:::endpoint PUT /v1/admin/fraud/detection

Change any part of [the detectors](/docs/api/admin/fraud-detection): the firm's
settings, what Restrict takes, and any number of detectors. What is left out
keeps its value. Each part that is sent is checked whole, by the rules the
website uses: half a `global` is refused rather than merged. The two exceptions
are `score_window_days` and a detector's `score`: left out, they keep what is
stored, so a client written before they existed cannot reset them.

A changed score counts at once for flags that are already open, so every
trader's risk score moves with it. It suspends nobody by itself: only a new flag
that takes a trader to `escalation_score` or higher does.

It takes effect at once. Access checks that were cached for a trader are thrown
away, so a detector put on Block refuses the next request.

Needs a firm. Our own staff name one with the `Propper-Workspace` header.

## Request

| Field       | Description |
| ----------- | ----------- |
| `global`    | All four of `enabled`, `notify_admins`, `escalation_enabled` and `escalation_score` (a whole number from 30 to 100, checked even while escalation is off). `score_window_days` is optional: `30`, `60`, `90`, `180`, `365` or `0`. `sensitivity` is deprecated: it is accepted and ignored |
| `restrict`  | All four of `block_new_orders`, `hold_payouts`, `block_purchases` and `hold_affiliate_payouts`, each true or false |
| `detectors` | By key, each with a `level` and its `params`, and optionally a `score` from 0 to 100 in steps of 5. A detector with thresholds needs `params`, and a threshold left out goes back to its default. An integer is a whole number from `min` to `max`, a choice one of its `options`, a country list up to 250 codes of two letters |

At least one of the three.

```bash
curl -X PUT "https://api.proppertrading.com/v1/admin/fraud/detection" \
  -H "Authorization: Bearer ptat_9f2c1a44_3b8e7d2f5c9a1b4e6d8f0a2c4e6b8d1f" \
  -H "Propper-Workspace: acme" \
  -H "Content-Type: application/json" \
  -d '{"detectors": {"max_countries": {"level": "flag", "score": 25, "params": {"max_countries": 4, "window_days": 30}}}}'
```

## Response

[The detectors](/docs/api/admin/fraud-detection) as they are now.

## Errors

| Status | Code                      | Meaning                                                                                                                                                                       |
| ------ | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 400    | `workspace_required`      | Asked by our own staff without naming a firm                                                                                                                                  |
| 401    | `invalid_token`           | Not a token, or the secret does not match                                                                                                                                     |
| 401    | `revoked_token`           | Signed out here or from another device                                                                                                                                        |
| 401    | `expired_token`           | Ninety days without use, or a set expiry passed                                                                                                                               |
| 403    | `admin_access_required`   | This account no longer helps run the environment                                                                                                                              |
| 403    | `insufficient_scope`      | This device does not hold `admin:write`                                                                                                                                       |
| 403    | `workspace_not_permitted` | The `Propper-Workspace` header names an environment this account cannot act in                                                                                                |
| 403    | `forbidden`               | Without `manage_fraud`                                                                                                                                                        |
| 422    | `validation_failed`       | Nothing to save, a part that is not whole, an unknown detector, a level, score or threshold out of range. `param` names the field, such as `detectors.shared_ip.params.max_accounts` |