First Leeward

Fraud Alerts

Report fraud

POSThttps://api.firstleeward.com/v0/fraud-alerts

Files a fraud report against a past card transaction. Always confirms the transaction as fraud and blocks the card. If a pending detected alert already exists for the same transaction and is still inside the response window, this delegates to confirm. Partners learn of the block via CARD_STATUS_UPDATED with blockReason: FRAUD_ALERT_CONFIRMED.

Authorizations

Authorizationstring · headerrequired

API key as Bearer token, e.g. Bearer YOUR_API_KEY

Headers

Leeward-Versionenum<string>required

API version (YYYY-MM-DD). Available option: 2026-09-18

Idempotency-Keystring

Unique key for safely retrying this request. Up to 255 characters; we recommend a UUIDv4. The first request executes and its response is cached; subsequent requests with the same key replay the cached response (24h retention).

Body

application/json

transactionIdstring<uuid>required

ID of the card transaction to report as fraud

typestringrequired

Fraud classification

Available options:CARD_LOSTCARD_STOLENACCOUNT_NUMBER_MISUSEOTHER
cardholderNotifiedAtstring<date-time>

ISO 8601 timestamp when the cardholder was notified of the suspected fraud. When supplied, the reporting window is the earlier of the transaction-based deadline and a shorter window from this timestamp. When omitted, only the transaction-based window applies.

Response

200Fraud alert resource
idstring<uuid>required

Unique fraud alert identifier

cardIdstring<uuid>required

ID of the card this alert is for

transactionIdstring<uuid>required

ID of the card transaction this alert is for

statusstringrequired

Current fraud alert status

Available options:PENDINGCONFIRMEDDECLINEDEXPIRED
originstringrequired

How the alert entered the system (DETECTED via fraud monitoring, or REPORTED by the partner)

Available options:DETECTEDREPORTED
typestring | nullrequired

Fraud classification. Present only when status is CONFIRMED; null for others

Available options:CARD_LOSTCARD_STOLENACCOUNT_NUMBER_MISUSEOTHER
detectionReasonstring | nullrequired

Reason supplied with a detected alert, when present

cardholderMessagestring | nullrequired

Cardholder-facing message from the First Leeward or Card Network, when present. Display only - do not branch on its contents

transactionOccurredAtstring<date-time>required

ISO 8601 timestamp of the underlying transaction (anchors the reporting window)

detectedAtstring<date-time>required

ISO 8601 timestamp when the alert was raised (anchors the response window)

respondedAtstring<date-time> | nullrequired

ISO 8601 timestamp when the alert was confirmed or declined, if resolved that way

resolvedAtstring<date-time> | nullrequired

ISO 8601 timestamp when the alert reached a terminal status

reportableUntilstring<date-time> | nullrequired

ISO 8601 deadline for a report after an unanswered detected alert expired. Null unless status is EXPIRED

respondableUntilstring<date-time>required

ISO 8601 deadline for confirming or declining a detected alert

createdAtstring<date-time>required

ISO 8601 timestamp of creation

updatedAtstring<date-time>required

ISO 8601 timestamp of last update

400Fraud reporting is not available for this transaction. It was created by an older sandbox simulation; please try again with a new transaction
errorobjectrequired
Show child attributes
codestringrequired
messagestringrequired
detailobject | nullrequired
404Card transaction not found
errorobjectrequired
Show child attributes
codestringrequired
messagestringrequired
detailobject | nullrequired
409Fraud alert has already been resolved
errorobjectrequired
Show child attributes
codestringrequired
messagestringrequired
detailobject | nullrequired
422Response for status 422
Option 1 · FraudReportingWindowExpiredError
errorobjectrequired
Show child attributes
codestringrequired
messagestringrequired
detailobject | nullrequired
Option 2 · FraudResponseWindowExpiredError
errorobjectrequired
Show child attributes
codestringrequired
messagestringrequired
detailobject | nullrequired