Create fraud marker

Persists a minimized fraud marker locally after hashing PII inputs for storage, and submits the corresponding BACEN fraud-marker report synchronously-after-persist, tracked by report_status (PENDING/SENT/FAILED) + request_id.

POST /api/v1/dict/fraud-markers

Create fraud marker

cURL

curl --request POST \
  --url https://spi.sandbox.lerian.net/api/v1/dict/fraud-markers \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-Idempotency: <x-idempotency>' \
  --data '
{
  "fraudType": "MULE_ACCOUNT",
  "keyValue": "[e-mail]",
  "ownerTaxId": "52998224725",
  "participantISPB": "12345678"
}
'

201

{
  "createdAt": "2026-06-14T12:00:00Z",
  "fraudType": "MULE_ACCOUNT",
  "id": "550e8400-e29b-41d4-a716-446655440002",
  "keyValueHash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "ownerTaxIdHash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "participantISPB": "12345678",
  "reportStatus": "SENT",
  "status": "ACTIVE",
  "updatedAt": "2026-06-14T12:00:00Z",
  "bacen": {
    "correlationId": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
    "lastModified": "2026-06-14T12:00:00Z",
    "responseTime": "2026-06-14T12:00:00Z"
  },
  "bacenCreationTime": "2026-06-14T12:00:00Z",
  "keyValue": "[e-mail]",
  "operationId": "01930000-0000-7000-8000-000000000000",
  "operationStatus": "UNKNOWN_OUTCOME",
  "originInfractionReportId": "550e8400-e29b-41d4-a716-446655440005",
  "originInfractionReporterISPB": "12345678",
  "originOperationId": "01930000-0000-7000-8000-000000000000",
  "ownerTaxId": "52998224725"
}

Authorizations

Authorization · string · header · required

JWT bearer token issued by the identity provider.

Headers

X-Idempotency · string · required

Required key used to prevent replaying the mutation.

Body

application/json

Fraud marker reported to BACEN first; only a CONFIRMED report is persisted locally, minimized — a rejection or ambiguous outcome creates no local row. Tracked by report_status=SENT + a durable operation intent (operationId) while pending; PII inputs (key value, owner tax ID) are hashed before storage.

fraudType · enum<string> · required

BACEN fraud classification: APPLICATION_FRAUD, MULE_ACCOUNT, SCAMMER_ACCOUNT, OTHER, or UNKNOWN

Available options: APPLICATION_FRAUD, MULE_ACCOUNT, SCAMMER_ACCOUNT, OTHER, UNKNOWN

Example:

"MULE_ACCOUNT"

keyValue · string · required

Plaintext PIX key value to mark; stored only as an HMAC hash, never in the clear, and not sent to BACEN. At most 77 characters, the ceiling BACEN publishes on a DICT key.

Required string length: 1 - 77

Example:

"[e-mail]"

ownerTaxId · string · required

Plaintext owner tax ID (CPF/CNPJ) the marker is associated with, shaped as the SPI wire type PICpfCnpj: 11 digits for a CPF, 14 alphanumeric characters for a CNPJ. BACEN requires it in the clear and its pattern rejects a hash, so it is sent verbatim inside the signed body — and only there. Storage, logs, events and responses keep the HMAC hash.

Pattern: ^([0-9]{11}|[0-9A-Z]{12}[0-9]{2})$

Example:

"52998224725"

participantISPB · string · required

ISPB (8 numeric digits) of the participant raising the fraud marker

Pattern: ^[0-9]{8}$

Example:

"12345678"

Response

201

application/json

Created

Persisted minimized fraud marker, or {operationId, operationStatus} while BACEN's outcome is pending (202).

createdAt · string · required

Record creation timestamp (RFC 3339, UTC)

Example:

"2026-06-14T12:00:00Z"

fraudType · string · required

BACEN fraud classification: APPLICATION_FRAUD, MULE_ACCOUNT, SCAMMER_ACCOUNT, OTHER, or UNKNOWN

Example:

"MULE_ACCOUNT"

id · string · required

BACEN-assigned fraud-marker resource UUID — the public, canonical identity of this record

Example:

"550e8400-e29b-41d4-a716-446655440002"

keyValueHash · string · required

HMAC hash of the marked PIX key value (hex); the plaintext key is never returned

Example:

"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"

ownerTaxIdHash · string · required

HMAC hash of the owner tax ID (hex); kept for consumers that index/audit on the minimized projection

Example:

"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"

participantISPB · string · required

ISPB (8 numeric digits) of the participant that raised the fraud marker

Example:

"12345678"

reportStatus · string · required

BACEN report delivery state. Always SENT at rest (a resource row is persisted only once BACEN has confirmed it; a rejected or ambiguous attempt creates no row).

Example:

"SENT"

status · string · required

Local fraud-marker state: ACTIVE (counts toward fraud stats) or INACTIVE (retained for audit only)

Example:

"ACTIVE"

updatedAt · string · required

Last update timestamp (RFC 3339, UTC)

Example:

"2026-06-14T12:00:00Z"

bacen · object

BACEN's own operational envelope for its most recent interaction on this fraud marker, including its LastModified version; omitted when no BACEN interaction has ever landed on it.

Show child attributes

bacenCreationTime · string

When BACEN created this fraud marker (RFC 3339, UTC); distinct from createdAt

Example:

"2026-06-14T12:00:00Z"

keyValue · string

BACEN-observed clear PIX key value (ExtendedFraudMarker.Key); omitted when BACEN's response omitted it

Example:

"[e-mail]"

operationId · string

Durable MED operation-intent id: the operation that produced this resource's current state. Present on both a synchronous 200/201 and a pending 202.

Example:

"01930000-0000-7000-8000-000000000000"

operationStatus · enum<string>

Durable operation-intent status. Always COMPLETED on a synchronous 200/201; on a pending 202 it is never REJECTED or LOCAL_FAILURE — both are BACEN-final/local-final outcomes mapped to their own HTTP status instead of a 202.

Available options: RESERVED, SUBMITTED, CONFIRMED, SYNC_PENDING, UNKNOWN_OUTCOME, MANUAL_REVIEW, COMPLETED

Example:

"UNKNOWN_OUTCOME"

originInfractionReportId · string

BACEN-assigned infraction that originated this marker (ExtendedFraudMarker.InfractionReport.Id); omitted when there is none

Example:

"550e8400-e29b-41d4-a716-446655440005"

originInfractionReporterISPB · string

Reporter ISPB of the originating infraction (ExtendedFraudMarker.InfractionReport.ReporterParticipant); omitted when there is none

Example:

"12345678"

originOperationId · string

Durable operation-intent id that produced this snapshot's current state, when known

Example:

"01930000-0000-7000-8000-000000000000"

ownerTaxId · string

BACEN-observed clear owner tax ID (CPF/CNPJ) — ExtendedFraudMarker.TaxIdNumber; omitted when BACEN has never echoed one back

Example:

"52998224725"