POST
/v1/admin/fraud/overridesMake an exception for one trader on one detector. It takes effect at once: access checks cached for the trader are thrown away.
A trader has at most one override per detector. Asking for a second is refused
with 409 override_exists, which names the one in the way in override, so
the app can open that one instead.
Needs a firm. Our own staff name one with the Propper-Workspace header.
Request
| Field | Description |
|---|---|
user_id | The trader, by id. A trader of this firm who has not deleted their account |
detector | The detector's key. Not a trading rule |
level | off, monitor, flag, restrict or block, or null to keep the firm's level. Off exempts the trader, and an override can switch on for one trader a detector the firm has off |
score | 0 to 100 in steps of 5, what a flag of this detector adds to this trader's risk score, or null to keep the firm's score. Left out, it keeps what it was |
params | Only the thresholds that differ, by key, and only those the detector's fields mark overridable. Ranges as for the detectors |
reason | Up to 1000 characters |
expires_at | An instant after now, or null for no end. The website sends the end of the chosen day in the admin's own time zone |
A level, a score or at least one threshold, or there is nothing to override.
curl -X POST "https://api.proppertrading.com/v1/admin/fraud/overrides" \
-H "Authorization: Bearer ptat_9f2c1a44_3b8e7d2f5c9a1b4e6d8f0a2c4e6b8d1f" \
-H "Propper-Workspace: acme" \
-H "Idempotency-Key: 2a4c6e8b-0d2f-4a4c-9e6b-8d0f2a4c6e8a" \
-H "Content-Type: application/json" \
-d '{"user_id": "usr_aqms4nt797jdkttb", "detector": "max_countries", "params": {"max_countries": 8}, "reason": "Travels for work, asked by email on 3 October.", "expires_at": "2026-12-09T22:59:59Z"}'
Response
201, with the new override.
Errors
| Status | Code | Meaning |
|---|---|---|
| 400 | workspace_required | Asked by our own staff without naming a firm |
| 400 | missing_idempotency_key | A POST without an Idempotency-Key header |
| 401 | invalid_token | Not a token, or the secret does not match |
| 401 | revoked_token | Signed out here or from another device |
| 401 | expired_token | Ninety days without use, or a set expiry passed |
| 403 | admin_access_required | This account no longer helps run the environment |
| 403 | insufficient_scope | This device does not hold admin:write |
| 403 | workspace_not_permitted | The Propper-Workspace header names an environment this account cannot act in |
| 403 | forbidden | Without manage_fraud |
| 409 | override_exists | The trader already has an override on this detector, named in override |
| 422 | validation_failed | No such trader or detector, nothing to override, a threshold this detector does not let one trader change, or one out of range, a reason over 1000 characters, an end in the past |