Build an Explainable Vendor-Risk Gate in Node.js
A vendor signs up with a company domain. Your application wants one fast answer: approve or reject? The network cannot give you that answer. It can give you evidence. In this tutorial, we will call a domain-intelligence API, normalize its response and return one of three application decisions: type Decision = " allow " | " review " | " block " ; The implementation uses registration, DNS, TLS,…
A company wants a simple decision on whether to approve or reject a vendor based on a domain. The system can provide evidence but not a definitive answer. The implementation examines various signals such as registration details, DNS records, TLS certificates, HTTPS reachability, and specific HTTP headers. It does not evaluate the legitimacy of the business or the site's content.
The system has defined boundaries for what it can observe and cannot prove, which should be handled in code reviews and user communications. When calling the domain-intelligence API, a RapidAPI key is stored in the environment, and the exact host is copied from the marketplace snippet. An async function fetches the domain audit with a timeout, returning structured data or an error if the request fails. The external timeout is longer than the audit timeout to ensure a structured failure response.
To normalize the provider's response, only relevant findings are processed. The normalizeAudit function builds an adapter to focus on policy-understood fields. The decision function separate evidence from the decision-making process, allowing for customizable policies on when to allow or block a vendor based on the gathered evidence.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
