: boolean description: >- When true, skip the verdict cache for both read and write — the request runs a fresh evaluation and the result is not stored. Default is false. Use this for forensic re-tests, regression probes, or any workflow where you need a guaranteed fresh evaluation. The cache key is a SHA-256 of the input bytes (one-way; we never store the content itself); cached verdicts expire after 1 hour. external_id: type: string maxLength: 255 description: >- Your unique identifier (e.g. message ID, content ID) for correlating Tuteliq results with your own system. Echoed back in the response and included in webhook payloads so you can match alerts to the original content. customer_id: type: string maxLength: 255 description: >- Your end-customer identifier for multi-tenant / B2B2C scenarios. If you serve multiple customers (schools, apps, brands) from a single API key, set this to route webhook alerts to the correct customer. Echoed back in the response and included in webhook payloads as "customerId". metadata: type: object additionalProperties: true maxProperties: 20 description: >- Arbitrary key-value pairs for additional context (e.g. { "channel": "discord", "region": "eu" }). Stored with the detection result, echoed in the response, and included in webhook payloads. Maximum 20 properties. incident_moderation_enabled: type: boolean description: >- Per-call override of your account incident logging setting. When set, it takes precedence for THIS request: true forces the incident to be persisted, false suppresses persistence. Omit to use your account default (which itself defaults to enabled). Useful to suppress logging for test traffic or to opt specific calls in or out. required: true responses: '200': description: Default Response content: application/json: schema: type: object properties: endpoint: type: string description: The detection endpoint that produced this result detected: type: boolean description: >- A signal was observed at ANY severity (including low / monitor cases). For production branching prefer `recommended_action` (`flag_for_moderator` / `immediate_intervention` indicate action required). severity: type: number description: Severity score (0.0-1.0) confidence: type: number description: Model confidence in the classification (0.0-1.0) risk_score: type: number description: Age-adjusted risk score (0.0-1.0) level: type: string enum: - none - low - medium - high - critical description: Human-readable severity level categories: type: array items: type: object properties: tag: type: string description: Category identifier (e.g., "URGENCY_FABRICATION") label: type: string description: Human-readable category label confidence: type: number description: Confidence for this category (0.0-1.0) description: Detected categories with confidence scores evidence: type: array items: type: object properties: text: type: string description: Evidence excerpt from the input tactic: type: string description: The tactic or indicator this evidence relates to weight: type: number description: Evidence weight (0.0-1.0) description: Evidence excerpts supporting the detection age_calibration: type: object properties: applied: type: boolean age_group: type: string multiplier: type: number recommended_action: type: string description: Recommended action to take rationale: type: string description: Explanation of the detection result message_analysis: type: array items: type: object properties: message_index: type: number description: >- Index of the message in the conversation history (1-based) risk_score: type: number description: Risk score for this individual message (0.0-1.0) flags: type: array items: type: string description: Tactics or indicators detected in this message summary: type: string description: >- Brief explanation of this message's risk contribution description: >- Per-message risk breakdown (only present when conversation_history is provided) language: type: string description: Language code used for analysis language_status: type: string enum: - stable - beta description: Language support maturity credits_used: type: number description: Credits consumed by this request processing_time_ms: type: number description: Processing time in milliseconds continuation_token: type: string description: >- Opaque, signed token carrying derived analysis state. Pass it back on the next call to continue the conversation without re-sending history. Server stores nothing — the token IS the state. continuation_expires_at: type: string description: >- ISO 8601 timestamp at which the continuation_token expires (24h default). state_source: type: string enum: - token - fresh - reset description: >- How the prior analysis state was sourced for this call: "token" (decoded from continuation_token), "fresh" (no prior state), "reset" (reset_conversation forced a fresh start). external_id: type: string description: Echo of the external_id you provided in the request customer_id: type: string description: Echo of the customer_id you provided in the request metadata: type: object additionalProperties: true description: Echo of the metadata you provided in the request support: type: object description: >- Country-specific crisis helplines and response guidance (only for high/critical severity) properties: country: type: string country_name: type: string emergency_number: type: string helplines: type: array items: type: object properties: name: type: string number: type: string description: type: string category: type: string available: type: string response_guide: type: object properties: category: type: string immediateActions: type: array items: type: string resources: type: array items: type: object properties: name: type: string description: type: string url: type: string components: securitySchemes: bearerAuth: type: http scheme: bearer description: API key as Bearer token apiKeyHeader: type: apiKey in: header name: x-api-key description: API key in header ````