> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# List fraud alerts raised on your account

> Returns the fraud / abuse alerts Orbit raised against your own organization (SIM-swap, IRSF / toll-fraud, suspicious campaign sends, voice-deepfake, API-key location anomaly, spend-velocity). Sorted by severity (critical first) then detection time. Each row carries an `actionable` flag derived from your configured triage thresholds, and the response echoes those thresholds under `prefs`. Read-only — use the acknowledge / dismiss endpoints to triage. Scoped to your organization only.



## OpenAPI

````yaml /openapi.yaml get /api/v1/compliance/fraud-reviews
openapi: 3.1.0
info:
  title: Devotel CPaaS API
  description: Orbit by Devotel — Communications Platform as a Service API
  version: 1.0.0
  contact:
    name: Devotel
    url: https://devotel.io
    email: support@devotel.io
  license:
    name: Proprietary
servers:
  - url: https://api.orbit.devotel.io
    description: Production
security:
  - Bearer: []
  - ApiKey: []
tags:
  - name: Messages
    description: >-
      Send and manage messages across all channels (SMS, WhatsApp, RCS, Email,
      Viber, etc.)
  - name: Fax
    description: >-
      List and track fax (MMS/T.38) transmissions on Telnyx-backed fax numbers
      (sending flows through the Messaging API)
  - name: Agents
    description: AI agent creation, configuration, and execution
  - name: Voice
    description: Voice calls, IVR, conferencing, and SIP trunking
  - name: OnCall
    description: On-call rotations and escalation policy planning for incident alerting
  - name: Webhooks
    description: Webhook endpoint management and delivery logs
  - name: Numbers
    description: Phone number search, provisioning, and configuration
  - name: Brand Identity
    description: >-
      Unified cross-channel brand trust posture (10DLC, toll-free, WhatsApp,
      RCS, branded calling, number KYC)
  - name: Contacts
    description: Contact management, segmentation, and lifecycle tracking
  - name: Campaigns
    description: Marketing campaign orchestration and analytics
  - name: Flows
    description: Automation flow builder and execution engine
  - name: Templates
    description: Message template management and approval workflows
  - name: Settings
    description: Organization, channel, and user preference settings
  - name: Verify
    description: OTP generation and verification across channels
  - name: Push
    description: Push notification delivery via FCM and APNs
  - name: Integrations
    description: Third-party service connections and OAuth management
  - name: CDP
    description: >-
      Customer Data Platform — activation surface (CRM object sync, streaming
      destinations, ad-audience activation)
  - name: Files
    description: >-
      Server-to-server media upload, listing, retrieval, and deletion
      (signed-URL backed)
  - name: Commerce
    description: >-
      Omnichannel conversational-commerce — persistent cart + checkout state
      machine, channel-agnostic hosted pay-by-link, native WhatsApp checkout,
      and AP2-style agent payment mandates.
  - name: Sync
    description: >-
      Real-time shared-state primitive (Twilio Sync parity) — Documents, Maps,
      Lists, and ephemeral Streams, with change events relayed over the
      /api/v1/ws/sync WebSocket gateway
paths:
  /api/v1/compliance/fraud-reviews:
    get:
      tags:
        - Compliance
      summary: List fraud alerts raised on your account
      description: >-
        Returns the fraud / abuse alerts Orbit raised against your own
        organization (SIM-swap, IRSF / toll-fraud, suspicious campaign sends,
        voice-deepfake, API-key location anomaly, spend-velocity). Sorted by
        severity (critical first) then detection time. Each row carries an
        `actionable` flag derived from your configured triage thresholds, and
        the response echoes those thresholds under `prefs`. Read-only — use the
        acknowledge / dismiss endpoints to triage. Scoped to your organization
        only.
      parameters:
        - name: status
          in: query
          required: false
          description: Filter by triage lifecycle status.
          schema:
            type: string
            enum:
              - open
              - triaged
              - dismissed
              - escalated
        - name: severity
          in: query
          required: false
          description: Filter by severity band.
          schema:
            type: string
            enum:
              - low
              - medium
              - high
              - critical
        - name: category
          in: query
          required: false
          description: Filter by detector category (e.g. `sim_swap_detected`).
          schema:
            type: string
            minLength: 1
            maxLength: 64
        - name: from
          in: query
          required: false
          description: Only alerts detected at/after this ISO-8601 timestamp.
          schema:
            type: string
            format: date-time
        - name: to
          in: query
          required: false
          description: Only alerts detected at/before this ISO-8601 timestamp.
          schema:
            type: string
            format: date-time
        - name: limit
          in: query
          required: false
          description: Max alerts returned. Clamped to [1, 500].
          schema:
            type: integer
            minimum: 1
            maximum: 500
            default: 100
      responses:
        '200':
          description: The caller org's fraud alerts plus the tenant's triage thresholds.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      reviews:
                        type: array
                        items:
                          $ref: '#/components/schemas/FraudReview'
                      prefs:
                        $ref: '#/components/schemas/FraudReviewPrefs'
                  meta:
                    $ref: '#/components/schemas/ResponseMeta'
        '422':
          $ref: '#/components/responses/StandardError'
components:
  schemas:
    FraudReview:
      type: object
      description: >-
        A single fraud / abuse alert Orbit raised against your organization (see
        GET /api/v1/compliance/fraud-reviews). The internal operator id that
        triaged the alert is never surfaced, and any PII in `details` is
        scrubbed on the way out.
      required:
        - id
        - category
        - severity
        - status
        - summary
        - source
        - detected_at
        - actionable
      properties:
        id:
          type: string
        category:
          type: string
          description: >-
            Detector category. Typically one of `sim_swap_detected`,
            `irsf_blocked`, `suspicious_campaign_send`,
            `voice_deepfake_high_score`, `api_key_geo_anomaly`,
            `spend_velocity_anomaly` — a free-text value is possible when a new
            detector ships ahead of this doc.
        severity:
          type: string
          description: Severity band (`low` | `medium` | `high` | `critical`).
        status:
          type: string
          description: >-
            Triage lifecycle status (`open` | `triaged` | `dismissed` |
            `escalated`).
        summary:
          type: string
        details:
          description: Detector-specific context (PII-scrubbed). Shape varies by category.
          nullable: true
        source:
          type: string
          description: The subsystem / detector that raised the alert.
        detected_at:
          type: string
          format: date-time
        triaged_at:
          type: string
          format: date-time
          nullable: true
        resolved_at:
          type: string
          format: date-time
          nullable: true
        actionable:
          type: boolean
          description: >-
            Whether this alert clears your triage thresholds (critical is always
            actionable; muted categories / below-floor severities are not).
    FraudReviewPrefs:
      type: object
      description: Your organization's fraud-review triage thresholds.
      required:
        - notify_min_severity
        - muted_categories
      properties:
        notify_min_severity:
          type: string
          enum:
            - low
            - medium
            - high
            - critical
          description: Minimum severity treated as actionable.
        muted_categories:
          type: array
          description: Detector categories muted from your triage view.
          items:
            type: string
        updated_at:
          type: string
          format: date-time
          nullable: true
        updated_by:
          type: string
          nullable: true
    ResponseMeta:
      type: object
      required:
        - request_id
        - timestamp
      additionalProperties: false
      properties:
        request_id:
          type: string
          description: Unique request identifier (also returned as X-Request-Id header)
        timestamp:
          type: string
          format: date-time
        docs_url:
          type: string
          format: uri
          nullable: true
  responses:
    StandardError:
      description: >-
        Standard error envelope. `error.code` is machine-readable; see the
        [error reference](https://docs.orbit.devotel.io/reference/error-codes)
        for the catalogue.
      content:
        application/json:
          schema:
            type: object
            properties:
              error:
                type: object
                required:
                  - code
                  - message
                  - status
                properties:
                  code:
                    type: string
                    description: Machine-readable error code (e.g. INVALID_PHONE_NUMBER)
                  message:
                    type: string
                    description: Human-readable error description
                  status:
                    type: integer
                    description: HTTP status code
                  details:
                    type: object
                    additionalProperties: true
                    description: Additional context about the error
              meta:
                type: object
                properties:
                  request_id:
                    type: string
                  timestamp:
                    type: string
                    format: date-time
                  docs_url:
                    type: string
                    format: uri
                    description: Link to relevant error documentation
  securitySchemes:
    Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Dashboard JWT token from Clerk
    ApiKey:
      type: apiKey
      name: X-API-Key
      in: header
      description: Server-to-server API key (dv_live_sk_*)

````