A WireMock simulation of Plaid's REST API — covering Trust Index scoring, risk-event ingestion and lookup, Protect reports, and user insights.
A shared instance of this template runs on a public endpoint — call it right now from curl, an SDK, or an AI agent. Responses are fixed examples and behavior can't be changed; rate limits apply.
Jump to the endpoints ↓Run this template as a mock API in WireMock Cloud for a private instance you control — edit stubs, add stateful scenarios, use dynamic response templating, and inspect requests in the log.
Open in WireMock Cloud (free) →Live sandbox · no signup, no API key
A running WireMock Cloud instance of this template, callable right now from a terminal, a script, or an AI agent.
Endpoints
POST Create - /protect/event/send
curl -s -X POST 'https://lo2q6.wiremockapi.cloud/protect/event/send' \
-H 'Content-Type: application/json' \
-d '{}'POST Get - /protect/event/get
curl -s -X POST 'https://lo2q6.wiremockapi.cloud/protect/event/get' \
-H 'Content-Type: application/json' \
-d '{}'POST Static - /protect/report/create
curl -s -X POST 'https://lo2q6.wiremockapi.cloud/protect/report/create' \
-H 'Content-Type: application/json' \
-d '{}'Spec catalog — The Plaid API (2020-09-14_1.688.6) · 5 endpoints
| Method | Path | Summary |
|---|---|---|
| POST | /protect/compute | Compute Protect Trust Index Score |
| POST | /protect/event/get | Get information about a user event |
| POST | /protect/event/send | Send a new event to enrich user data |
| POST | /protect/report/create | Create a Protect report |
| POST | /protect/user/insights/get | Get Protect user insights |
Unauthenticated WireMock Cloud demo sandbox for Plaid — not an official Plaid sandbox, and it returns simulated example data only.
Protect is Plaid's session-risk product, and its sandbox centers on a Trust Index of 86 that arrives dressed differently per route: /protect/compute reports it under the ti-link-session-2.0 model above ten dotted-path fraud attributes — email history of 7.03 years, twelve linked social networks, no MFA challenge, one connected bank — while the event routes score it as trust_index.2.0.0 with device-and-connection and bank-account-insights subscores of 87 and 85. Event ingestion keeps a registry: /protect/event/send mints a fresh event id per call and /protect/event/get echoes ids it recognizes, while /protect/user/insights/get wraps the canonical scored event in a per-user envelope for the read-latest path.
The compute route and the event routes model different Protect calls, and each carries its own model string — ti-link-session-2.0 on compute, trust_index.2.0.0 on events. Assertions should pin the model per route rather than expecting one global constant, which also mirrors production, where model versions advance independently.
Not on this instance. An id the registry knows comes back echoed in its scored body; an id it doesn't triggers a fallback stub serving the same body under the canonical ptevt_-prefixed id. Existence checks therefore can't lean on an error response here — compare the returned id against the one requested when a test needs to prove registration.
They're feature-store coordinates — link_session.*, session.*, and user.pi.* paths naming each signal's provenance, from frozen-account counts to SSN quality. Rules engines that key on these exact strings can evaluate against the fixture block, and the mixed value types — booleans, integers, a fractional year count — keep parsers honest about typing.
In Beacon, Plaid's cross-member fraud consortium — the Beacon template — where the question is whether a person left fraud behind at another company. Protect scores the session in front of you right now; the two products bracket onboarding risk from opposite sides, and their sandboxes pair the same way.
Vendor names identify APIs represented by WireMock template sources. This page does not imply vendor endorsement, certification, partnership, or official integration status.