Rupt.Api 1.0.0

Rupt.Api

Server-side .NET SDK for Rupt. Use it from your backend to fetch evaluations, look up users and their devices, and read challenge details. It signs requests with your project secret, so keep it on the server.

Looking for the browser SDK? That's @ruptjs/client, which fingerprints devices and runs the evaluate flow. This package is the .NET counterpart of @ruptjs/api.

It targets .NET 10 and has no dependencies.

Install

dotnet add package Rupt.Api

Quick start

using Rupt.Api;

var rupt = new RuptApi(Environment.GetEnvironmentVariable("RUPT_SECRET")!);

var evaluation = await rupt.ConsumeEvaluationAsync(evaluationId);
if (evaluation.Verdict == "allow")
{
    // mint the session
}

Get your project secret from the Rupt dashboard.

RuptApi is thread-safe. Create one instance and reuse it for the lifetime of your app, or register it as a singleton:

builder.Services.AddSingleton(new RuptApi(builder.Configuration["Rupt:Secret"]!));

To send requests through an HttpClient you manage (for example one from IHttpClientFactory), pass it as the third constructor argument.

Configuration

var rupt = new RuptApi(secret, new RuptApiOptions
{
    Timeout = TimeSpan.FromSeconds(10),
    Retries = 3,
    MaxRetryDelay = TimeSpan.FromSeconds(5),
});

Methods

GetEvaluationAsync(id)

Fetch the full server-side evaluation payload: verdict, reasons, checks, risks, policy, challenge, fingerprint, user, and geolocation.

var evaluation = await rupt.GetEvaluationAsync(evaluationId);
Console.WriteLine($"{evaluation.Verdict}: {string.Join(", ", evaluation.Reasons)}");

ConsumeEvaluationAsync(id)

Atomically consume a single-use evaluation and get the same payload back with Consumed set. Call this instead of GetEvaluationAsync at the exact moment you mint a session: the first call wins, and a replayed success URL or guessed id throws a RuptApiException with status 409 on every later attempt.

try
{
    var evaluation = await rupt.ConsumeEvaluationAsync(evaluationId);
}
catch (RuptApiException ex) when (ex.StatusCode == 409)
{
    // already consumed: reject the login
}

GetChallengeAsync(id)

Fetch a challenge's public projection: status, channels, reasons, the user binding, and the parent evaluation id.

var challenge = await rupt.GetChallengeAsync(challengeId);

GetUserDevicesAsync(user)

List the devices attached to a user. user is the external id your application evaluates with.

var devices = await rupt.GetUserDevicesAsync(userId);

UpdateUserAsync(user, update)

Update a user's email, phone, metadata, or groups. Only the properties you set are sent; anything left null stays untouched.

await rupt.UpdateUserAsync(userId, new UpdateUserRequest
{
    Email = "new@example.com",
    Groups = [new Group { Id = "team-42", Name = "Team 42" }],
});

Errors

Every method throws a subclass of RuptException:

try
{
    var evaluation = await rupt.GetEvaluationAsync(id);
}
catch (RuptApiException ex) when (ex.StatusCode == 404)
{
    // unknown id, wrong project, or wrong environment
}
catch (RuptNetworkException)
{
    // API unreachable after all retries
}

Every method also takes an optional CancellationToken if you want to cancel a call yourself; caller cancellation surfaces as the usual OperationCanceledException.

License

MIT