First Leeward

Fraud Alerts

Respond to alert

POSThttps://api.firstleeward.com/v0/fraud-alerts/:id/respond

Confirms or declines a pending detected fraud alert. Confirming blocks the card (CARD_STATUS_UPDATED with blockReason: FRAUD_ALERT_CONFIRMED); declining leaves the card alone. type is required when confirming.

Authorizations

Authorizationstring · headerrequired

API key as Bearer token, e.g. Bearer YOUR_API_KEY

Headers

Leeward-Versionenum<string>required

API version (YYYY-MM-DD). Available option: 2026-09-18

Idempotency-Keystring

Unique key for safely retrying this request. Up to 255 characters; we recommend a UUIDv4. The first request executes and its response is cached; subsequent requests with the same key replay the cached response (24h retention).

Path Parameters

idstring<uuid>required

Fraud alert ID

Body

application/json

Option 1 · Confirm
responsestringrequired

Confirm the alert as fraud

typestringrequired

Fraud classification

Available options:CARD_LOSTCARD_STOLENACCOUNT_NUMBER_MISUSEOTHER
Option 2 · Decline
responsestringrequired

Decline the alert as not fraud

Response

200Fraud alert resource
idstring<uuid>required

Unique fraud alert identifier

cardIdstring<uuid>required

ID of the card this alert is for

transactionIdstring<uuid>required

ID of the card transaction this alert is for

statusstringrequired

Current fraud alert status

Available options:PENDINGCONFIRMEDDECLINEDEXPIRED
originstringrequired

How the alert entered the system (DETECTED via fraud monitoring, or REPORTED by the partner)

Available options:DETECTEDREPORTED
typestring | nullrequired

Fraud classification. Present only when status is CONFIRMED; null for others

Available options:CARD_LOSTCARD_STOLENACCOUNT_NUMBER_MISUSEOTHER
detectionReasonstring | nullrequired

Reason supplied with a detected alert, when present

cardholderMessagestring | nullrequired

Cardholder-facing message from the First Leeward or Card Network, when present. Display only - do not branch on its contents

transactionOccurredAtstring<date-time>required

ISO 8601 timestamp of the underlying transaction (anchors the reporting window)

detectedAtstring<date-time>required

ISO 8601 timestamp when the alert was raised (anchors the response window)

respondedAtstring<date-time> | nullrequired

ISO 8601 timestamp when the alert was confirmed or declined, if resolved that way

resolvedAtstring<date-time> | nullrequired

ISO 8601 timestamp when the alert reached a terminal status

reportableUntilstring<date-time> | nullrequired

ISO 8601 deadline for a report after an unanswered detected alert expired. Null unless status is EXPIRED

respondableUntilstring<date-time>required

ISO 8601 deadline for confirming or declining a detected alert

createdAtstring<date-time>required

ISO 8601 timestamp of creation

updatedAtstring<date-time>required

ISO 8601 timestamp of last update

404Fraud alert not found
errorobjectrequired
Show child attributes
codestringrequired
messagestringrequired
detailobject | nullrequired
409Fraud alert has already been resolved
errorobjectrequired
Show child attributes
codestringrequired
messagestringrequired
detailobject | nullrequired
422Fraud response window has expired
errorobjectrequired
Show child attributes
codestringrequired
messagestringrequired
detailobject | nullrequired