POS / Terminal Threat
POS / Terminal Threat is a separate B2B surface of Identity Intelligence for in-store, card-present environments. Instead of a browser or a mobile app, it scores a point-of-sale transaction against the terminal and the cashier behind it — surfacing terminal tampering, anomalous cashier patterns and enrolled-fleet drift.
Like the rest of Identity Intelligence, this is an evidence provider — it returns a risk verdict per terminal transaction and never blocks on its own. It is not the browser device snapshot; the two surfaces are independent.
Configurable — enrollment required. POS threat evaluates against enrolled terminals and cashiers. You must enroll your terminal fleet and configure the surface (an admin step) before evaluations are meaningful. An unenrolled terminal has nothing to score against.
Evaluate a transaction
POST /identity/pos-threat/evaluate — server-side, Authorization: Bearer <secret key>. Pass the terminal, the cashier and the transaction context; get back a risk verdict.
curl https://api-gateway.lunixi.com/api/v1/identity/pos-threat/evaluate \
-H "Authorization: Bearer at_live_5f3e2b1a..." \
-H "Content-Type: application/json" \
-d '{
"subjectType": "pos_transaction",
"subjectId": "sale_123",
"paymentId": "pay_123",
"terminal": {
"globalTerminalId": "term_glob_123",
"merchantTerminalId": "mterm_55",
"terminalSerial": "device-serial-001",
"terminalPlatform": "android_smartpos",
"keyInjectionState": "valid",
"tamperState": "clear",
"secureBootVerified": true
},
"transaction": {
"actionType": "sale",
"amount": 1250.50,
"currency": "TRY",
"entryMode": "chip",
"cvmMethod": "pin"
}
}'The response is the standard gateway envelope; data carries the canonical identityRiskLevel verdict plus reasonCodes and findings scoped to the terminal transaction.
Fleet & decisions
| Method | Path | What it does |
|---|---|---|
GET | /identity/pos-threat/terminals | List your enrolled terminals |
GET | /identity/pos-threat/cashiers | List cashiers seen across the fleet |
GET | /identity/pos-threat/decisions | Recent terminal evaluations |
GET | /identity/pos-threat/decisions/:id | One evaluation in full |
GET | /identity/pos-threat/trace/:traceId/decisions | POS decisions tied to a given trace |
PATCH | /identity/pos-threat/terminals/:key/control-state | Change a terminal's control state (e.g. quarantine or restore an enrolled terminal) |
Notes
- Separate surface. Do not mix POS fields with the browser device snapshot — they are evaluated by different pipelines.
- Enrollment first. Terminals and cashiers must be enrolled and the surface configured before evaluations carry signal.
Next steps
- Mobile Threat — the native app surface
- The Risk Snapshot — the shared verdict fields
- Server-side API & Queries — reading and querying analyses