API Reference

The FraudDetect API checks a customer's COD delivery history across all five major Bangladeshi couriers — Steadfast, Pathao, RedX, Paperfly, and Carrybee — and returns an aggregated success/cancel score in a single HTTP request. Use it to flag risky orders before dispatch.

From zero to your first fraud check in under five minutes.

curl -X POST https://connect.chowdhury.bd/api/v1/check \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"phone":"01711223344"}'

Every request must include your API key in the X-Api-Key request header. There is no OAuth or session-based authentication — the key itself is the credential.

curl -X POST https://connect.chowdhury.bd/api/v1/check \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"phone":"01711223344"}'

The API currently exposes a single endpoint. All requests go to the base URLhttps://connect.chowdhury.bd/api.

The request body must be JSON with Content-Type: application/json.

# Minimal
curl -X POST https://connect.chowdhury.bd/api/v1/check \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"phone":"01711223344"}'

A successful 200 OK response contains a top-level object with one key per courier and an aggregate summary. Couriers with no data for the phone number return zero counts — they are never omitted from the response.

{
  "steadfast": {
    "success": 3,
    "cancel":  1,
    "total":   4
  },
  "pathao": {
    "success": 5,
    "cancel":  2,
    "total":   7
  },
  "redx": {
    "success": 20,
    "cancel":  5,
    "total":   25
  },
  "paperfly": {
    "success": 0,
    "cancel":  0,
    "total":   1
  },
  "carrybee": {
    "success":     10,
    "cancel":      0,
    "total":       10,
    "fraud_count": 0
  },
  "aggregate": {
    "total_success":    38,
    "total_cancel":     8,
    "total_deliveries": 47,
    "success_ratio":    80.85,
    "cancel_ratio":     17.02,
    "verdict": {
      "level":    "good",
      "title":    "Looks Good",
      "subtitle": "80.85% success across 47 orders. Good track record for COD."
    }
  }
}

Production-ready examples in all major languages. Each snippet reads the API key from an environment variable (FRAUDDETECT_API_KEY), handles errors, and prints the fraud score.

Basic check

curl -X POST https://connect.chowdhury.bd/api/v1/check \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"phone":"01711223344"}'

#!/bin/bash
# Retry with exponential back-off on 429
MAX_RETRIES=3
DELAY=1

for i in $(seq 1 $MAX_RETRIES); do
  STATUS=$(curl -s -o /tmp/fd_resp.json -w "%{http_code}" \
    -X POST https://connect.chowdhury.bd/api/v1/check \
    -H "X-Api-Key: $FRAUDDETECT_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{"phone":"01711223344"}')

  if [ "$STATUS" -eq 200 ]; then
    cat /tmp/fd_resp.json
    exit 0
  elif [ "$STATUS" -eq 429 ]; then
    echo "Rate limited, waiting ${DELAY}s..."
    sleep $DELAY
    DELAY=$((DELAY * 2))
  else
    echo "Error: HTTP $STATUS"
    cat /tmp/fd_resp.json
    exit 1
  fi
done
echo "Exceeded retry limit"
exit 1

success_ratio is the single most useful field for deciding whether to fulfil a COD order. It represents what percentage of this customer's past orders across all five couriers were successfully delivered.

const { aggregate } = result;

function getRiskLevel(aggregate) {
  const { total_deliveries, success_ratio, cancel_ratio } = aggregate;

  if (total_deliveries === 0) return 'new_customer';  // no history

  // Low sample size — be less aggressive
  if (total_deliveries < 3) {
    return cancel_ratio > 66 ? 'high_risk' : 'low_sample';
  }

  if (success_ratio >= 80) return 'safe';
  if (success_ratio >= 50) return 'medium_risk';
  return 'high_risk';
}

console.log(getRiskLevel(aggregate)); // 'safe' | 'medium_risk' | 'high_risk' | ...

The phone field must be an 11-digit Bangladeshi mobile number in local format — no country code prefix.

function normalizePhone(input) {
  let phone = input.trim().replace(/\s+/g, '');
  if (phone.startsWith('+88')) phone = phone.slice(3);
  if (phone.startsWith('88') && phone.length === 13) phone = phone.slice(2);
  if (!/^01[0-9]{9}$/.test(phone)) throw new Error('Invalid phone number');
  return phone;
}

normalizePhone('+8801711223344'); // '01711223344'
normalizePhone('01711223344');   // '01711223344'

Each API key is rate-limited to protect the service and ensure fair usage.

async function checkPhoneWithRetry(phone, maxRetries = 3) {
  let delay = 1000; // 1 second

  for (let attempt = 1; attempt <= maxRetries; attempt++) {
    const res = await fetch('https://connect.chowdhury.bd/api/v1/check', {
      method: 'POST',
      headers: {
        'X-Api-Key': process.env.FRAUDDETECT_API_KEY,
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({ phone }),
    });

    if (res.ok) return res.json();

    if (res.status === 429 && attempt < maxRetries) {
      console.warn(`Rate limited — retrying in ${delay}ms (attempt ${attempt})`);
      await new Promise(r => setTimeout(r, delay));
      delay *= 2; // exponential back-off
      continue;
    }

    const err = await res.json().catch(() => ({}));
    throw new Error(`API error ${res.status}: ${err.message ?? 'unknown'}`);
  }
  throw new Error('Exceeded maximum retries');
}

All errors return a JSON body with a message field. HTTP status codes follow standard semantics.

{
  "message": "Unauthenticated."
}

# or for validation errors:
{
  "message": "The phone field is required.",
  "errors": {
    "phone": ["The phone field is required."]
  }
}