Cases API — List, Retrieve, and Resolve Fraud Cases

Cases are automatically created by AntifraudAI whenever a transaction or event receives a review decision. Each case represents a single flagged item that requires a human decision. The Cases API lets your fraud operations team list open cases for their review queue, inspect individual case details, and resolve cases with an approved or rejected outcome. Resolved cases feed back into the risk models as labeled training data.

GET /cases

List fraud review cases for your account, with optional filters for status, date range, and pagination.

Query Parameters

string

Filter by case status. One of: open, approved, rejected, expired. Omit to return cases of all statuses.

integer

Number of cases to return per page. Maximum 100, default 20.

integer

Zero-based pagination offset. Use in combination with limit to page through results.

string

ISO 8601 UTC start date for filtering cases by created_at. Cases created at or after this timestamp are included.

string

ISO 8601 UTC end date for filtering cases by created_at. Cases created before this timestamp are included.

cURL

curl --request GET \
  --url 'https://api.antifraudai.com/v1/cases?status=open&limit=20&offset=0' \
  --header 'Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxx'

Example response:

{
  "cases": [
    {
      "case_id": "case_3XPWQ1NMBY6LZ8R",
      "transaction_id": "txn_01HXZ9KP3QRMN7B2",
      "status": "open",
      "risk_score": 72,
      "decision": "review",
      "signals": ["velocity_spike", "ip_mismatch"],
      "created_at": "2024-06-15T10:32:00Z",
      "resolved_at": null,
      "resolved_by": null
    }
  ],
  "total": 47,
  "limit": 20,
  "offset": 0
}

GET /cases/

Retrieve the full details of a single case by its ID.

string

required

The unique identifier of the case to retrieve.

Response Fields

string

Unique identifier for this case.

string

The ID of the transaction or event that triggered this case.

string

Current status of the case: open, approved, rejected, or expired.

integer

Risk score (0–100) at the time the case was created.

string

The automated decision that triggered this case (always review).

array of strings

Risk signals that were active when the case was created.

string

ISO 8601 UTC timestamp of when the case was created.

string | null

ISO 8601 UTC timestamp of when the case was resolved, or null if still open.

string | null

Your internal identifier of the reviewer who resolved the case, or null if unresolved.

Example response:

{
  "case_id": "case_3XPWQ1NMBY6LZ8R",
  "transaction_id": "txn_01HXZ9KP3QRMN7B2",
  "status": "open",
  "risk_score": 72,
  "decision": "review",
  "signals": [
    "velocity_spike",
    "ip_mismatch",
    "high_amount_first_transaction"
  ],
  "created_at": "2024-06-15T10:32:00Z",
  "resolved_at": null,
  "resolved_by": null
}

PUT /cases/

Resolve a case by setting its status to approved or rejected. Resolving a case closes it and records the decision for model feedback.

string

required

The unique identifier of the case to resolve.

Request Parameters

string

required

The resolution outcome. Must be either approved (legitimate — false positive) or rejected (confirmed fraud).

string

Your internal identifier for the analyst resolving the case. Stored for audit trail purposes.

string

Free-text notes explaining the resolution decision. Useful for team audits and compliance records.

curl --request PUT \
  --url https://api.antifraudai.com/v1/cases/case_3XPWQ1NMBY6LZ8R \
  --header 'Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxx' \
  --header 'Content-Type: application/json' \
  --data '{
    "status": "approved",
    "resolver_id": "agent_jsmith",
    "notes": "Customer confirmed via 2FA challenge. Transaction is legitimate."
  }'

import requests

response = requests.put(
    "https://api.antifraudai.com/v1/cases/case_3XPWQ1NMBY6LZ8R",
    headers={
        "Authorization": "Bearer sk_live_xxxxxxxxxxxxxxxxxxxx",
        "Content-Type": "application/json",
    },
    json={
        "status": "approved",
        "resolver_id": "agent_jsmith",
        "notes": "Customer confirmed via 2FA challenge. Transaction is legitimate.",
    },
)

print(response.json())

The response is the updated case object reflecting the new status:

{
  "case_id": "case_3XPWQ1NMBY6LZ8R",
  "transaction_id": "txn_01HXZ9KP3QRMN7B2",
  "status": "approved",
  "risk_score": 72,
  "decision": "review",
  "signals": [
    "velocity_spike",
    "ip_mismatch",
    "high_amount_first_transaction"
  ],
  "created_at": "2024-06-15T10:32:00Z",
  "resolved_at": "2024-06-15T14:17:33Z",
  "resolved_by": "agent_jsmith"
}

Open cases expire automatically after 7 days if not resolved. Expired cases are marked with status expired and are no longer eligible for resolution via the API.

Overview

Endpoints

Cases API — List, Retrieve, and Resolve Fraud Cases

GET /cases

Query Parameters

GET /cases/

Response Fields

PUT /cases/

Request Parameters

​GET /cases

​Query Parameters

​GET /cases/

​Response Fields

​PUT /cases/

​Request Parameters

GET /cases

Query Parameters

GET /cases/

Response Fields

PUT /cases/

Request Parameters