:::endpoint GET /v1/admin/payouts/{payout}/fraud

The tab Fraud of the website's Payouts screen: the trader's risk score and
where it comes from, the flags involving the trader, open ones first, the
restrictions in force and what they take, and the overrides made for them. A
restriction is lifted by its `id`, with
[lift a fraud restriction](/docs/api/admin/fraud-restriction-lift).

Needs a firm. Our own staff name one with the `Propper-Workspace` header.

## Request

```bash
curl "https://api.proppertrading.com/v1/admin/payouts/po_pk2jjt25cw5swbwv/fraud" \
  -H "Authorization: Bearer ptat_9f2c1a44_3b8e7d2f5c9a1b4e6d8f0a2c4e6b8d1f" \
  -H "Propper-Workspace: acme"
```

## Response

```json
{
    "data": {
        "object": "payout_fraud",
        "risk": {
            "score": 35,
            "sum": 35,
            "threshold": 80,
            "window_days": 90,
            "lines": [
                {
                    "flag": "fflag_a7gfz99ayqrn7yda",
                    "kind": "detector",
                    "flags": 1,
                    "label": null,
                    "level": "flag",
                    "exempt": false,
                    "points": 35,
                    "seen_at": "2026-09-30T16:27:50+00:00",
                    "detector": "shared_device"
                }
            ]
        },
        "flags": [
            {
                "id": "fflag_a7gfz99ayqrn7yda",
                "detector": "shared_device",
                "category": "device",
                "label": "Shared device",
                "score": 35,
                "severity": "low",
                "risk": 35,
                "level": "flag",
                "status": "open",
                "subject": "dxFeed E2E",
                "others": 2,
                "ip": "127.0.0.1",
                "restricted": false,
                "created_at": "2026-09-30T16:27:50+00:00",
                "reviewed_at": null
            }
        ],
        "total": 1,
        "restrictions": [],
        "takes": [],
        "overrides": []
    },
    "meta": {
        "request_id": "req_01m50qhejqe3mgt8v6zs1fa977"
    }
}
```

| Field          | Description |
| -------------- | ----------- |
| `risk`         | The trader's risk score and a line per detector it comes from, as on [a flag](/docs/api/admin/fraud-flag). Null when the trader deleted their account |
| `flags`        | Up to fifty flags involving the trader, open ones first, then newest first. `label` is the detector's name in words, `subject` the person it is about and `others` how many more it involves. `score` is what the flag's detector adds and `risk` the risk score it weighs in the queue |
| `total`        | Every flag involving the trader, closed ones too |
| `restrictions` | What fraud detection holds against the trader now, each with its `detector` and `detector_name` in words, the `flag` that caused it and `since` |
| `takes`        | What a restriction takes from a trader in this firm, such as `hold_payouts` |
| `overrides`    | Exceptions made for the trader, with the `detector` and `detector_name`, the `level`, the `score` (null for the firm's), the `reason`, `expires_at` and whether it is `active` |

## Errors

| Status | Code                      | Meaning                                                                         |
| ------ | ------------------------- | ------------------------------------------------------------------------------- |
| 400    | `workspace_required`      | Asked by our own staff without naming a firm                                    |
| 401    | `invalid_token`           | Not a token, or the secret does not match                                       |
| 401    | `revoked_token`           | Signed out here or from another device                                          |
| 401    | `expired_token`           | Ninety days without use, or a set expiry passed                                 |
| 403    | `admin_access_required`   | This account no longer helps run the environment                                |
| 403    | `insufficient_scope`      | This device does not hold `admin:read`                                          |
| 403    | `workspace_not_permitted` | The `Propper-Workspace` header names an environment this account cannot act in |
| 403    | `forbidden`               | Without `view_payouts` and `view_fraud`                                                            |
| 404    | `resource_not_found`      | No payout with that id in this firm                                             |