Introduction

Base URL: http://localhost

This documentation aims to provide all the information you need to work with our API.

<aside>As you scroll, you'll see code examples for working with the API in different programming languages in the dark area to the right (or as part of the content on mobile).
You can switch the language used with the tabs at the top right (or from the nav menu at the top left on mobile).</aside>

Authenticating requests

To authenticate requests, include an Authorization header with the value "Bearer {YOUR_AUTH_KEY}".

All authenticated endpoints are marked with a requires authentication badge in the documentation below.

You can ask the SOS Golpe support team to generate a token for you.

MED Request Files

API endpoints for managing MED request files

Upload a file or multiple files for a MED request

requires authentication

Example request:

curl --request POST \
    "http://localhost/api/v1/med-requests/20/files" \
    --header "Authorization: Bearer {YOUR_AUTH_KEY}" \
    --header "Content-Type: multipart/form-data" \
    --header "Accept: application/json" \
    --form "type=other"\
    --form "types[]=audio-report"\
    --form "file=@/tmp/phpm8co4po0se338rnskpQ" \
    --form "files[]=@/tmp/phpauurvmp1ik18eYaJkcF"

const url = new URL(
    "http://localhost/api/v1/med-requests/20/files"
);

const headers = {
    "Authorization": "Bearer {YOUR_AUTH_KEY}",
    "Content-Type": "multipart/form-data",
    "Accept": "application/json",
};

const body = new FormData();
body.append('type', 'other');
body.append('types[]', 'audio-report');
body.append('file', document.querySelector('input[name="file"]').files[0]);
body.append('files[]', document.querySelector('input[name="files[]"]').files[0]);

fetch(url, {
    method: "POST",
    headers,
    body,
}).then(response => response.json());

Example response (200):


{
    "data": {
        "id": 28,
        "fraud_detail_id": 70,
        "type": "occurrence-report",
        "path": "eius",
        "url": "https://signed.url?X-Amz-SignedParams=...",
        "metadata": [],
        "validations": {
            "errors": []
        },
        "created_at": "2025-07-21T18:20:53.000000Z",
        "updated_at": "2025-07-21T18:20:53.000000Z"
    }
}

Received response:

Request failed with error:



Tip: Check that you're properly connected to the network.
If you're a maintainer of ths API, verify that your API is running and you've enabled CORS.
You can check the Dev Tools console for debugging information.

Request

POST api/v1/med-requests/{med_request_id}/files

Headers

Authorization

Example: Bearer {YOUR_AUTH_KEY}

Content-Type

Example: multipart/form-data

Accept

Example: application/json

URL Parameters

med_request_id integer

The ID of the med request. Example: 20

med_request integer

The ID of the MED request. Example: 1

Body Parameters

file file optional

This field is required when files is not present. Must be a file. Must not be greater than 10240 kilobytes. Example: /tmp/phpm8co4po0se338rnskpQ

files file[] optional

Must be a file. Must not be greater than 10240 kilobytes.

type string optional

This field is required when types is not present. Example: other

Must be one of:

occurrence-report
audio-report
other

types string[] optional
Must be one of:

occurrence-report
audio-report
other

Update a MED request file

requires authentication

Example request:

curl --request PUT \
    "http://localhost/api/v1/files/16" \
    --header "Authorization: Bearer {YOUR_AUTH_KEY}" \
    --header "Content-Type: multipart/form-data" \
    --header "Accept: application/json" \
    --form "type=occurrence-report"\
    --form "file=@/tmp/phpsugiflpaifmb8GIJnBq"

const url = new URL(
    "http://localhost/api/v1/files/16"
);

const headers = {
    "Authorization": "Bearer {YOUR_AUTH_KEY}",
    "Content-Type": "multipart/form-data",
    "Accept": "application/json",
};

const body = new FormData();
body.append('type', 'occurrence-report');
body.append('file', document.querySelector('input[name="file"]').files[0]);

fetch(url, {
    method: "PUT",
    headers,
    body,
}).then(response => response.json());

Example response (200):


{
    "data": {
        "id": 29,
        "fraud_detail_id": 71,
        "type": "occurrence-report",
        "path": "eius",
        "url": "https://signed.url?X-Amz-SignedParams=...",
        "metadata": [],
        "validations": {
            "errors": []
        },
        "created_at": "2025-07-21T18:20:53.000000Z",
        "updated_at": "2025-07-21T18:20:53.000000Z"
    }
}

Received response:

Request failed with error:



Tip: Check that you're properly connected to the network.
If you're a maintainer of ths API, verify that your API is running and you've enabled CORS.
You can check the Dev Tools console for debugging information.

Request

PUT api/v1/files/{id}

PATCH api/v1/files/{id}

Headers

Authorization

Example: Bearer {YOUR_AUTH_KEY}

Content-Type

Example: multipart/form-data

Accept

Example: application/json

URL Parameters

id integer

The ID of the file. Example: 16

med_request_file integer

The ID of the file. Example: 1

Body Parameters

file file optional

The file to upload (max 10MB). Supported file types: pdf, jpeg, jpg, png, mp3, mp4, wav. Example: /tmp/phpsugiflpaifmb8GIJnBq

type string optional

The type of file. Must be one of: occurrence-report, audio-report, other. Example: occurrence-report

metadata object optional

Optional metadata for the file.

List MED request files.

requires authentication

Example request:

curl --request GET \
    --get "http://localhost/api/v1/files?filters=%7B%22path%22%3A+%22file_path%22%7D&per_page=15&page=1" \
    --header "Authorization: Bearer {YOUR_AUTH_KEY}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"

const url = new URL(
    "http://localhost/api/v1/files"
);

const params = {
    "filters": "{"path": "file_path"}",
    "per_page": "15",
    "page": "1",
};
Object.keys(params)
    .forEach(key => url.searchParams.append(key, params[key]));

const headers = {
    "Authorization": "Bearer {YOUR_AUTH_KEY}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());

Example response (200):


{
    "data": [
        {
            "id": 30,
            "fraud_detail_id": 72,
            "type": "occurrence-report",
            "path": "adipisci",
            "url": "https://signed.url?X-Amz-SignedParams=...",
            "metadata": [],
            "validations": {
                "errors": []
            },
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        },
        {
            "id": 31,
            "fraud_detail_id": 73,
            "type": "other",
            "path": "odio",
            "url": "https://signed.url?X-Amz-SignedParams=...",
            "metadata": [],
            "validations": {
                "errors": []
            },
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        }
    ]
}

Received response:

Request failed with error:



Tip: Check that you're properly connected to the network.
If you're a maintainer of ths API, verify that your API is running and you've enabled CORS.
You can check the Dev Tools console for debugging information.

Request

GET api/v1/files

Headers

Authorization

Example: Bearer {YOUR_AUTH_KEY}

Content-Type

Example: application/json

Accept

Example: application/json

Query Parameters

filters string optional

Filter requests by various criteria. Example: {"path": "file_path"}

per_page integer optional

The number of results per page. Example: 15

page integer optional

The page number. Example: 1

MED request management

APIs for managing MED requests

List MED requests.

requires authentication

Example request:

curl --request GET \
    --get "http://localhost/api/v1/med-requests?filters=%7B%22origin_customer_id%22%3A+1%2C+%22origin_bank_id%22%3A+1%7D&per_page=15&page=1" \
    --header "Authorization: Bearer {YOUR_AUTH_KEY}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"

const url = new URL(
    "http://localhost/api/v1/med-requests"
);

const params = {
    "filters": "{"origin_customer_id": 1, "origin_bank_id": 1}",
    "per_page": "15",
    "page": "1",
};
Object.keys(params)
    .forEach(key => url.searchParams.append(key, params[key]));

const headers = {
    "Authorization": "Bearer {YOUR_AUTH_KEY}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());

Example response (200):


{
    "data": [
        {
            "id": 49,
            "transaction_id": "E2E1757680",
            "transaction_amount": "9736.93",
            "transaction_time": "2025-07-11T18:20:53.000000Z",
            "transaction_description": "Omnis autem et consequatur.",
            "reporter_client_name": "Schultz Group",
            "reporter_client_id": "7059720839",
            "contested_participant_id": null,
            "counterparty_client_name": "Fahey, Cartwright and Balistreri",
            "counterparty_client_id": "0261536693",
            "counterparty_client_key": "ac9e0973-adfe-32df-ade4-9b9752e8c6ad",
            "protocol_id": "62b13b25-7887-3a6d-933d-9f63b76646b2",
            "pix_auto": null,
            "ispb": "04415490",
            "client_id": null,
            "client_since": "2025-07-21T18:20:53.000000Z",
            "client_birth": null,
            "autofraud_risk": null,
            "latest_status": "requested",
            "latest_refund_status": "pending",
            "latest_refund_status_reason": null,
            "situation_type": null,
            "report_merge": false,
            "category": "scam",
            "sub_category": "scam_buy-hire",
            "tactic": "scam_debt-charge_restore-credit",
            "scam_checks": [
                "scam-check_delivered-false-item"
            ],
            "channels": [
                "scammer_phone"
            ],
            "items": [
                "item_buy-other",
                "item_developer"
            ],
            "origin_channel": "whatsapp-unknown",
            "is_over_60_optin": false,
            "report": "Voluptate accusamus ut et recusandae. Rerum ex repellendus assumenda et. Ab reiciendis quia perspiciatis deserunt ducimus corrupti.",
            "med_info_optin": false,
            "share_true_info_optin": false,
            "dashboard_url": "https://cronin.com/incidunt-iure-odit-et-et-modi-ipsum.html",
            "report_details": "Caso de Desconhecido. Relato e B.O. em: https://cronin.com/incidunt-iure-odit-et-et-modi-ipsum.html.",
            "qualification_errors": [],
            "ispb_data": {
                "id": 167,
                "name": "Leuschke-Feeney Bank",
                "compe": "227",
                "ispb": "04415490",
                "created_at": "2025-07-21T18:20:53.000000Z",
                "updated_at": "2025-07-21T18:20:53.000000Z"
            },
            "reporter": {
                "id": 78,
                "bank_id": 168,
                "document": "7059720839",
                "document_type": "cpf",
                "name": "Schultz Group",
                "created_at": "2025-07-21T18:20:53.000000Z",
                "updated_at": "2025-07-21T18:20:53.000000Z"
            },
            "counterparty": {
                "id": 79,
                "bank_id": 170,
                "document": "0261536693",
                "document_type": "cnpj",
                "name": "Fahey, Cartwright and Balistreri",
                "created_at": "2025-07-21T18:20:53.000000Z",
                "updated_at": "2025-07-21T18:20:53.000000Z"
            },
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        },
        {
            "id": 50,
            "transaction_id": "E2E2213199",
            "transaction_amount": "5814.67",
            "transaction_time": "2025-07-11T18:20:53.000000Z",
            "transaction_description": "Rem est esse sint aut.",
            "reporter_client_name": "Bernhard, Tromp and Baumbach",
            "reporter_client_id": "4159682090",
            "contested_participant_id": null,
            "counterparty_client_name": "Marquardt-Klocko",
            "counterparty_client_id": "8764418754",
            "counterparty_client_key": "8c352249-2535-3e45-8de4-d6620458a778",
            "protocol_id": "efb45134-b05b-36f6-b20a-f93610c7e46f",
            "pix_auto": null,
            "ispb": "41312753",
            "client_id": null,
            "client_since": "2025-07-21T18:20:53.000000Z",
            "client_birth": null,
            "autofraud_risk": null,
            "latest_status": "requested",
            "latest_refund_status": "pending",
            "latest_refund_status_reason": null,
            "situation_type": null,
            "report_merge": false,
            "category": "coercion",
            "sub_category": "other_commercial-dispute-buy",
            "tactic": "scam_get-item_money",
            "scam_checks": [
                "scam-check_delay-site-down"
            ],
            "channels": [
                "scammer_youtube"
            ],
            "items": [
                "item_phone-accessory",
                "item_hire-other",
                "item_developer"
            ],
            "origin_channel": "scammer_landline",
            "is_over_60_optin": true,
            "report": "Eaque neque sit sunt. Accusantium odit ut perspiciatis. Dolorem aut quis ut dolores omnis. Earum consequatur asperiores est vel id aut officiis eos.",
            "med_info_optin": false,
            "share_true_info_optin": false,
            "dashboard_url": "http://www.robel.com/corporis-nesciunt-ut-ratione-iure-impedit-molestiae",
            "report_details": "Caso de Desconhecido. Relato e B.O. em: http://www.robel.com/corporis-nesciunt-ut-ratione-iure-impedit-molestiae.",
            "qualification_errors": [],
            "ispb_data": {
                "id": 171,
                "name": "Bauch Group Bank",
                "compe": "045",
                "ispb": "41312753",
                "created_at": "2025-07-21T18:20:53.000000Z",
                "updated_at": "2025-07-21T18:20:53.000000Z"
            },
            "reporter": {
                "id": 80,
                "bank_id": 172,
                "document": "4159682090",
                "document_type": "cpf",
                "name": "Bernhard, Tromp and Baumbach",
                "created_at": "2025-07-21T18:20:53.000000Z",
                "updated_at": "2025-07-21T18:20:53.000000Z"
            },
            "counterparty": {
                "id": 81,
                "bank_id": 174,
                "document": "8764418754",
                "document_type": "cpf",
                "name": "Marquardt-Klocko",
                "created_at": "2025-07-21T18:20:53.000000Z",
                "updated_at": "2025-07-21T18:20:53.000000Z"
            },
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        }
    ],
    "links": {
        "first": "/?page=1",
        "last": null,
        "prev": null,
        "next": null
    },
    "meta": {
        "current_page": 1,
        "from": 1,
        "path": "/",
        "per_page": "15",
        "to": 2
    }
}

Received response:

Request failed with error:



Tip: Check that you're properly connected to the network.
If you're a maintainer of ths API, verify that your API is running and you've enabled CORS.
You can check the Dev Tools console for debugging information.

Request

GET api/v1/med-requests

Headers

Authorization

Example: Bearer {YOUR_AUTH_KEY}

Content-Type

Example: application/json

Accept

Example: application/json

Query Parameters

filters string optional

Filter requests by various criteria. Example: {"origin_customer_id": 1, "origin_bank_id": 1}

per_page integer optional

The number of results per page. Example: 15

page integer optional

The page number. Example: 1

Create a new MED request.

requires authentication

Example request:

curl --request POST \
    "http://localhost/api/v1/med-requests" \
    --header "Authorization: Bearer {YOUR_AUTH_KEY}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"transaction_id\": \"architecto\",
    \"transaction_amount\": 22,
    \"transaction_time\": \"2051-05-26\",
    \"transaction_description\": \"architecto\",
    \"reporter_client_name\": \"architecto\",
    \"reporter_client_id\": 4326.41688,
    \"contested_participant_id\": \"architecto\",
    \"counterparty_client_name\": \"architecto\",
    \"counterparty_client_id\": 4326.41688,
    \"counterparty_client_key\": \"architecto\",
    \"protocol_id\": \"architecto\",
    \"pix_auto\": true,
    \"ispb\": 4326.41688,
    \"client_id\": \"architecto\",
    \"client_since\": \"2025-07-21\",
    \"client_birth\": \"2025-07-21\",
    \"autofraud_risk\": false
}"

const url = new URL(
    "http://localhost/api/v1/med-requests"
);

const headers = {
    "Authorization": "Bearer {YOUR_AUTH_KEY}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "transaction_id": "architecto",
    "transaction_amount": 22,
    "transaction_time": "2051-05-26",
    "transaction_description": "architecto",
    "reporter_client_name": "architecto",
    "reporter_client_id": 4326.41688,
    "contested_participant_id": "architecto",
    "counterparty_client_name": "architecto",
    "counterparty_client_id": 4326.41688,
    "counterparty_client_key": "architecto",
    "protocol_id": "architecto",
    "pix_auto": true,
    "ispb": 4326.41688,
    "client_id": "architecto",
    "client_since": "2025-07-21",
    "client_birth": "2025-07-21",
    "autofraud_risk": false
};

fetch(url, {
    method: "POST",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());

Example response (200):


{
    "data": {
        "url": null
    }
}

Example response (422):


{
    "message": "The given data was invalid.",
    "errors": {
        "transaction_id": [
            "required",
            "not-a-string"
        ],
        "transaction_amount": [
            "required",
            "not-a-number",
            "value-too-low"
        ],
        "transaction_time": [
            "required",
            "not-a-date",
            "wrong-date-format",
            "too-old"
        ]
    }
}

Received response:

Request failed with error:



Tip: Check that you're properly connected to the network.
If you're a maintainer of ths API, verify that your API is running and you've enabled CORS.
You can check the Dev Tools console for debugging information.

Request

POST api/v1/med-requests

Headers

Authorization

Example: Bearer {YOUR_AUTH_KEY}

Content-Type

Example: application/json

Accept

Example: application/json

Body Parameters

transaction_id string

Example: architecto

transaction_amount number

Must be at least 1. Example: 22

transaction_time string

Must be a valid date. Must be a valid date in the format Y-m-d H:i:s. Must be a valid date. Must be a date after 2025-05-02. Example: 2051-05-26

transaction_description string

Example: architecto

reporter_client_name string

Example: architecto

reporter_client_id number

Example: 4326.41688

contested_participant_id string

Example: architecto

counterparty_client_name string

Example: architecto

counterparty_client_id number

Example: 4326.41688

counterparty_client_key string

Example: architecto

protocol_id string

Example: architecto

pix_auto boolean optional true false

Example: true

ispb number optional

Example: 4326.41688

client_id string optional

Example: architecto

client_since string optional

Must be a valid date in the format Y-m-d. Example: 2025-07-21

client_birth string optional

Must be a valid date in the format Y-m-d. Example: 2025-07-21

autofraud_risk boolean optional true false

Example: false

Response

Response Fields

errors object

* string[]

List of possible error slugs: required, not-a-string, not-a-number, value-too-low, not-a-date, wrong-date-format, too-old, wrong-format, invalid-value

Display a specific MED request.

requires authentication

Example request:

curl --request GET \
    --get "http://localhost/api/v1/med-requests/20?load[]=scamReport&load[]=taxonomy" \
    --header "Authorization: Bearer {YOUR_AUTH_KEY}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"load\": [
        \"architecto\"
    ]
}"

const url = new URL(
    "http://localhost/api/v1/med-requests/20"
);

const params = {
    "load[0]": "scamReport",
    "load[1]": "taxonomy",
};
Object.keys(params)
    .forEach(key => url.searchParams.append(key, params[key]));

const headers = {
    "Authorization": "Bearer {YOUR_AUTH_KEY}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "load": [
        "architecto"
    ]
};

fetch(url, {
    method: "GET",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());

Example response (200):


{
    "data": {
        "id": 51,
        "transaction_id": "E2E5449171",
        "transaction_amount": "2449.73",
        "transaction_time": "2025-07-11T18:20:53.000000Z",
        "transaction_description": "Deserunt aut ab provident perspiciatis quo omnis nostrum.",
        "reporter_client_name": "Leuschke, Bauch and Fritsch",
        "reporter_client_id": "0951073658",
        "contested_participant_id": null,
        "counterparty_client_name": "Raynor Ltd",
        "counterparty_client_id": "9444597233",
        "counterparty_client_key": "bfc53181-d647-36b2-9080-f9c2b76006f4",
        "protocol_id": "5d093e7f-5aae-3aa3-bece-f6e784dcbd67",
        "pix_auto": null,
        "ispb": "21988862",
        "client_id": null,
        "client_since": "2025-07-21T18:20:53.000000Z",
        "client_birth": null,
        "autofraud_risk": null,
        "latest_status": "requested",
        "latest_refund_status": "pending",
        "latest_refund_status_reason": null,
        "situation_type": null,
        "report_merge": false,
        "category": "other",
        "sub_category": "fraudulent_access_known-person",
        "tactic": "scam_get-money_damages-compensation",
        "scam_checks": [
            "scam-check_delivered-false-item"
        ],
        "channels": [
            "phone-unknown",
            "discord"
        ],
        "items": [
            "item_health-service"
        ],
        "origin_channel": "call-known",
        "is_over_60_optin": false,
        "report": "Dignissimos neque blanditiis odio. Excepturi doloribus delectus fugit qui repudiandae laboriosam. Alias tenetur ratione nemo voluptate accusamus ut et. Modi rerum ex repellendus assumenda et tenetur.",
        "med_info_optin": false,
        "share_true_info_optin": false,
        "dashboard_url": "http://www.okuneva.com/fugiat-sunt-nihil-accusantium-harum-mollitia.html",
        "report_details": "Caso de Desconhecido. Relato e B.O. em: http://www.okuneva.com/fugiat-sunt-nihil-accusantium-harum-mollitia.html.",
        "qualification_errors": [],
        "ispb_data": {
            "id": 175,
            "name": "Hauck-Leuschke Bank",
            "compe": "279",
            "ispb": "21988862",
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        },
        "reporter": {
            "id": 82,
            "bank_id": 176,
            "document": "0951073658",
            "document_type": "cpf",
            "name": "Leuschke, Bauch and Fritsch",
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        },
        "counterparty": {
            "id": 83,
            "bank_id": 178,
            "document": "9444597233",
            "document_type": "cnpj",
            "name": "Raynor Ltd",
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        },
        "created_at": "2025-07-21T18:20:53.000000Z",
        "updated_at": "2025-07-21T18:20:53.000000Z"
    }
}

Received response:

Request failed with error:



Tip: Check that you're properly connected to the network.
If you're a maintainer of ths API, verify that your API is running and you've enabled CORS.
You can check the Dev Tools console for debugging information.

Request

GET api/v1/med-requests/{id}

Headers

Authorization

Example: Bearer {YOUR_AUTH_KEY}

Content-Type

Example: application/json

Accept

Example: application/json

URL Parameters

id integer

The ID of the med request. Example: 20

Query Parameters

load string[] optional

Optional. Additional relationships to load.

Body Parameters

load string[] optional

Update a MED request.

requires authentication

Example request:

curl --request PUT \
    "http://localhost/api/v1/med-requests/20" \
    --header "Authorization: Bearer {YOUR_AUTH_KEY}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"latest_status\": \"acknowledged\",
    \"latest_status_reason\": \"commercial-disagreement\",
    \"latest_refund_status\": \"rejected\",
    \"latest_refund_status_reason\": \"account-closure\",
    \"situation_type\": \"ACCOUNT_TAKEOVER\",
    \"category\": \"coercion\",
    \"sub_category\": \"scam_get-profit\",
    \"tactic\": \"scam_debt-charge_utilities\",
    \"scam_checks\": [
        \"scam-check_delivered-none\"
    ],
    \"channels\": [
        {
            \"scammer_email\": \"email@provider.com\"
        },
        {
            \"scammer_phone\": \"5511987654433\"
        }
    ],
    \"origin_channel\": \"facebook-msg-known-hacked\",
    \"med_info_optin\": false,
    \"share_true_info_optin\": false,
    \"is_over_60_optin\": false,
    \"report\": \"architecto\",
    \"items\": [
        \"item_health-service\"
    ],
    \"dashboard_url\": \"http:\\/\\/bailey.com\\/\"
}"

const url = new URL(
    "http://localhost/api/v1/med-requests/20"
);

const headers = {
    "Authorization": "Bearer {YOUR_AUTH_KEY}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "latest_status": "acknowledged",
    "latest_status_reason": "commercial-disagreement",
    "latest_refund_status": "rejected",
    "latest_refund_status_reason": "account-closure",
    "situation_type": "ACCOUNT_TAKEOVER",
    "category": "coercion",
    "sub_category": "scam_get-profit",
    "tactic": "scam_debt-charge_utilities",
    "scam_checks": [
        "scam-check_delivered-none"
    ],
    "channels": [
        {
            "scammer_email": "email@provider.com"
        },
        {
            "scammer_phone": "5511987654433"
        }
    ],
    "origin_channel": "facebook-msg-known-hacked",
    "med_info_optin": false,
    "share_true_info_optin": false,
    "is_over_60_optin": false,
    "report": "architecto",
    "items": [
        "item_health-service"
    ],
    "dashboard_url": "http:\/\/bailey.com\/"
};

fetch(url, {
    method: "PUT",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());

Example response (200):


{
    "data": {
        "id": 52,
        "transaction_id": "E2E9026316",
        "transaction_amount": "2250.00",
        "transaction_time": "2025-07-11T18:20:53.000000Z",
        "transaction_description": "Perspiciatis quo omnis nostrum aut adipisci quidem nostrum qui.",
        "reporter_client_name": "McLaughlin and Sons",
        "reporter_client_id": "5671733515",
        "contested_participant_id": null,
        "counterparty_client_name": "Wisoky-Kshlerin",
        "counterparty_client_id": "3608007829",
        "counterparty_client_key": "0a9446d3-4070-3757-8926-67a9d2adbc0e",
        "protocol_id": "c68e0767-6220-31fb-a489-61093ff79529",
        "pix_auto": null,
        "ispb": "95107365",
        "client_id": null,
        "client_since": "2025-07-21T18:20:53.000000Z",
        "client_birth": null,
        "autofraud_risk": null,
        "latest_status": "requested",
        "latest_refund_status": "pending",
        "latest_refund_status_reason": null,
        "situation_type": null,
        "report_merge": false,
        "category": "operational_flaw",
        "sub_category": "scam_job",
        "tactic": "scam_get-item_donation",
        "scam_checks": [
            "scam-check_delivered-heavy-item"
        ],
        "channels": [
            "app-travel",
            "search-engine"
        ],
        "items": [
            "item_computer"
        ],
        "origin_channel": "app-job",
        "is_over_60_optin": false,
        "report": "Veritatis excepturi doloribus delectus fugit. Repudiandae laboriosam est alias tenetur ratione. Voluptate accusamus ut et recusandae. Rerum ex repellendus assumenda et.",
        "med_info_optin": false,
        "share_true_info_optin": false,
        "dashboard_url": "http://www.okon.com/accusantium-harum-mollitia-modi-deserunt-aut-ab",
        "report_details": "Caso de Desconhecido. Relato e B.O. em: http://www.okon.com/accusantium-harum-mollitia-modi-deserunt-aut-ab.",
        "qualification_errors": [],
        "ispb_data": {
            "id": 179,
            "name": "Leuschke, Bauch and Fritsch Bank",
            "compe": "058",
            "ispb": "95107365",
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        },
        "reporter": {
            "id": 84,
            "bank_id": 180,
            "document": "5671733515",
            "document_type": "cpf",
            "name": "McLaughlin and Sons",
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        },
        "counterparty": {
            "id": 85,
            "bank_id": 182,
            "document": "3608007829",
            "document_type": "cnpj",
            "name": "Wisoky-Kshlerin",
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        },
        "created_at": "2025-07-21T18:20:53.000000Z",
        "updated_at": "2025-07-21T18:20:53.000000Z"
    }
}

Received response:

Request failed with error:



Tip: Check that you're properly connected to the network.
If you're a maintainer of ths API, verify that your API is running and you've enabled CORS.
You can check the Dev Tools console for debugging information.

Request

PUT api/v1/med-requests/{id}

PATCH api/v1/med-requests/{id}

Headers

Authorization

Example: Bearer {YOUR_AUTH_KEY}

Content-Type

Example: application/json

Accept

Example: application/json

URL Parameters

id integer

The ID of the med request. Example: 20

Body Parameters

latest_status string optional

Example: acknowledged

Must be one of:

draft
denied
requested
open
acknowledged
accepted
rejected
cancelled

latest_status_reason string optional

Example: commercial-disagreement

Must be one of:

commercial-disagreement
invalid-payment-date

latest_refund_status string optional

Example: rejected

Must be one of:

pending
open
totally-accepted
partially-accepted
rejected
cancelled

latest_refund_status_reason string optional

Example: account-closure

Must be one of:

no-balance
account-closure
invalid-request
other

situation_type string optional

Example: ACCOUNT_TAKEOVER

Must be one of:

SCAM
ACCOUNT_TAKEOVER
COERCION
FRAUDULENT_ACCESS
OTHER
UNKNOWN

category string optional

Example: coercion

Must be one of:

fraudulent_access
account_takeover
coercion
scam
other
operational_flaw

sub_category string optional

Example: scam_get-profit

Must be one of:

fraudulent_access_fake-bank-site
fraudulent_access_ask-for-code
fraudulent_access_ask-for-password
fraudulent_access_known-person
fraudulent_access_stolen-lost-bank-card
fraudulent_access_other
account_takeover_stolen-lost-computer
account_takeover_stolen-lost-mobile
account_takeover_sim-swap
account_takeover_destination_swap
account_takeover_virus
account_takeover_atm
account_takeover_other
coercion_kidnapping-3rd-person
coercion_kidnapping-1st-person
coercion_physical-inperson
coercion_blackmail
coercion_other
scam_bank-alert
scam_job
scam_get-profit
scam_get-item
scam_get-money
scam_debt-charge
scam_buy-hire
scam_rental-reservation
scam_help
scam_blackmail
scam_sell
other_pix-error-destination
other_pix-error-value
other_commercial-dispute-hire
other_commercial-dispute-buy
other_right-of-withdrawal
other
operational_flaw

tactic string optional

Example: scam_debt-charge_utilities

Must be one of:

scam_bank-alert_unknown-pix
scam_bank-alert_unknown-purchase
scam_bank-alert_unknown-loan
scam_bank-alert_security-update
scam_bank-alert_loyalty-miles
scam_bank-alert_unknown-debt
scam_bank-alert_social-registration-update
scam_bank-alert_other
scam_bank-alert_redeem-prize
scam_bank-alert_unknown-account-access
scam_job_tasks
scam_job_certificate-full-time
scam_job_supplies-full-time
scam_job_admission-exam-full-time
scam_job_registration-fee-full-time
scam_job_equipment-contractor
scam_job_registration-fee-contractor
scam_job_other
scam_get-profit_withdraw-fee
scam_get-profit_buy-in-fee
scam_get-profit_multiply-pix
scam_get-profit_invest-stock
scam_get-profit_invest-cripto
scam_get-profit_invest-item
scam_get-profit_other
scam_get-item_donation
scam_get-item_money
scam_get-item_quiz
scam_get-item_draw
scam_get-item_gift
scam_get-item_other
scam_get-money_loan
scam_get-money_financing
scam_get-money_credit-card
scam_get-money_consortium
scam_get-money_credit-limit
scam_get-money_amounts-receivable
scam_get-money_welfare-grant
scam_get-money_retirement-savings
scam_get-money_payout-lawyer
scam_get-money_damages-compensation
scam_get-money_other
scam_get-money_loyalty-miles
scam_debt-charge_restore-credit
scam_debt-charge_debt-settlement
scam_debt-charge_mortgage-settlement
scam_debt-charge_loan-settlement
scam_debt-charge_credit-card
scam_debt-charge_shipping-fee
scam_debt-charge_enrollment
scam_debt-charge_vehicle-property-tax
scam_debt-charge_utilities
scam_debt-charge_business-taxes
scam_debt-charge_personal-taxes
scam_debt-charge_other
scam_pay-pos-change-card
scam_pay-pos-change-value
scam_buy-other_order-canceled
scam_buy-bid_auction
scam_hire
scam_buy-other_b2c-store-cloned
scam_buy-other_b2c-store-unkown
scam_buy-used_middleman
scam_buy-used
scam_buy-other_c2c-seller
scam_buy-hire_other
scam_buy-other_shipping-fee
scam_rental-reservation_short-stay
scam_rental-reservation_residential
scam_rental-reservation_commercial
scam_rental-reservation_hospitality
scam_rental-reservation_vehicle
scam_rental-reservation_other
scam_help_3rd-party-payment
scam_help_catfish
scam_help_medical-expenses
scam_help_donation
scam_help_wrong-pix
scam_help_other
scam_blackmail_kidnapping
scam_blackmail_nudes-leak
scam_blackmail_religious
scam_blackmail_cheater
scam_blackmail_sex-work
scam_blackmail_crime-charge
scam_blackmail_hacked-account
scam_blackmail_stolen-item
scam_blackmail_death
scam_blackmail_other
scam_sell_platform-fee
scam_sell_shipping
scam_sell_paralel-deal
scam_sell_middleman
scam_seller_other

scam_checks string[] optional
Must be one of:

scam-check_service-none
scam-check_service-partial
scam-check_service-quality
scam-check_delivered-none
scam-check_delivered-heavy-item
scam-check_delivered-false-item
scam-check_delivered-wrong-item
scam-check_delivered-quality
scam-check_contact-not-yet
scam-check_contact-stalling
scam-check_contact-blocked
scam-check_contact-no-answer
scam-check_contact-not-found
scam-check_delay-no-tracking
scam-check_delay-broken-tracking
scam-check_delay-no-import-fee
scam-check_delay-online-reviews
scam-check_delay-site-down
scam-check_delay-company-disclaimer
scam-check_delay-none

channels object[] optional

optional An array where each object represents a channel used in the fraud. Each object must contain a single key-value pair, where the key is a valid channel type and the value is a optional string.

origin_channel string optional

Example: facebook-msg-known-hacked

Must be one of:

scammer_phone
scammer_landline
scammer_youtube
scammer_social-media
scammer_app-gaming
scammer_marketplace
scammer_site
scammer_email
scammer_sms
inperson
mail
sms
phone-known
phone-unknown
landline-known
landline-unknown
call-known
call-unknown
email
whatsapp-group
whatsapp-unknown
whatsapp-known
telegram
instagram-msg-known-hacked
instagram-msg-unknown
instagram-feed-influencer-hacked
instagram-feed-known-hacked
instagram-feed-unknown
instagram-feed-fake-ad
facebook-marketplace
facebook-groups
facebook-msg-known-hacked
facebook-msg-unknown
facebook-feed-influencer-hacked
facebook-feed-known-hacked
facebook-feed-unknown
facebook-feed-fake-ad
tiktok
linkedin
youtube
discord
search-engine
advertising
app-gaming
app-dating
app-travel
app-real-state
app-reseller-used
app-reseller-new
app-job
app-sex-content
other

med_info_optin boolean optional true false

Example: false

share_true_info_optin boolean optional true false

Example: false

is_over_60_optin boolean optional true false

Example: false

report string optional

Example: architecto

items string[] optional
Must be one of:

item_house
item_baby-item
item_religious-item
item_selfcare
item_medicine
item_construction
item_clothes
item_food-beverage
item_auto-parts
item_vehicle
item_animal
item_iphone
item_mobile
item_phone-accessory
item_videogame
item_computer
item_online-account
item_gift-card
item_online-subscription
item_online-sex-content
item_real-state
item_education
item_ticket-show
item_ticket-travel
item_ride
item_lottery-game
item_phone-unlock
item_account-recover
item_technical-assistance
item_maintainance
item_transportation
item_forwarder
item_sex
item_lawyer
item_finance-adviser
item_developer
item_spiritual
item_wellness
item_detective
item_marketing
item_health-service
item_taxes
item_buy-other
item_hire-other

merge_with string optional

The id of an existing record in the med_requests table.

dashboard_url string optional

Must be a valid URL. Example: http://bailey.com/

Notification Content Management

APIs for managing notification content for webhook events

Remove the specified notification content.

requires authentication

Example request:

curl --request DELETE \
    "http://localhost/api/v1/notification-contents/16" \
    --header "Authorization: Bearer {YOUR_AUTH_KEY}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"

const url = new URL(
    "http://localhost/api/v1/notification-contents/16"
);

const headers = {
    "Authorization": "Bearer {YOUR_AUTH_KEY}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

fetch(url, {
    method: "DELETE",
    headers,
}).then(response => response.json());

Example response (204):

Empty response

Example response (404):


{
    "message": "Notification content not found."
}

Received response:

Request failed with error:



Tip: Check that you're properly connected to the network.
If you're a maintainer of ths API, verify that your API is running and you've enabled CORS.
You can check the Dev Tools console for debugging information.

Request

DELETE api/v1/notification-contents/{id}

Headers

Authorization

Example: Bearer {YOUR_AUTH_KEY}

Content-Type

Example: application/json

Accept

Example: application/json

URL Parameters

id integer

The ID of the notification content. Example: 16

Taxonomy management

APIs for managing taxonomy categories

List taxonomy categories.

requires authentication

Example request:

curl --request GET \
    --get "http://localhost/api/v1/taxonomy/categories?filters=%7B%22slug%22%3A+%22category-slug%22%7D&per_page=15&page=1" \
    --header "Authorization: Bearer {YOUR_AUTH_KEY}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"

const url = new URL(
    "http://localhost/api/v1/taxonomy/categories"
);

const params = {
    "filters": "{"slug": "category-slug"}",
    "per_page": "15",
    "page": "1",
};
Object.keys(params)
    .forEach(key => url.searchParams.append(key, params[key]));

const headers = {
    "Authorization": "Bearer {YOUR_AUTH_KEY}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());

Example response (200):


{
    "data": [
        {
            "id": 39,
            "slug": "adipisci-quidem-nostrum",
            "name": "qui commodi incidunt",
            "order": 63,
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        },
        {
            "id": 40,
            "slug": "et-et",
            "name": "modi ipsum nostrum",
            "order": 59,
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        }
    ]
}

Received response:

Request failed with error:



Tip: Check that you're properly connected to the network.
If you're a maintainer of ths API, verify that your API is running and you've enabled CORS.
You can check the Dev Tools console for debugging information.

Request

GET api/v1/taxonomy/categories

Headers

Authorization

Example: Bearer {YOUR_AUTH_KEY}

Content-Type

Example: application/json

Accept

Example: application/json

Query Parameters

filters string optional

Filter requests by various criteria. Example: {"slug": "category-slug"}

per_page integer optional

The number of results per page. Example: 15

page integer optional

The page number. Example: 1

List taxonomy subcategories.

requires authentication

Example request:

curl --request GET \
    --get "http://localhost/api/v1/taxonomy/subcategories?filters=%7B%22slug%22%3A+%22subcategory-slug%22%7D&per_page=15&page=1" \
    --header "Authorization: Bearer {YOUR_AUTH_KEY}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"

const url = new URL(
    "http://localhost/api/v1/taxonomy/subcategories"
);

const params = {
    "filters": "{"slug": "subcategory-slug"}",
    "per_page": "15",
    "page": "1",
};
Object.keys(params)
    .forEach(key => url.searchParams.append(key, params[key]));

const headers = {
    "Authorization": "Bearer {YOUR_AUTH_KEY}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());

Example response (200):


{
    "data": [
        {
            "id": 58,
            "taxonomy_category_id": 41,
            "slug": "commodi-incidunt",
            "name": "iure odit et",
            "order": 45,
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        },
        {
            "id": 59,
            "taxonomy_category_id": 42,
            "slug": "enim-non-facere",
            "name": "tempora ex voluptatem",
            "order": 28,
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        }
    ]
}

Received response:

Request failed with error:



Tip: Check that you're properly connected to the network.
If you're a maintainer of ths API, verify that your API is running and you've enabled CORS.
You can check the Dev Tools console for debugging information.

Request

GET api/v1/taxonomy/subcategories

Headers

Authorization

Example: Bearer {YOUR_AUTH_KEY}

Content-Type

Example: application/json

Accept

Example: application/json

Query Parameters

filters string optional

Filter requests by various criteria. Example: {"slug": "subcategory-slug"}

per_page integer optional

The number of results per page. Example: 15

page integer optional

The page number. Example: 1

List taxonomy channels.

requires authentication

Example request:

curl --request GET \
    --get "http://localhost/api/v1/taxonomy/channels?filters=%7B%22slug%22%3A+%22channel-slug%22%7D&per_page=15&page=1" \
    --header "Authorization: Bearer {YOUR_AUTH_KEY}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"

const url = new URL(
    "http://localhost/api/v1/taxonomy/channels"
);

const params = {
    "filters": "{"slug": "channel-slug"}",
    "per_page": "15",
    "page": "1",
};
Object.keys(params)
    .forEach(key => url.searchParams.append(key, params[key]));

const headers = {
    "Authorization": "Bearer {YOUR_AUTH_KEY}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());

Example response (200):


{
    "data": [
        {
            "id": 51,
            "slug": "odit-et",
            "name": "et modi ipsum",
            "order": 66,
            "group_slug": "autem-et-consequatur",
            "group_name": "aut dolores",
            "type_slug": "non-facere",
            "type_name": "tempora",
            "owner_slug": "voluptatem-laboriosam",
            "owner_name": "Schultz Group",
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        },
        {
            "id": 52,
            "slug": "fugit-deleniti-distinctio",
            "name": "eum doloremque id",
            "order": 89,
            "group_slug": "aliquam-veniam-corporis",
            "group_name": "dolorem mollitia",
            "type_slug": "nemo",
            "type_name": "odit",
            "owner_slug": "officia-est-dignissimos",
            "owner_name": "Ward-O'Connell",
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        }
    ]
}

Received response:

Request failed with error:



Tip: Check that you're properly connected to the network.
If you're a maintainer of ths API, verify that your API is running and you've enabled CORS.
You can check the Dev Tools console for debugging information.

Request

GET api/v1/taxonomy/channels

Headers

Authorization

Example: Bearer {YOUR_AUTH_KEY}

Content-Type

Example: application/json

Accept

Example: application/json

Query Parameters

filters string optional

Filter requests by various criteria. Example: {"slug": "channel-slug"}

per_page integer optional

The number of results per page. Example: 15

page integer optional

The page number. Example: 1

List taxonomy items.

requires authentication

Example request:

curl --request GET \
    --get "http://localhost/api/v1/taxonomy/items?filters=%7B%22slug%22%3A+%22item-slug%22%7D&per_page=15&page=1" \
    --header "Authorization: Bearer {YOUR_AUTH_KEY}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"

const url = new URL(
    "http://localhost/api/v1/taxonomy/items"
);

const params = {
    "filters": "{"slug": "item-slug"}",
    "per_page": "15",
    "page": "1",
};
Object.keys(params)
    .forEach(key => url.searchParams.append(key, params[key]));

const headers = {
    "Authorization": "Bearer {YOUR_AUTH_KEY}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());

Example response (200):


{
    "data": [
        {
            "id": 57,
            "slug": "modi-ipsum",
            "name": "nostrum omnis autem",
            "type": "buy",
            "order": 68,
            "is_physical_item": false,
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        },
        {
            "id": 58,
            "slug": "ex-voluptatem",
            "name": "laboriosam praesentium quis",
            "type": "hire",
            "order": 84,
            "is_physical_item": true,
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        }
    ]
}

Received response:

Request failed with error:



Tip: Check that you're properly connected to the network.
If you're a maintainer of ths API, verify that your API is running and you've enabled CORS.
You can check the Dev Tools console for debugging information.

Request

GET api/v1/taxonomy/items

Headers

Authorization

Example: Bearer {YOUR_AUTH_KEY}

Content-Type

Example: application/json

Accept

Example: application/json

Query Parameters

filters string optional

Filter requests by various criteria. Example: {"slug": "item-slug"}

per_page integer optional

The number of results per page. Example: 15

page integer optional

The page number. Example: 1

List taxonomy scam checks.

requires authentication

Example request:

curl --request GET \
    --get "http://localhost/api/v1/taxonomy/scam-checks?filters=%7B%22slug%22%3A+%22scam-check-slug%22%7D&per_page=15&page=1" \
    --header "Authorization: Bearer {YOUR_AUTH_KEY}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"

const url = new URL(
    "http://localhost/api/v1/taxonomy/scam-checks"
);

const params = {
    "filters": "{"slug": "scam-check-slug"}",
    "per_page": "15",
    "page": "1",
};
Object.keys(params)
    .forEach(key => url.searchParams.append(key, params[key]));

const headers = {
    "Authorization": "Bearer {YOUR_AUTH_KEY}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());

Example response (200):


{
    "data": [
        {
            "id": 32,
            "slug": "omnis-autem",
            "name": "et consequatur aut",
            "type": "hire",
            "order": 33,
            "level": 2,
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        },
        {
            "id": 33,
            "slug": "tempora-ex",
            "name": "voluptatem laboriosam praesentium",
            "type": "hire",
            "order": 24,
            "level": 4,
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        }
    ]
}

Received response:

Request failed with error:



Tip: Check that you're properly connected to the network.
If you're a maintainer of ths API, verify that your API is running and you've enabled CORS.
You can check the Dev Tools console for debugging information.

Request

GET api/v1/taxonomy/scam-checks

Headers

Authorization

Example: Bearer {YOUR_AUTH_KEY}

Content-Type

Example: application/json

Accept

Example: application/json

Query Parameters

filters string optional

Filter requests by various criteria. Example: {"slug": "scam-check-slug"}

per_page integer optional

The number of results per page. Example: 15

page integer optional

The page number. Example: 1

List taxonomy tactics.

requires authentication

Example request:

curl --request GET \
    --get "http://localhost/api/v1/taxonomy/tactics?filters=%7B%22slug%22%3A+%22tactic-slug%22%7D&per_page=15&page=1" \
    --header "Authorization: Bearer {YOUR_AUTH_KEY}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"

const url = new URL(
    "http://localhost/api/v1/taxonomy/tactics"
);

const params = {
    "filters": "{"slug": "tactic-slug"}",
    "per_page": "15",
    "page": "1",
};
Object.keys(params)
    .forEach(key => url.searchParams.append(key, params[key]));

const headers = {
    "Authorization": "Bearer {YOUR_AUTH_KEY}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());

Example response (200):


{
    "data": [
        {
            "id": 102,
            "taxonomy_subcategory_id": 60,
            "slug": "consequatur-aut-dolores",
            "name": "enim non facere",
            "order": 25,
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        },
        {
            "id": 103,
            "taxonomy_subcategory_id": 61,
            "slug": "aliquam-veniam-corporis",
            "name": "dolorem mollitia deleniti",
            "order": 37,
            "created_at": "2025-07-21T18:20:53.000000Z",
            "updated_at": "2025-07-21T18:20:53.000000Z"
        }
    ]
}

Received response:

Request failed with error:



Tip: Check that you're properly connected to the network.
If you're a maintainer of ths API, verify that your API is running and you've enabled CORS.
You can check the Dev Tools console for debugging information.

Request

GET api/v1/taxonomy/tactics

Headers

Authorization

Example: Bearer {YOUR_AUTH_KEY}

Content-Type

Example: application/json

Accept

Example: application/json

Query Parameters

filters string optional

Filter requests by various criteria. Example: {"slug": "tactic-slug"}

per_page integer optional

The number of results per page. Example: 15

page integer optional

The page number. Example: 1

Generate taxonomy.

requires authentication

Example request:

curl --request POST \
    "http://localhost/api/v1/taxonomy/generate" \
    --header "Authorization: Bearer {YOUR_AUTH_KEY}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"report\": \"architecto\"
}"

const url = new URL(
    "http://localhost/api/v1/taxonomy/generate"
);

const headers = {
    "Authorization": "Bearer {YOUR_AUTH_KEY}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "report": "architecto"
};

fetch(url, {
    method: "POST",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());

Example response (200):


{
    "sub_category": "fraudulent_access",
    "tactic": "fraudulent_access_fake_bank_site",
    "channels": [
        "scam_bank_alert_unknown_pix"
    ],
    "items": [
        "scam_bank_alert_unknown_pix"
    ]
}

Received response:

Request failed with error:



Tip: Check that you're properly connected to the network.
If you're a maintainer of ths API, verify that your API is running and you've enabled CORS.
You can check the Dev Tools console for debugging information.

Request

POST api/v1/taxonomy/generate

Headers

Authorization

Example: Bearer {YOUR_AUTH_KEY}

Content-Type

Example: application/json

Accept

Example: application/json

Body Parameters

report string

Example: architecto

Webhook Subscription Management

APIs for managing webhook subscriptions

Register a new webhook subscription.

requires authentication

Example request:

curl --request POST \
    "http://localhost/api/v1/webhook-subscriptions" \
    --header "Authorization: Bearer {YOUR_AUTH_KEY}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"url\": \"https:\\/\\/example.com\\/webhook\",
    \"event_type\": \"med-request.created\",
    \"actor_id\": 1,
    \"actor_type\": \"origin-bank\"
}"

const url = new URL(
    "http://localhost/api/v1/webhook-subscriptions"
);

const headers = {
    "Authorization": "Bearer {YOUR_AUTH_KEY}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "url": "https:\/\/example.com\/webhook",
    "event_type": "med-request.created",
    "actor_id": 1,
    "actor_type": "origin-bank"
};

fetch(url, {
    method: "POST",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());

Example response (200):


{
    "data": {
        "id": 18,
        "actor_id": null,
        "actor_type": "first-party-app",
        "event_type": "INFRACTION:ACKNOWLEDGED",
        "url": "http://www.okon.com/accusantium-harum-mollitia-modi-deserunt-aut-ab",
        "created_at": "2025-07-21T18:20:53.000000Z",
        "updated_at": "2025-07-21T18:20:53.000000Z",
        "secret_key": null
    }
}

Received response:

Request failed with error:



Tip: Check that you're properly connected to the network.
If you're a maintainer of ths API, verify that your API is running and you've enabled CORS.
You can check the Dev Tools console for debugging information.

Request

POST api/v1/webhook-subscriptions

Headers

Authorization

Example: Bearer {YOUR_AUTH_KEY}

Content-Type

Example: application/json

Accept

Example: application/json

Body Parameters

url string

The URL where the notification will be sent. Must be a valid URL. Example: https://example.com/webhook

event_type string

The type of event to subscribe to. Must be one of: med-request.created, med-request.updated, med-request.*. Example: med-request.created

actor_id integer optional

nullable The ID of the actor (bank or app) that will receive the webhook. Example: 1

actor_type string

The type of actor. Must be one of: origin-bank, destination-bank, first-party-app. Example: origin-bank

Webhook Notifications

Overview

Webhook notifications are sent to clients when specific events occur in the system. These notifications are triggered based on the webhook subscriptions registered by the clients. Each notification contains an event payload and is signed with a secret key to ensure its authenticity.

Notification Structure

Webhook notifications are sent as HTTP POST requests to the URL specified in the webhook subscription. The request contains the following:

Headers

Content-Type: application/json
X-CAM-Signature: A HMAC-SHA256 signature of the payload, generated using the secret key provided during subscription registration.

Body

The body of the request is a JSON object with the following structure:

{
  "event_type": "string", // The type of event (e.g., med-request.created, med-request.updated)
  "med_request_id": "integer", // The ID of the MED request related to the event
  "timestamp": "string" // ISO 8601 timestamp of the event
}

Validating the Signature

To ensure the authenticity of the webhook notification, clients must validate the X-CAM-Signature header. Follow these steps to validate the signature:

Retrieve the X-CAM-Signature header from the request.
Compute the HMAC-SHA256 hash of the request payload using the secret key provided during subscription registration.
Compare the computed hash with the value of the X-CAM-Signature header. If they match, the notification is authentic.

Note on Secret Key Hashing

When validating the signature, clients must first hash their plain secret key using a SHA-256 hash algorithm (for example hash('sha256', $plainSecretKey) in PHP) before computing the HMAC-SHA256 hash of the payload.

Updated Example Validation Code

Below is an updated example of how to validate the signature in PHP, considering the secret key hashing:

$payload = file_get_contents('php://input');
$receivedSignature = $_SERVER['HTTP_X_CAM_SIGNATURE'];
$plainSecretKey = 'your-plain-secret-key'; // Replace with your actual plain secret key

// Hash the plain secret key
$hashedSecretKey = hash('sha256', $plainSecretKey);

// Compute the HMAC-SHA256 hash of the payload
$computedSignature = hash_hmac('sha256', $payload, $hashedSecretKey);

if (hash_equals($computedSignature, $receivedSignature)) {
    // Signature is valid
    http_response_code(200);
    echo 'Notification received and verified.';
} else {
    // Signature is invalid
    http_response_code(403);
    echo 'Invalid signature.';
}

Handling Notifications

Clients should respond to webhook notifications with an HTTP status code:

200 OK: Indicates that the notification was received and processed successfully.
Any other status code: Indicates that the notification was not processed successfully. The system may retry sending the notification based on its retry policy.

Retry Policy

If a webhook notification fails (e.g., due to a network error or an invalid response code), the system will retry sending the notification. The retry policy includes exponential backoff and a maximum number of retries.

Security Best Practices

Use HTTPS for your webhook endpoint to ensure data is transmitted securely.
Keep your secret key confidential and rotate it periodically.
Validate the X-CAM-Signature header for every notification to ensure authenticity.
Log received notifications and their processing status for auditing and debugging purposes.

MED Request Status Webhook System

This webhook allows for automated retrieval of MedRequest status updates from external sources via webhooks.

The event type for refund status updates is fetch.med-request-refund-status.

Expected Response Format

Your webhook endpoint should return a JSON array of objects with the following structure:

[
  {
    "med_request_id": 1234,
    "status": "accepted",
    "refund_status": "refunded"
  },
  {
    "med_request_id": 5678,
    "status": "rejected",
    "refund_status": "med-denied"
  }
]

Valid status values are:

requested
in-review
opened
accepted
rejected
closed
cancelled

Valid refund status values are:

pending
refunded
not-refunded
partial-refunded
med-opened
med-denied
no-funds
not-refunded/scam
denied
no-infraction
infraction-received

Introduction

Authenticating requests

MED Request Files

Upload a file or multiple files for a MED request

Request Try it out ⚡ Cancel 🛑 Send Request 💥

Headers

URL Parameters

Body Parameters

Update a MED request file

Request Try it out ⚡ Cancel 🛑 Send Request 💥

Headers

URL Parameters

Body Parameters

List MED request files.

Request Try it out ⚡ Cancel 🛑 Send Request 💥

Headers

Query Parameters

MED request management

List MED requests.

Request Try it out ⚡ Cancel 🛑 Send Request 💥

Headers

Query Parameters

Create a new MED request.

Request Try it out ⚡ Cancel 🛑 Send Request 💥

Headers

Body Parameters

Response

Response Fields

Display a specific MED request.

Request Try it out ⚡ Cancel 🛑 Send Request 💥

Headers

URL Parameters

Query Parameters

Body Parameters

Update a MED request.

Request Try it out ⚡ Cancel 🛑 Send Request 💥

Headers

URL Parameters

Body Parameters

Notification Content Management

Remove the specified notification content.

Request Try it out ⚡ Cancel 🛑 Send Request 💥

Headers

URL Parameters

Taxonomy management

List taxonomy categories.

Request Try it out ⚡ Cancel 🛑 Send Request 💥

Headers

Query Parameters

List taxonomy subcategories.

Request Try it out ⚡ Cancel 🛑 Send Request 💥

Headers

Query Parameters

List taxonomy channels.

Request Try it out ⚡ Cancel 🛑 Send Request 💥

Headers

Query Parameters

List taxonomy items.

Request Try it out ⚡ Cancel 🛑 Send Request 💥

Headers

Query Parameters

List taxonomy scam checks.

Request Try it out ⚡ Cancel 🛑 Send Request 💥

Headers

Query Parameters

List taxonomy tactics.

Request Try it out ⚡ Cancel 🛑 Send Request 💥

Headers

Query Parameters

Generate taxonomy.

Request Try it out ⚡ Cancel 🛑 Send Request 💥

Headers

Body Parameters

Webhook Subscription Management

Register a new webhook subscription.

Request Try it out ⚡ Cancel 🛑 Send Request 💥

Headers

Body Parameters

Webhook Notifications

Overview

Request

Request

Request

Request

Request

Request

Request

Request

Request

Request

Request

Request

Request

Request

Request

Request