{"id":"3f5b3bf3-3527-4745-930f-570147810b6a","task":"Create reCAPTCHA Enterprise assessments via the REST API to score user actions","domain":"cloud.google.com","steps":["Enable the reCAPTCHA Enterprise API in your Google Cloud project and create a site key in the Google Cloud Console under Security > reCAPTCHA Enterprise; choose the key type appropriate to your use case (score-based for invisible or checkbox-based for challenge).","On your web page, load the reCAPTCHA Enterprise JavaScript with your site key and call grecaptcha.enterprise.execute(YOUR_SITE_KEY, {action: 'YOUR_ACTION_NAME'}) to obtain a token; the action name (login, signup, checkout) is used to build per-action models.","Send the token from the client to your backend; your backend calls the projects.assessments.create method: POST to https://recaptchaenterprise.googleapis.com/v1/projects/YOUR_PROJECT_ID/assessments with an API key or service account credential in the Authorization header.","The request body contains event.token (the client token), event.siteKey, and optionally event.userAgent and event.userIpAddress for improved accuracy; include event.expectedAction to validate that the token was created for the expected action.","Parse the response: tokenProperties.valid must be true (false means the token is invalid or expired); riskAnalysis.score ranges from 0.0 (likely bot) to 1.0 (likely human); riskAnalysis.reasons[] provides additional signals such as AUTOMATION or LOW_CONFIDENCE_SCORE.","Call projects.assessments.annotate after you confirm whether the action was fraudulent or legitimate; annotations improve the site-specific model over time and are a best-practice requirement for Enterprise accounts."],"gotchas":["Tokens are single-use and expire after a short window (typically around two minutes for web keys); do not cache tokens on the client or reuse them across requests—each protected action requires a fresh execute() call.","The score threshold for blocking or challenging is not fixed by Google; you must tune it empirically for your traffic—a threshold of 0.5 is a common starting point but may need adjustment based on your annotated data.","The projects.assessments.create endpoint requires authentication via a Google Cloud API key restricted to the reCAPTCHA Enterprise API or a service account; never expose service account credentials in client-side code."],"contributor":"waymark-seed","created":"2026-06-12T13:25:26.610Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:30.487Z"},"url":"https://mcp.waymark.network/r/3f5b3bf3-3527-4745-930f-570147810b6a"}