> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Create fraud marker > Reports the fraud marker to BACEN (createFraudMarker, idempotent on a RequestId derived from X-Idempotency) and persists it once BACEN confirms. Always synchronous: an ambiguous outcome or a replay is reconciled inline — when this request's operation already carries BACEN's id, the marker BACEN serves under it (checked against the request's document, key and fraud type) is persisted and answered with 201. With no id known yet the answer is 503 SPI-1010, retry with the same X-Idempotency: when BACEN never answered, the reconciliation sweep resends the create with the same RequestId (which BACEN dedups) and records the id, after which the retry is answered 201; when BACEN confirmed without an id, the operation goes to manual review and the retry is answered once an operator resolves it. 422 when BACEN refuses the marker. ## OpenAPI ````yaml /pt/openapi/v3-current/spi-dict.yaml post /api/v1/dict/fraud-markers openapi: 3.1.0 info: contact: email: contact@lerian.studio name: Lerian Studio url: https://lerian.studio description: >- OpenAPI 3.1 surface for the DICT (Diretório de Identificadores de Contas Transacionais) capability of Lerian SPI, the direct integration between the institution and the Brazilian Instant Payment System (SPI/Pix). It covers the PIX key lifecycle, portability and ownership claims, the MED 2.0 dispute surface (infraction reports, refunds, fraud markers, and funds recoveries), antifraud statistics, synchronous DICT reports, and the internal operations that keep the key directory consistent. license: name: Lerian Studio General License title: Lerian SPI — DICT API version: 1.0.0 servers: - url: https://api.example.com description: >- Replace the example host with the URL provided during environment onboarding. security: [] tags: - description: 'PIX key lifecycle: register, list, search, lookup, delete, and statistics.' name: Keys - description: >- PIX key portability and ownership claims through their full lifecycle (initiate, confirm, reject, cancel, acknowledge, complete). name: Claims - description: 'DICT infraction reports: list and retrieve.' name: Infractions - description: 'DICT refund requests: create, list, and retrieve.' name: Refunds - description: 'PIX fraud markers: create, list, and statistics.' name: Fraud Markers - description: >- Durable MED operation-intent status: the operationId every create/lifecycle-transition backlog route returns or references on every outcome, queryable independently of the business resource. name: Operations - description: >- Synchronous reports over Lerian SPI's own DICT record: COUNT(*) summaries of keys (by type/status) and claims (by type/status + open-past-deadline). COUNT-only — DICT holds no money. name: Reports - description: >- DICT 8.4 section 13.2.3 query monitoring: read the query indicators, block or release an end user after a founded suspicion, and read the DICT request-limiting token buckets. name: Query Monitoring - description: >- DICT synchronism checks transported to BACEN for the participant named in X-ISPB: sync verification, CID resolution and CID set events, projected verbatim. name: VSync paths: /api/v1/dict/fraud-markers: post: tags: - Fraud Markers summary: Create fraud marker description: >- Reports the fraud marker to BACEN (createFraudMarker, idempotent on a RequestId derived from X-Idempotency) and persists it once BACEN confirms. Always synchronous: an ambiguous outcome or a replay is reconciled inline — when this request's operation already carries BACEN's id, the marker BACEN serves under it (checked against the request's document, key and fraud type) is persisted and answered with 201. With no id known yet the answer is 503 SPI-1010, retry with the same X-Idempotency: when BACEN never answered, the reconciliation sweep resends the create with the same RequestId (which BACEN dedups) and records the id, after which the retry is answered 201; when BACEN confirmed without an id, the operation goes to manual review and the retry is answered once an operator resolves it. 422 when BACEN refuses the marker. operationId: createFraudMarker parameters: - description: Required key used to prevent replaying the mutation. in: header name: X-Idempotency required: true schema: description: Required key used to prevent replaying the mutation. type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateFraudMarkerRequest' description: >- Fraud marker reported to BACEN first; only a CONFIRMED report is persisted locally, minimized — a rejection or ambiguous outcome creates no local row. Tracked by report_status=SENT + the durable operation intent (operationId) that created it. required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/CreateFraudMarkerResponse' description: >- Persisted minimized fraud marker and the operation that created it. description: Created '403': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Forbidden '404': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Not Found '409': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Conflict '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unprocessable Entity '429': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Too Many Requests '500': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Internal Server Error '503': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Service Unavailable default: content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Error security: - BearerAuth: [] components: schemas: CreateFraudMarkerRequest: additionalProperties: false properties: fraudType: description: >- BACEN fraud classification: APPLICATION_FRAUD, MULE_ACCOUNT, SCAMMER_ACCOUNT, OTHER, or UNKNOWN enum: - APPLICATION_FRAUD - MULE_ACCOUNT - SCAMMER_ACCOUNT - OTHER - UNKNOWN examples: - MULE_ACCOUNT type: string keyValue: description: >- Optional plaintext Pix key of the fraudster, informed when known so the key also receives the fraud mark; a blank value is treated as absent. The clear key travels in the signed BACEN body, the operation request_body, the BACEN snapshot, the MED snapshot facts and the fraud-marker responses; the row column holds its HMAC hash. At most 77 characters, the ceiling BACEN publishes on a DICT key. examples: - usuario@example.com maxLength: 77 type: string ownerTaxId: description: >- Plaintext owner tax ID (CPF/CNPJ) the marker is associated with, shaped as the SPI wire type PICpfCnpj: 11 digits for a CPF, 14 alphanumeric characters for a CNPJ. BACEN requires it in the clear and its pattern rejects a hash, so it is sent verbatim inside the signed body. The clear value is also kept in the operation request_body, the BACEN snapshot, the MED snapshot facts and the responses. examples: - '52998224725' pattern: ^([0-9]{11}|[0-9A-Za-z]{12}[0-9]{2})$ type: string participantISPB: description: >- ISPB (8 digits or uppercase letters) of the participant raising the fraud marker examples: - '12345678' pattern: ^[0-9A-Z]{8}$ type: string required: - ownerTaxId - participantISPB - fraudType type: object CreateFraudMarkerResponse: additionalProperties: false properties: bacen: $ref: '#/components/schemas/BACENEnvelopeResponse' description: >- BACEN's own operational envelope for its most recent interaction on this fraud marker, including its LastModified version; omitted when no BACEN interaction has ever landed on it. bacenCreationTime: description: >- When BACEN created this fraud marker (RFC 3339, UTC); distinct from createdAt examples: - '2026-06-14T12:00:00Z' type: string createdAt: description: Record creation timestamp (RFC 3339, UTC) examples: - '2026-06-14T12:00:00Z' type: string fraudType: description: >- BACEN fraud classification: APPLICATION_FRAUD, MULE_ACCOUNT, SCAMMER_ACCOUNT, OTHER, or UNKNOWN examples: - MULE_ACCOUNT type: string id: description: >- BACEN-assigned fraud-marker resource UUID — the public, canonical identity of this record examples: - 550e8400-e29b-41d4-a716-446655440002 type: string keyValue: description: >- Clear Pix key value the caller informed or BACEN echoed (ExtendedFraudMarker.Key); omitted when no key is known examples: - usuario@example.com type: string keyValueHash: description: >- HMAC hash of the marked Pix key value (hex); empty when no key was given examples: - e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 type: string operationId: description: >- Durable MED operation-intent id of the create that produced this marker; always present. examples: - 01930000-0000-7000-8000-000000000000 type: string operationStatus: description: >- Durable operation-intent status. COMPLETED on an ordinary create; any other value means the marker was reconciled from BACEN inline (or a replay served the row an earlier attempt wrote) and the operation is still the reconciliation's to complete (the sweep, or an operator for MANUAL_REVIEW). enum: - COMPLETED - UNKNOWN_OUTCOME - MANUAL_REVIEW - SYNC_PENDING - RESERVED - SUBMITTED - CONFIRMED examples: - COMPLETED type: string originInfractionReportId: description: >- BACEN-assigned infraction that originated this marker (ExtendedFraudMarker.InfractionReport.Id); omitted when there is none examples: - 550e8400-e29b-41d4-a716-446655440005 type: string originInfractionReporterISPB: description: >- Reporter ISPB of the originating infraction (ExtendedFraudMarker.InfractionReport.ReporterParticipant); omitted when there is none examples: - '12345678' type: string originOperationId: description: >- Durable operation-intent id that produced this snapshot's current state, when known examples: - 01930000-0000-7000-8000-000000000000 type: string ownerTaxId: description: >- BACEN-observed clear owner tax ID (CPF/CNPJ) — ExtendedFraudMarker.TaxIdNumber; omitted when BACEN has never echoed one back examples: - '52998224725' type: string participantISPB: description: >- ISPB (8 digits or uppercase letters) of the participant that raised the fraud marker examples: - '12345678' type: string reportStatus: description: >- BACEN report delivery state. Always SENT at rest (a resource row is persisted only once BACEN has confirmed it; a rejected or ambiguous attempt creates no row). examples: - SENT type: string status: description: >- Local fraud-marker state: ACTIVE (counts toward fraud stats) or INACTIVE (retained for audit only) examples: - ACTIVE type: string updatedAt: description: Last update timestamp (RFC 3339, UTC) examples: - '2026-06-14T12:00:00Z' type: string required: - id - keyValueHash - participantISPB - fraudType - status - reportStatus - createdAt - updatedAt type: object Detail: additionalProperties: false properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). type: string correlationId: description: Request-scoped correlation identifier echoing X-Request-ID. examples: - req-7a3f9c2e type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. required: - correlationId type: object BACENEnvelopeResponse: additionalProperties: false properties: correlationId: description: >- BACEN's own correlation identifier for its most recent interaction on this record — the wire value, distinct from any request-scoped echo. examples: - a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4 type: string lastModified: description: >- BACEN's own LastModified for this resource (RFC 3339, UTC) — the version this response reflects; present only on the MED resources (infraction, refund, fraud marker, funds recovery). examples: - '2026-06-14T12:00:00Z' type: string responseTime: description: >- Instant BACEN answered its most recent interaction on this record, RFC 3339 (UTC); omitted when BACEN's response carried no parseable instant. examples: - '2026-06-14T12:00:00Z' type: string required: - correlationId type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.