Symantec VIP's EvaluateRisk API Latency Observations and Troubleshooting Guidance

Products

• VIP Service

Issue/Introduction

This article addresses scenarios where customers observe latency or delayed response times while invoking the EvaluateRisk API from Symantec VIP User Services. In several instances, the issue is not due to the API processing itself but rather to delays before the request reaches the Intelligent Authentication (IA) component, where the actual risk evaluation logic executes.

Environment

 Symantec VIP 

Cause

The EvaluateRisk API is designed to perform a real-time risk assessment on authentication or transaction events. The API request flow involves two main layers:

1. VIP User Service (VIPUS) — the external-facing service endpoint receiving API calls.
2. Intelligent Authentication (IA) — the internal engine responsible for risk scoring and policy evaluation.

When an EvaluateRisk request is submitted, VIPUS internally forwards the call to IA. The overall latency experienced by the client depends on:

• Client-to-VIPUS network latency
• VIPUS internal processing time
• VIPUS-to-IA communication latency

 

Sample Case Details

In a recent case, a customer reported EvaluateRisk failures due to their API gateway timeout being set to 1 second. Logs indicated:

• VIPUS call start time: 2025-10-17 08:03:59.968
• IA received call: 2025-10-17 08:04:01.077

This shows an ~1100 ms delay before the request reached IA.
The complete EvaluateRisk processing time (VIPUS + IA) was ~1570 ms.

Resolution

Recommendations

1. Increase the API Gateway Timeout

   • The current timeout value of 1 second (or 200 ms in some cases) is too low.
   • Typical EvaluateRisk API responses can range between 200–300 ms, depending on network latency and processing load.
   • Configure a minimum timeout of 3–5 seconds for better reliability.

2. Monitor Network Latency

   • Run connectivity and latency tests between your API Gateway and VIPUS endpoints.
   • Ensure consistent network performance and no packet loss.

3. Check API Request Volume

   • Evaluate if concurrent EvaluateRisk calls are causing overloads or queue delays.

4. Review IA Integration Health

   • Confirm that IA services are healthy and processing requests within normal limits.
   • Contact Broadcom Support if internal latency persists beyond typical thresholds.

 

References

• Symantec VIP Web Services and APIs Documentation
• EvaluateRisk API Reference