5分钟接入电商订单风控能力

curl -X POST https://api.fengkong.cloud/v1/order/risk-check \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: your_api_key" \
  -H "X-Timestamp: 1709971200" \
  -H "X-Signature: hmac_sha256_signature" \
  -d '{
    "flow_id": "order_risk_v1",
    "request_id": "req_20240309_001",
    "data": {
      "order_id": "ORD20240309001",
      "buyer_id": "B123456",
      "amount": 299.00,
      "item_count": 3,
      "shipping_address": "浙江省杭州市钱塘区白杨街道",
      "buyer_phone": "138****1234",
      "platform": "taobao",
      "payment_method": "alipay"
    }
  }'

import requests
import hmac
import hashlib
import time

API_KEY = "your_api_key"
API_SECRET = "your_api_secret"
BASE_URL = "https://api.fengkong.cloud/v1"

def make_signature(timestamp, body):
    message = f"{timestamp}{body}"
    return hmac.new(
        API_SECRET.encode(),
        message.encode(),
        hashlib.sha256
    ).hexdigest()

timestamp = str(int(time.time()))
payload = {
    "flow_id": "order_risk_v1",
    "request_id": "req_20240309_001",
    "data": {
        "order_id": "ORD20240309001",
        "buyer_id": "B123456",
        "amount": 299.00,
        "item_count": 3,
        "shipping_address": "浙江省杭州市钱塘区白杨街道",
        "buyer_phone": "138****1234",
        "platform": "taobao",
        "payment_method": "alipay"
    }
}

import json
body = json.dumps(payload)
signature = make_signature(timestamp, body)

response = requests.post(
    f"{BASE_URL}/order/risk-check",
    json=payload,
    headers={
        "X-Api-Key": API_KEY,
        "X-Timestamp": timestamp,
        "X-Signature": signature
    }
)

result = response.json()
print(f"风控决策: {result['data']['decision']}")
print(f"风险评分: {result['data']['risk_score']}")
print(f"命中规则: {result['data']['hit_rules']}")

import java.net.http.*;
import java.net.URI;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class FengkongClient {
    private static final String API_KEY = "your_api_key";
    private static final String API_SECRET = "your_api_secret";
    private static final String BASE_URL = "https://api.fengkong.cloud/v1";

    public static void main(String[] args) throws Exception {
        String timestamp = String.valueOf(System.currentTimeMillis() / 1000);
        String body = """
            {
              "flow_id": "order_risk_v1",
              "request_id": "req_20240309_001",
              "data": {
                "order_id": "ORD20240309001",
                "buyer_id": "B123456",
                "amount": 299.00,
                "item_count": 3,
                "shipping_address": "浙江省杭州市钱塘区白杨街道",
                "buyer_phone": "138****1234",
                "platform": "taobao",
                "payment_method": "alipay"
              }
            }
            """;

        String signature = hmacSha256(API_SECRET, timestamp + body);

        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create(BASE_URL + "/order/risk-check"))
            .header("Content-Type", "application/json")
            .header("X-Api-Key", API_KEY)
            .header("X-Timestamp", timestamp)
            .header("X-Signature", signature)
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();

        HttpResponse<String> response = client.send(
            request, HttpResponse.BodyHandlers.ofString()
        );
        System.out.println("Response: " + response.body());
    }

    private static String hmacSha256(String key, String data)
            throws Exception {
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(key.getBytes(), "HmacSHA256"));
        byte[] hash = mac.doFinal(data.getBytes());
        StringBuilder hex = new StringBuilder();
        for (byte b : hash) {
            hex.append(String.format("%02x", b));
        }
        return hex.toString();
    }
}

signature = HMAC-SHA256(api_secret, timestamp + request_body)

其中：
- api_secret: 您的 API Secret（控制台获取，请妥善保管）
- timestamp: X-Timestamp 的值（字符串）
- request_body: 请求体的原始 JSON 字符串
- 输出为十六进制小写字符串

{
  "code": 0,
  "message": "success",
  "request_id": "req_20240309_001",
  "data": {
    "decision": "REVIEW",
    "risk_score": 72,
    "risk_level": "MEDIUM",
    "hit_rules": [
      {"rule_id": "R001", "rule_name": "同一地址24小时内多单", "detail": "该地址24小时内已下3单"},
      {"rule_id": "R015", "rule_name": "新注册账号高额订单", "detail": "账号注册不足7天，订单金额超过200元"}
    ],
    "execution_time_ms": 3,
    "details": {
      "buyer_risk_score": 45,
      "address_risk_score": 68,
      "order_pattern": "suspicious_multi_order"
    }
  }
}

{
  "code": 40101,
  "message": "Invalid API key",
  "request_id": "req_20240309_002"
}