Account Security Response · Registry

Operations

The contract defines what each operation means. A trusted connector maps it to the service’s existing operations; the email supplies no credential destination or execution endpoint.

Report unrecognized activity

Record that the recipient reports this event as unrecognized, without executing account remediation or making a verified fraud assertion.

Operation ID: report-unrecognized
Bindings: Connected service operation · Experimental capability
Effects: protection · state
Exact terms: Required

Capability scope: protective-report. Maximum lifetime: 72 hours, bounded by the message’s expiry.

This operation takes no additional input.

reported: The service recorded the protective report; no account remediation is implied.

Requirements

The event MUST be a concrete event in the addressed principal's service account. The terms version MUST bind that account, event identifier, occurrence time, activity description, and presented device or location information.
The report MUST be recorded as the recipient's unverified protective signal. It MUST NOT claim that fraud occurred or that a device or location was verified merely because the recipient submitted the report.
The report MUST NOT by itself lock or delete the account, revoke sessions or credentials, change recovery settings, transfer assets, disclose protected data, or execute another consequential action. Any such response requires a separate authenticated service process and its own authorization.
The contract MUST NOT offer a recognize, authorize-login, or approve-device operation. Recognizing an event is not authorization for a new session.
For capability use, the event report MUST expire within 259200 seconds of issuedAt and no later than expiresAt. A copied capability can submit only the same report for the same event. It cannot supply a message or identify another event.
The email SHOULD minimize device and location information. The human route MUST authenticate the principal before disclosing protected event details beyond the minimal email preview.

Details schema

This schema constrains the description’s details. The Core supplies the common fields and processing requirements.

View complete JSON Schema

JSON Schema 2020-12

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "account",
    "event"
  ],
  "properties": {
    "account": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "id",
        "label"
      ],
      "properties": {
        "id": {
          "type": "string",
          "minLength": 1,
          "format": "uri",
          "maxLength": 2048
        },
        "label": {
          "type": "string",
          "minLength": 1,
          "maxLength": 2048
        }
      }
    },
    "event": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "id",
        "occurredAt",
        "activity"
      ],
      "properties": {
        "id": {
          "type": "string",
          "minLength": 1,
          "format": "uri",
          "maxLength": 2048
        },
        "occurredAt": {
          "type": "string",
          "minLength": 1,
          "format": "date-time",
          "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}Z$"
        },
        "activity": {
          "type": "string",
          "minLength": 1,
          "maxLength": 2048
        },
        "device": {
          "type": "string",
          "minLength": 1,
          "maxLength": 2048
        },
        "location": {
          "type": "string",
          "minLength": 1,
          "maxLength": 2048
        }
      }
    }
  }
}

Review a sign-in from a new device

An illustrative description using this exact contract. Example service addresses and digests do not identify a live integration.

View complete MAP description

MAP description

{
  "@context": "https://mailschema.org/contexts/map-0.3.jsonld",
  "@type": "MailAction",
  "profile": "https://mailschema.org/profiles/map/0.3",
  "type": {
    "id": "https://mailschema.org/types/account-security-response",
    "version": "0.1",
    "contractDigest": "sha-256:ec7c85eb9415914a59be29496f6b50ea77839a579420155f17b39a5968a4e611"
  },
  "@id": "urn:uuid:0199a6c2-4b1e-7c3a-9d2e-5f8a1b2c3d43",
  "issuedAt": "2026-10-02T08:00:00Z",
  "expiresAt": "2026-10-03T08:00:00Z",
  "inLanguage": "en",
  "service": {
    "id": "https://service.example",
    "tenant": "urn:example:tenant:7"
  },
  "recipient": "owner@example.net",
  "subject": {
    "id": "urn:example:event:23",
    "title": "Review a sign-in from a new device"
  },
  "terms": {
    "id": "urn:example:security-alert:s23",
    "version": "s23-r1"
  },
  "human": {
    "url": "https://service.example/security/s23"
  },
  "details": {
    "account": {
      "id": "urn:example:account:7",
      "label": "Example account"
    },
    "event": {
      "id": "urn:example:event:23",
      "occurredAt": "2026-10-02T07:50:00Z",
      "activity": "Sign-in from a new device",
      "device": "Example browser"
    }
  },
  "operations": [
    {
      "id": "report-unrecognized",
      "capability": {
        "url": "https://service.example/c/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
      }
    }
  ]
}

Contract identity

https://mailschema.org/types/account-security-response · version 0.1

The canonical digest binds the whole contract, including its requirements and operation semantics. Registry listing grants no authority to perform an operation.

sha-256:ec7c85eb9415914a59be29496f6b50ea77839a579420155f17b39a5968a4e611

Machine-readable catalogue →

Implementations

No service support is listed for this contract version yet.

List service support →