> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Configure a Generic API external risk engine

Configure a Generic API external risk engine when your provider supports the IDaaS API. If it does not, use an intermediate proxy server to translate requests between IDaaS and the external risk engine API.

Before you begin, ensure that you know the credentials for your external risk provider.

## Configure a Generic API external risk engine

1. Click Menu icon **>** **Configuration > External Risk Engines**. The **External Risk Engines** page appears.

2. Click **Add** and then select the **Generic API** from the drop-down list. The **Add External Risk Engine** page appears.

3. Enter a **Name** for the external risk engine.

4. Select **Enabled** to enable the external risk engine.

note
You can also enable or disable the external risk engine after you add it from the **External Risk Engines** page.

5. Enter the external risk engine credentials, for example the **Username/Identifier** and **Password**.

6. Under **Attributes**, do the following:

   1. Enter the **URL**.

   2. Enter the **External Risk Provider**.

   3. Enter the **Company ID** provided to you by the external risk engine.

   4. Enter the **Token Expiration** for the token used by the external risk engine.

   5. Select **Fail evaluation when identities do not match** if the user session identity and user identity must be the same.

   note
   For a **Generic API** external risk engine, you must define the base URL where you will deploy your REST service and the risk provider identifier (for example, BioCatch). For more information, see [Integrate a generic API risk engine](/docs/applications-and-sso/identity-as-a-service-integration-guides/integrate-a-generic-api-risk-engine.md).

7. Optional. Add **Rules** as follows:

   1. Click **Add**. The **Add Rule** dialog box appears.

   2. Enter a **Name** for the rule that defines the risk factor.

   3. Select the **Risk Item** from the drop-down list. There are two options:

      - **Risk**: The risk score returned by the external risk provider.
      - **serviceStatus**: This item is available for all external risk engines integrated with IDaaS. It can be used to decide what the system should do when the external risk engine is not available.

      To use this item, create a rule with serviceStatus EQUALS FAILURE. You can then include that rule in a resource rule with other conditions. If external risk evaluation is required to grant access to an application, assign enough risk points to this rule so evaluation moves to the High Risk scenario.

   note
   See your external risk engine documentation for a description of other risk items.

   4. Select the required **Operator** from the drop-down list.

   5. Add a value in the **Value** text box.

   6. Optional: To add more conditions to the rule, do the following:

      1. Click **Add Group**.
      2. Select the **AND** or **OR** operator for each added group expression.
      3. Select the **Risk Item** from the drop-down list.
      4. Select the required **Operator** from the drop-down list.
      5. Add a value in the **Value** text box.

   7. Click **Add**.

   8. Repeat these steps to add more external risk engine rules.

8. Click **Save** to save the external risk engine and return to the **External Risk Engines** page.

### Validate your changes

After you save the external risk engine, verify the following:

1. The external risk engine is listed as **Enabled** on the **External Risk Engines** page.
2. Test requests return the expected **Risk** or **serviceStatus** values.
3. The linked resource rule applies the expected low-, medium-, and high-risk outcomes.