First Leeward

Fraud Alerts

List alerts

GEThttps://api.firstleeward.com/v0/fraud-alerts

Returns a paginated list of fraud alerts, newest transaction first. Filter by status, card, transaction, origin, or transaction time range. No status default is applied.

Authorizations

Authorizationstring · headerrequired

API key as Bearer token, e.g. Bearer YOUR_API_KEY

Headers

Leeward-Versionenum<string>required

API version (YYYY-MM-DD). Available option: 2026-09-18

Query Parameters

limitintegerdefault: 20

Maximum number of items to return (1-100, default: 20)

cursorstring

Opaque cursor for pagination. Pass nextCursor from previous response to get next page.

statusstring[]

Filter by fraud alert status (comma-separated)

Available options:PENDINGCONFIRMEDDECLINEDEXPIRED
cardIdstring<uuid>

Filter by card ID

transactionIdstring<uuid>

Filter by card transaction ID

originstring[]

Filter by how the alert entered the system (comma-separated)

Available options:DETECTEDREPORTED
occurredFromstring<date-time>

Inclusive lower bound on the underlying transaction time. ISO 8601 datetime.

occurredTostring<date-time>

Inclusive upper bound on the underlying transaction time. ISO 8601 datetime.

Response

200Response for status 200
itemsobject[]required
Show child attributes
idstring<uuid>required

Unique fraud alert identifier

cardIdstring<uuid>required

ID of the card this alert is for

transactionIdstring<uuid>required

ID of the card transaction this alert is for

statusstringrequired

Current fraud alert status

Available options:PENDINGCONFIRMEDDECLINEDEXPIRED
originstringrequired

How the alert entered the system (DETECTED via fraud monitoring, or REPORTED by the partner)

Available options:DETECTEDREPORTED
typestring | nullrequired

Fraud classification. Present only when status is CONFIRMED; null for others

Available options:CARD_LOSTCARD_STOLENACCOUNT_NUMBER_MISUSEOTHER
detectionReasonstring | nullrequired

Reason supplied with a detected alert, when present

cardholderMessagestring | nullrequired

Cardholder-facing message from the First Leeward or Card Network, when present. Display only - do not branch on its contents

transactionOccurredAtstring<date-time>required

ISO 8601 timestamp of the underlying transaction (anchors the reporting window)

detectedAtstring<date-time>required

ISO 8601 timestamp when the alert was raised (anchors the response window)

respondedAtstring<date-time> | nullrequired

ISO 8601 timestamp when the alert was confirmed or declined, if resolved that way

resolvedAtstring<date-time> | nullrequired

ISO 8601 timestamp when the alert reached a terminal status

reportableUntilstring<date-time> | nullrequired

ISO 8601 deadline for a report after an unanswered detected alert expired. Null unless status is EXPIRED

respondableUntilstring<date-time>required

ISO 8601 deadline for confirming or declining a detected alert

createdAtstring<date-time>required

ISO 8601 timestamp of creation

updatedAtstring<date-time>required

ISO 8601 timestamp of last update

nextCursorstring | nullrequired

Cursor for next page, or null if no more items