Webhook events

fraud.flagged

Sent when fraud rules fired on a new completed order or milestone report. It covers every rule in fraudRuleIds. Self-referral matches keep their own self_referral.detected event, and a referral that triggers both sends both. blocked: the program created no reward. review: rewardId names the reward held as pending. flagged: rewardId names a reward that follows the usual approval. rules lists rule IDs and signal types, never values.

Example payload

This illustrative payload follows the current event validator. Amounts use minor units.

json

{
  "id": "00000000-0000-4000-8000-000000000001",
  "companyId": "company-example",
  "type": "fraud.flagged",
  "data": {
    "action": "blocked",
    "rules": [
      {
        "rule": "duplicate_accounts",
        "action": "blocked",
        "signals": [
          "email"
        ]
      }
    ],
    "partnerId": "partner-example",
    "partnerExternalId": "merchant-partner-001",
    "eventId": "payment-example",
    "programId": "program-example",
    "customerId": "customer-example",
    "trigger": "order",
    "orderId": "order-example"
  },
  "createdAt": "2026-10-11T12:00:00.000Z"
}

Payload fields

Field	Type	Required
`action`	"blocked", "review", "flagged"	Yes
`rules`	array	Yes
`partnerId`	string	Yes
`partnerExternalId`	string	Yes
`eventId`	string	Yes
`programId`	string	Yes
`customerId`	string	Yes
`rewardId`	string	No

rules[]

Field	Type	Required
`rules.rule`	"duplicate_accounts", "rapid_repeats", "repeat_customer", "disposable_email"	Yes
`rules.action`	"blocked", "review", "flagged"	Yes
`rules.signals`	array	Yes
`rules.count`	integer	No

Variant 1

Field	Type	Required	Details
`trigger`	"order"	Yes
`orderId`	string	Yes

Variant 2

Field	Type	Required	Details
`trigger`	"milestone"	Yes
`milestone`	string	Yes

Payload schema

json

{
  "allOf": [
    {
      "type": "object",
      "properties": {
        "action": {
          "type": "string",
          "enum": [
            "blocked",
            "review",
            "flagged"
          ]
        },
        "rules": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "rule": {
                "type": "string",
                "enum": [
                  "duplicate_accounts",
                  "rapid_repeats",
                  "repeat_customer",
                  "disposable_email"
                ]
              },
              "action": {
                "type": "string",
                "enum": [
                  "blocked",
                  "review",
                  "flagged"
                ]
              },
              "signals": {
                "type": "array",
                "items": {
                  "type": "string",
                  "enum": [
                    "email",
                    "phone",
                    "card",
                    "device",
                    "ip"
                  ]
                }
              },
              "count": {
                "type": "integer",
                "exclusiveMinimum": 0
              }
            },
            "required": [
              "rule",
              "action",
              "signals"
            ],
            "additionalProperties": true
          }
        },
        "partnerId": {
          "type": "string",
          "minLength": 1
        },
        "partnerExternalId": {
          "type": "string",
          "minLength": 1
        },
        "eventId": {
          "type": "string",
          "minLength": 1
        },
        "programId": {
          "type": "string",
          "minLength": 1
        },
        "customerId": {
          "type": "string",
          "minLength": 1
        },
        "rewardId": {
          "type": "string",
          "minLength": 1
        }
      },
      "required": [
        "action",
        "rules",
        "partnerId",
        "partnerExternalId",
        "eventId",
        "programId",
        "customerId"
      ],
      "additionalProperties": true
    },
    {
      "anyOf": [
        {
          "type": "object",
          "properties": {
            "trigger": {
              "type": "string",
              "const": "order"
            },
            "orderId": {
              "type": "string",
              "minLength": 1
            }
          },
          "required": [
            "trigger",
            "orderId"
          ],
          "additionalProperties": true
        },
        {
          "type": "object",
          "properties": {
            "trigger": {
              "type": "string",
              "const": "milestone"
            },
            "milestone": {
              "type": "string",
              "minLength": 1
            }
          },
          "required": [
            "trigger",
            "milestone"
          ],
          "additionalProperties": true
        }
      ]
    }
  ]
}

Handle delivery

Verify the signature over the raw body before parsing JSON. Check that the body ID matches Grizzlee-Event-Id. Process each ID once, since delivery can repeat.