Supported capabilities and activation

Every company uses the same registration and integration workflow. A live production environment and an active customer application are separate facts, and publishing this documentation creates neither.

Production status on 2026-10-17

Surface	Status
Customer console, dash.fingertrackid.com	Live. Named sign-in with mandatory authenticator. Screens read your company’s real data; Ciclo de vida do cliente does not send or read requests yet (contact support) (console screens)
Invitation email	Live. Sent on a best-effort basis when an account is created; the sign-in page’s password recovery is the fallback
Password recovery email	Live. Sent by FingerTrackID from `no-reply@fingertrackid.com`, at most one email per address in each fixed 15-minute window
Managed configuration requests (application, collection setup, server credential, SDK configuration, members)	Live. Submitted from Início, normally approved as soon as they are sent (recorded in the audit trail, and visible to FingerTrackID, which can cancel or reverse them) and then applied automatically
Internal backoffice	Live, for FingerTrackID operators only
Signed assessment API, `POST https://api.fingertrackid.com/v1/assessments`	Live, in shadow mode (since 2026-10-08). Responses are recommendations only; FingerTrackID never blocks, allows or executes anything. Under the current managed production profile, an assessment stored without a browser `event_context_token` is `INCONCLUSIVE` with `trust_score: null` and the managed fallback recommendation, never `COMPLETED`; the call can still end in an operational Problem such as `503`. Your application needs its installed server credential and active admission
Tagged request `event-assessment-request.v1.1`	Live (since 2026-10-13). It is the recommended profile for new integrations (journeys and tags): a v1.1 body with your `tag` is accepted and answered with `event-assessment.v1.1`. The v1 request is unchanged and stays accepted
Action and outcome feedback API	Live with the signed assessment API, on the same signed runtime. It needs the credential permissions `action:write` and `outcome:write`
Web SDK collection	Deployed, only through your company’s registered first-party collection domain, `collect.<your-domain>`, once that domain is active for your application. Its end-to-end operation from a customer page (a collection that becomes a `COMPLETED` event context attached to an assessment) is still being measured. The first latency figures, from one application and a small sample (not an SLA): `getEventContext` on an accepted collection 0.15 s at the median, a collection started at the click 2.6 s at the median (measured in production). The private SDK package and its SHA-256/SHA-512 digests are downloaded in the dash (installation)
Public SDK script distribution (signed script assets served by FingerTrackID)	Not enabled. The private package bundled into your frontend is the only delivery
Outbound assessment webhooks	Not enabled. They need their own endpoint verification, outbound credential and release
Access context in the console (Contexto do acesso)	Live (computed during the assessment since 2026-10-17). The 54 context items are computed inside the assessment, within a short time budget: an item that does not fit stays without data and never deducts, and if the whole step fails, the context is computed after the assessment instead, as before, without an error, and then changes nothing in that access’s score. Context changes the score, the recommendation and the response only through context rules your company made active; otherwise it is informative. The account items need `account_ref`, and an account’s history starts with the first event that carries it (console screens)
Search by your company’s ID in the console (Buscar titular ou conta pelo ID da sua empresa)	Live for Administrador da empresa, Analista de risco and Supervisor de risco: an exact, audited lookup of the accesses your backend sent with one `subject_ref` or `account_ref`. The ID never goes into the page address (console screens)
Company risk rules (off, ghost or active, edited in Configuração de risco)	Live (since 2026-10-13; context rules can be active since 2026-10-17). Any rule, including the 54 context items, can be published as active directly; a ghost rule is computed and recorded but never changes the score. Each context item fires on a ruler your company adjusts, starting from FingerTrackID’s default. Measuring the impact before publishing is optional. Only your company activates a rule; FingerTrackID never does, and while no rule is active every recommendation stays `MONITOR`. Missing evidence, a timeout or a failure never recommend blocking, and a block recommended by your own active rules is still a recommendation your backend executes (console screens)

What each application still needs

A capability being live in production does not activate your application; each application is activated separately:

Capability	Activation requirement for your application
Console access	Provisioned named account, verified email, password, authenticator and current membership. FingerTrackID creates each company and its first administrator; there is no self-service company registration
Configuration requests	The request must reach its completed state; a submitted or approved request is not a created resource
Collection setup	The managed cooperative web observation profile, its detector/policy/admission artifacts applied by the automatic setup steps, your exact owned domain, DNS/TLS proof and native completion
Assessment API	A v1.1 request with your own `tag` (recommended) or a v1 request with one of the journeys `LOGIN`, `WITHDRAWAL`, `TRADE`; installed credential, active admission and an active qualified release/policy
Browser collection	Approved private SDK archive and the exact active first-party host, origin and public key
Missing browser context	`event_context_token: null` is a supported input, not a promise of success, a score or a particular status
Feedback	Credential capabilities `action:write` and `outcome:write`, actually active
Exports and Usage	Current dataset permission; exports are redacted and expire, usage figures are estimates, not invoices
Password recovery	Provider-backed reset; your existing authenticator remains required
Lost authenticator	Separate identity-verified operator recovery; access is blocked first and restored only after a new setup

A credential still waiting for secure installation is not usable. Setup waiting for review is not ready. Valid DNS is not active collection, and an approved policy is not an active policy. Security, independent verifier isolation, technical retention/disposal, restoration and first-party proofs remain required before real data.

Contract and measurement boundaries

Two request profiles share the same route and signature. v1.1 names the moment with your own tag and is the recommended profile for new integrations; v1 keeps exactly LOGIN, WITHDRAWAL and TRADE and remains supported, unchanged. Production accepts both. Every tag is assessed the same way (journeys and tags).
The Web SDK’s private archive delivery does not imply a public npm package or CDN. Script distribution requires a separately approved exact release, path and SRI and is not the standard installation.
There is no assessment retrieval GET; reconciliation uses the same original assessment POST.
A listed signal is not proof of an active detector. Missing, stale or failed evaluation is NOT_EVALUATED, never NOT_DETECTED.
Trust score is an ordered index, not a measured fraud probability. No recommendation executes a customer action. Start in SHADOW and keep your existing decisions during validation.
The managed COOPERATIVE_WEB_SHADOW_V1 setup recommends MONITOR and makes no calibrated fraud-detection claim. New managed server clients are admitted at the standard tier, 5 requests per second with a burst of 10; higher tiers are requested in the console (limits), and larger schema ranges do not promise higher throughput.
Usage estimates are not commercial acceptance, a price, quota, SLA or invoice.
The downloadable OpenAPI contract keeps its historical planned implementation annotation and example server. They are not evidence of live availability or an issued API origin.

Start with onboarding and the developer handoff. Questions: contato@fingertrackid.com.