Risk Assessment (SDK Layer)#

Build RiskAssessmentConfiguration on the main thread — typically in AppDelegate.application(_:didFinishLaunchingWithOptions:) — because UIDevice is main-actor-isolated:

let riskAssessmentConfiguration = RiskAssessmentConfiguration(
    operatingSystemName: UIDevice.current.systemName,
    operatingSystemVersion: UIDevice.current.systemVersion,
    deviceModelName: UIDevice.current.deviceModelName,
    applicatonIdentifier: Bundle.main.bundleIdentifier!
)

let haapiConfiguration = HaapiConfiguration(
    // ...other configuration
    riskAssessmentConfiguration: riskAssessmentConfiguration
)

operatingSystemName — UIDevice.current.systemName returns the system name string (typically "iOS").

operatingSystemVersion — UIDevice.current.systemVersion returns the major.minor.patch string (for example, "17.4.1").

deviceModelName — UIDevice.current.deviceModelName is not a standard UIDevice property; it is a Curity-recommended extension that resolves the machine identifier (for example, "iPhone15,3") to a human-readable model name (for example, "iPhone 14 Pro Max"). If you don’t have that extension, fall back to UIDevice.current.model, which returns the device class ("iPhone", "iPad") — coarser, but informative for the risk-assessment service.

applicatonIdentifier — the app’s bundle identifier (Bundle.main.bundleIdentifier!). The parameter name is misspelled in the SDK (missing the second i in “application”); type it verbatim to compile. The misspelling is preserved for binary compatibility and may be corrected in a future major release.

Pass the Android applicationContext into the configuration from Application.onCreate. The framework reads the context-derived fields internally:

class ClientApplication : Application() {
    lateinit var haapiConfiguration: HaapiConfiguration

    override fun onCreate() {
        super.onCreate()
        haapiConfiguration = HaapiConfiguration(
            // ...other configuration
            applicationContext = applicationContext
        )
    }
}

Internally, the framework reads:

• OS name — always "Android".
• OS version — Build.VERSION.RELEASE (for example, "14").
• Device model — Build.MODEL (for example, "Pixel 7").
• Application identifier — applicationContext.packageName (for example, "com.example.client.app").

The Android API is intentionally narrower than the iOS surface because all four fields are obtainable from the standard Android Context without main-thread restrictions; explicitly passing each one would add no information.

Toggle risk assessment via a single boolean per platform — useRiskAssessmentConfiguration: true — on createIOSConfiguration / createAndroidConfiguration. The native bridge handles the field collection internally using the same UIDevice / Build lookups documented above.

import {
    createIOSConfiguration,
    createAndroidConfiguration,
    noAuthentication,
} from 'identityserver.haapi.reactnative.sdk'

const iosConfig = createIOSConfiguration({
    clientId: 'haapi-ios-client',
    appRedirect: 'app://haapi',
    clientAuthenticationMethodConfiguration: noAuthentication(),
    useRiskAssessmentConfiguration: true,
})

const androidConfig = createAndroidConfiguration({
    clientId: 'haapi-android-client',
    appRedirect: 'app://haapi',
    clientAuthenticationMethodConfig: noAuthentication(),
    useRiskAssessmentConfiguration: true,
})

When the flag is true, the native side constructs a RiskAssessmentConfiguration (iOS) or wires applicationContext into the Android configuration. The host JS side has nothing else to configure — there is no JS-facing field selection.