> For the complete documentation index, see [llms.txt](https://docs.facephi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.facephi.com/docs.facephi-en/rest-api/midapi-v2/security-compliance/injection-attack-detection.md).

# Injection Attack Detection (IAD)

Service that analyzes the capture and determines whether the video flow was injected instead of coming from the device camera.

Accepts the binary inline or by reference to the asset `TOKEN_BIN_IAD`. A single asset slot, interpreted according to `source`.

### Endpoint

```
POST /behavioral/iad
```

### Headers

| Name              | Type   | Required    | Description                                                                                                                                                             |
| ----------------- | ------ | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Authorization** | string | **Yes**     | consumer Token in the format `Bearer <token>`. See [Authentication](/docs.facephi-en/rest-api/midapi-v2/autenticacion.md).                                              |
| **consumer-id**   | string | **Yes**     | Consumer identifier.                                                                                                                                                    |
| **operation-id**  | string | Conditional | Identifier of the operation to which the referenced assets belong. Required when `source` is `FILE_KEY`. See [Storage](/docs.facephi-en/rest-api/midapi-v2/storage.md). |

### Request body

**Content-Type:** `application/json`

#### Parameters

| Parameter | Type   | Required | Description                                                                                                                                                           |
| --------- | ------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `source`  | string | **Yes**  | Mode in which the assets are provided: `FILE_KEY` for stored asset keys, `FILE` for content in Base64. See [Storage](/docs.facephi-en/rest-api/midapi-v2/storage.md). |
| `file`    | string | **Yes**  | IAD capture: asset key `TOKEN_BIN_IAD` or the binary in Base64.                                                                                                       |

#### Request example

```json
{
  "source": "FILE_KEY",
  "file": "0192a3f4-7b21-7c44-9e1a-3f5b8c2d1e04/TOKEN_BIN_IAD"
}
```

### Responses

#### `200` Success

#### Response parameters

| Parameter               | Type   | Description                                                                 |
| ----------------------- | ------ | --------------------------------------------------------------------------- |
| `consumerId`            | string | Identifier of the consumer that made the call.                              |
| `transactionId`         | string | Transaction identifier.                                                     |
| `timestamp`             | string | Response timestamp in format **ISO 8601**.                                  |
| `message`               | string | Descriptive field for the result of the service execution.                  |
| `livenessResult`        | string | Result of the liveness check: `LIVE`, `NO_LIVE` or `ERROR`.                 |
| `captureLivenessResult` | string | Result of the Injection Attack Detection: `NO_ATTACK`, `ATTACK` or `ERROR`. |
| `extractedImage`        | string | Best image extracted from the capture, in Base64.                           |
| `description`           | string | Details of the analysis performed.                                          |

{% hint style="info" %}
When storing a `TOKEN_BIN_IAD` with [Save Asset](/docs.facephi-en/rest-api/midapi-v2/storage/save-asset.md) the context is also available `TOKEN_BEST_IMAGE` of the same operation, so that a single call leaves the IAD and selfie assets ready.
{% endhint %}

#### Other responses

| Code  | Description                                                                                                                                                                                                                                                                                                                                             |
| ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `400` | Required field missing or unsupported value; missing header `operation-id` with references; or a key does not have the form `{operationId}/{CONTEXTO}` or declares a context that the slot does not support.                                                                                                                                            |
| `403` | The consumer is not provisioned with the service `CAPTURE_LIVENESS`.                                                                                                                                                                                                                                                                                    |
| `404` | The operation declared in `operation-id` does not exist or belongs to another consumer.                                                                                                                                                                                                                                                                 |
| `409` | A referenced asset contains content already processed in another operation.                                                                                                                                                                                                                                                                             |
| `410` | The operation declared in `operation-id` has expired.                                                                                                                                                                                                                                                                                                   |
| `422` | A key names an operation different from the one declared in `operation-id`, or the context has no stored asset.                                                                                                                                                                                                                                         |
| `429` | The consumer has exceeded its request rate limit, or a referenced asset has exhausted its invocation budget on this Endpoint. In the first case the response includes `Retry-After`, `X-RateLimit-Limit` and `X-RateLimit-Burst`, and waiting resolves it; in the second it does not. The underlying service is not invoked and the call is not billed. |

The body of an error response has the form described in [MIDAPI v2](/docs.facephi-en/rest-api/midapi-v2.md#respuestas-de-error).