Skip to content
aerandil.com
GitHub

Search Fraud network signal

POST
/v1/object-types/hospitality.fraud_network_signal/search
curl --request POST \
  --url https://api.aerandil.com/v1/object-types/hospitality.fraud_network_signal/search \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "branch": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "cursor": "example", "filters": [ { "property": "id", "type": "eq", "value": "example" } ], "limit": 1, "order": "asc", "property_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "scope": { "level": "tenant" }, "sort_by": "created_at" }'

Search for instances. Filters eq, contains, gte and lte AND-compose; or / not are additive follow-ups. Pages with an opaque cursor; the +1 fetch returns has_more without a second round-trip. Ordered by sort_by (default created_at) in order (default ascending), id breaking ties; rows with no value for a property key sort last.

What Watchtower, the card rail’s federated fraud network (proposal 0029), answered when this house asked about a card, email or phone before holding a card — frozen as issued; only a contest is ever added. match_present says whether a fraud outcome on the rail (contributed within the last two years) carries one of the digests; the count, the breadth of houses behind it and its recency are bucketed, and breadth reads only below_cohort until the cohort floor is met — the network never says which house, nor how many. band_floor is the lowest risk band the rail lets the hold’s assessment carry and floor_basis why: a card match blocks only on the house’s own loss or on another house’s recent issuer-confirmed loss that a second house or the guest’s contact corroborates; anything else sends the hold to review. A desk that believes the guest contests the answer (contest_fraud_network_signal), which puts it before the platform’s review and lets the next answer for the same subject take the hold to review instead (desk_override, override_of). fingerprints keeps the digests the house asked about, so the platform’s review of a contest can find the contributions the answer rested on. Recorded by the card rail only.

Authorizations

Section titled “Authorizations”

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
branch

Optional open-branch id. Search composes that branch’s copy-on-first-write overlay instead of main, so a preview reads its own hypothetical writes. Omit to read main.

string format: uuid
cursor

Opaque cursor from a prior response’s next_cursor. Pass back verbatim; do not introspect.

string
filters

Conjunctive list of predicates. Empty or omitted matches every row in scope, capped by limit.

Array
One of:
object
property
required
Allowed value: id
type
required
Allowed value: eq
value
required
string
limit

Page size. Server defaults to 50, silently clamps at 500 (AIP-158 §3).

integer
>= 1 <= 500
order

Direction of sort_by: asc (oldest / smallest first) or desc. A cursor is bound to the sort_by and order it was minted under; another pair is refused (422).

string
default: asc
Allowed values: asc desc
property_id

The house a desk stands in: keeps this property’s rows (property- or venue-scoped there) and every row scoped to no property (tenant, brand, portfolio), and drops a sibling house’s — the meaning property_id has on the event tail.

string format: uuid
scope
One of: discriminator: level
object
level
required
string
Allowed value: tenant
Allowed values: tenant
sort_by

What the page is ordered by: the row’s created_at or updated_at, or a property whose type orders — strings, enums and dates as text, ints, decimals and durations as numbers, datetimes as instants. Rows with no value sort last in either direction. A property the caller is not cleared to read is refused (403).

string
default: created_at
Allowed values: created_at updated_at id subject_kind subject_id match_count_bucket contributor_breadth recency_bucket band_floor floor_basis contested_at contest_reason salt_epoch issued_at expires_at

Responses

Section titled “Responses”

200

Section titled “200”

Search results, ordered by (sort_by, id) in the requested order (ascending by default).

Media typeapplication/json
object
data
required
Array<object>
object
created_at
required
string format: date-time
id
required
string format: uuid
object_type
required
Allowed value: hospitality.fraud_network_signal
properties
required
object
band_floor
required
The lowest band the hold's assessment may carry given this answer
string
Allowed values: low medium high block not_assessed
contest_reason
Why the desk contested it, in words
string
contested_at
When the desk contested this answer for the platform's review
string format: date-time
contributor_breadth
required
Whether the houses behind the match meet the cohort floor
string
Allowed values: none below_cohort cohort_met
expires_at
required
When the answer stops being a fair read (24 hours on)
string format: date-time
fingerprints
The digests the house asked about, as `[{kind, digest}]` — one per kind queried, 64 lower-case hex under the network salt, never an identifier — kept so the platform's review of a contest can find the contributions behind the answer (since 2026-11-03; an answer frozen before then carries none)
floor_basis
Why the answer set that floor — none, contact, card_unconfirmed, card_corroborated, card_own_house or desk_override
string
Allowed values: none contact card_unconfirmed card_corroborated card_own_house desk_override
id
required
Signal id
string
issued_at
required
When the network answered
string format: date-time
kinds_queried
required
The identifier kinds the house could ask about
Array<string>
Allowed values: card email phone
match_count_bucket
required
How many matching outcomes, bucketed
string
Allowed values: none one few many
match_present
required
Whether any confirmed outcome on the network carries one of them
boolean
matched_kinds
required
Which identifier kinds matched
Array<string>
Allowed values: card email phone
override_of
The contested answer this one takes to review instead (desk_override)
string format: uuid
recency_bucket
required
How recent the newest matching outcome is
string
Allowed values: none within_30_days within_180_days older
salt_epoch
required
The network salt generation the read was taken under
integer
subject_id
required
The subject's id
string
subject_kind
required
What the risk read was about
string
Allowed values: reservation payment charge person loyalty_redemption folio
provenance

Per-property source attribution and pins. An entry under properties means the property’s current value came from that source (on the source’s own clock, source_updated_at); an entry under pins is a human override protecting the property from sourced writes.

object
pins
object
key
additional properties
object
pinned_at
string format: date-time
pinned_by
object
reason
required
string
properties
object
key
additional properties
object
external_id
string
recorded_at
required
string format: date-time
source
required
string
source_updated_at
string format: date-time
stream
string
scope
required
One of: discriminator: level
object
level
required
string
Allowed value: tenant
Allowed values: tenant
tenant_id
required
string format: uuid
updated_at
required
string format: date-time
version
required
integer
>= 1
has_more
required
boolean
next_cursor

Cursor for the next page; omitted when the result set is exhausted.

string
Example
{
  "data": [
    {
      "object_type": "hospitality.fraud_network_signal",
      "properties": {
        "band_floor": "low",
        "contributor_breadth": "none",
        "floor_basis": "none",
        "kinds_queried": [
          "card"
        ],
        "match_count_bucket": "none",
        "matched_kinds": [
          "card"
        ],
        "recency_bucket": "none",
        "subject_kind": "reservation"
      },
      "scope": {
        "level": "tenant"
      }
    }
  ]
}

422

Section titled “422”

Validation error — unknown property or filter type mismatch.