openapi: 3.2.0
info:
  title: Silverflow Fraud Notification Events API
  version: 1.417.0
  contact:
    name: API Support
    email: support@silverflow.com
  license:
    name: Commercial
  description: 'Operations tagged Fraud Notification Events across 2 of this provider''s published API definitions: silverflow-openapi.yml, silverflow-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://eu-west-1.api.silverflow.com/v1
  description: Production URL for Europe - Equivalent to https://api.silverflow.co/v1
- url: https://us-east-2.api.silverflow.com/v1
  description: Production URL for North America
- url: https://eu-west-1.api-sbx.silverflow.com/v1
  description: Sandbox URL - Equivalent to https://api-sbx.silverflow.co/v1
security:
- ApiKey: []
- BearerToken: []
tags:
- name: Fraud Notification Events
  description: ' '
paths: {}
webhooks:
  events.fraudNotifications:
    post:
      summary: Received
      security: []
      operationId: fraudNotificationEvent
      tags:
      - Fraud Notification Events
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FraudNotificationEventNotificationVersion1_0Received'
      responses:
        default:
          description: Event Notification that is sent when a Fraud Notification is received.
    servers:
    - url: https://eu-west-1.api.silverflow.com/v1
      description: Production URL for Europe - Equivalent to https://api.silverflow.co/v1
    - url: https://us-east-2.api.silverflow.com/v1
      description: Production URL for North America
    - url: https://eu-west-1.api-sbx.silverflow.com/v1
      description: Sandbox URL - Equivalent to https://api-sbx.silverflow.co/v1
components:
  schemas:
    source:
      type: string
      description: Source system of the event.
      pattern: ^https://silverflow.com/[a-zA-Z]+$
    time:
      type: string
      format: date-time
      description: Date and time when the event was sent.
    schemas-fraudNotificationKey:
      description: Uniquely identifies a Fraud Notification.
      type: string
      pattern: ^frn-[a-zA-Z0-9]+$
      minLength: 1
      maxLength: 120
      readOnly: false
      example: frn-1JRadf2ffdfrdPMf2XrS2
    PublicCloudEvent:
      type: object
      required:
      - id
      - source
      - specversion
      - type
      - datacontenttype
      - dataschema
      - subject
      - time
      - agent
      - data
      properties:
        id:
          $ref: '#/components/schemas/eventId'
        specversion:
          allOf:
          - description: The version of the current spec.
          - enum:
            - '1.0'
          - $ref: '#/components/schemas/openapi_components-schemas-version-3'
        datacontenttype:
          $ref: '#/components/schemas/dataContentType'
        dataschema:
          $ref: '#/components/schemas/dataschema'
        time:
          $ref: '#/components/schemas/time'
        agent:
          $ref: '#/components/schemas/common_agentKey'
    schemas-fraudReportingDate:
      description: Date when the Fraud Notification was received by the Card Network. This is specific for each network. For Mastercard this is the TLL8 "Fraud Posted Date". For VISA this is the TC90 "Processing Date".
      format: date
      example: '2021-05-28'
    openapi_components-schemas-cardNetwork-3:
      type: string
      description: The card network.
      enum:
      - mastercard
      - visa
      - american-express
    common_agentKey:
      description: Uniquely identifies an Agent.
      type: string
      pattern: ^cgt-[a-zA-Z0-9]+$
      readOnly: true
      example: cgt-EFG67b4yPre23ZDrLX
      title: agentKey
    acquirerReferenceNumber:
      description: Unique identifier assigned by the acquirer at clearing. Used to identify the transaction with the card networks.
      type: string
      pattern: ^\d+$
      minLength: 23
      maxLength: 23
      readOnly: false
      example: '12345678901234567890123'
    dataschema:
      type: string
      description: The event schema with the data version of the event.
    openapi_components-schemas-version-3:
      type: string
      description: The version of the spec.
      pattern: ^[1-9]+.[0-9]+$
      example: '1.0'
    common_version:
      type: integer
      description: The version of this object.
      format: int64
      minimum: 1
      maximum: 1000
      example: 1
      readOnly: false
    FraudNotificationEventNotificationVersion1_0:
      type: object
      allOf:
      - $ref: '#/components/schemas/PublicCloudEvent'
      required:
      - data
      properties:
        data:
          $ref: '#/components/schemas/FraudNotificationEventDataVersion1_0'
        source:
          allOf:
          - $ref: '#/components/schemas/source'
          - enum:
            - https://silverflow.com/fraudNotifications
        specversion:
          allOf:
          - $ref: '#/components/schemas/openapi_components-schemas-version-3'
          - enum:
            - '1.0'
        subject:
          allOf:
          - description: The subject key, which is a `key`.
          - $ref: '#/components/schemas/schemas-fraudNotificationKey'
        type:
          $ref: '#/components/schemas/fraudNotificationEventType'
        dataschema:
          allOf:
          - $ref: '#/components/schemas/dataschema'
          - example: https://silverflow.com/schemas/events/fraudNotifications/1.0
          - enum:
            - https://silverflow.com/schemas/events/fraudNotifications/1.0
    openapi_components-schemas-created-4:
      type: string
      description: The date and time this object was created.
      format: date-time
      readOnly: false
    openapi_components-schemas-chargeKey-2:
      description: Uniquely identifies a Charge.
      type: string
      pattern: ^chg-[a-zA-Z0-9]+$
      minLength: 1
      maxLength: 120
      readOnly: false
      example: chg-1e1dAHhgstYTUhlphPzZ
    FraudNotificationEventNotificationVersion1_0Received:
      type: object
      allOf:
      - $ref: '#/components/schemas/FraudNotificationEventNotificationVersion1_0'
      properties:
        type:
          allOf:
          - $ref: '#/components/schemas/fraudNotificationEventType'
          - enum:
            - com.silverflow.fraudNotifications.received
    FraudNotificationEventDataVersion1_0:
      type: object
      description: The event data.
      required:
      - key
      - arn
      - chargeKey
      - network
      - fraudTypeCode
      - fraudReportingDate
      - created
      - version
      properties:
        key:
          $ref: '#/components/schemas/schemas-fraudNotificationKey'
        arn:
          $ref: '#/components/schemas/acquirerReferenceNumber'
        chargeKey:
          $ref: '#/components/schemas/openapi_components-schemas-chargeKey-2'
        network:
          $ref: '#/components/schemas/openapi_components-schemas-cardNetwork-3'
        fraudTypeCode:
          type: string
          example: '01'
        fraudSubTypeCode:
          type: string
          example: N
        fraudReportingDate:
          $ref: '#/components/schemas/schemas-fraudReportingDate'
        created:
          $ref: '#/components/schemas/openapi_components-schemas-created-4'
        version:
          $ref: '#/components/schemas/common_version'
    fraudNotificationEventType:
      type: string
      description: The event type.
      pattern: ^com.silverflow.fraudNotifications.[a-zA-Z]+$
      example: com.silverflow.fraudNotifications.received
    eventId:
      type: string
      description: Uniquely identifies an event.
      pattern: ^evt-[a-zA-Z0-9]+$
      minLength: 5
      maxLength: 120
      example: evt-1e1dAHhgstYTUhlphPzZ
    dataContentType:
      type: string
      description: The content type of the event.
      enum:
      - application/json
  securitySchemes:
    ApiKey:
      description: "The primary method of authenticating to the Silverflow API is through API keys.\n\nAPI keys can be created by calling the [createApiKey](#operation/createApiKey) endpoint. You can create up to 40 API keys and also update and delete them, allowing for _credential rotation_.\n\nThe _Agent Activation_ process will generate an initial API Key for you. See [Activate Agent](#section/Getting-Started).\n\nA call to the [createApiKey](#operation/createApiKey) endpoint will return the following structure:\n\n```json\n{\n    \"key\": \"apk-1wtRxni5IsPsSpBLWpwr\",\n    \"status\": \"active\",\n    \"agentKey\": \"cgt-1wtRvFLIjDOyyUR5Q2LB\",\n    \"description\": \"Data lake API key\",\n    \"permissions\": [\n        \"charges:List\",\n        \"reports:All\"\n    ],\n    \"created\": \"2021-06-22T11:21:45.115Z\",\n    \"secret\": \"FWtnOOHAjbD6rNxWWEeVOCj7JXSEPGJQ\",\n    \"version\": 1\n}\n```\n\n> **Important:** The `secret` is only returned once in the response to the `createApiKey` call.\n\nOnce created, the `key` and `secret` fields from the API key must be used in the HTTP `Authorization` header using the `Basic` scheme.\nThe Basic scheme requires a **username** and **password** to be specified, separated by a `:` (colon) and Base64 encoded.\n\nUse the following values from the API key to construct a Basic authentication header:\n\n| Basic field | API key field | Example |\n| ----------- | ------------- | ------- |\n| username | `key` | `apk-1wtRxni5IsPsSpBLWpwr` |\n| password | `secret` | `FWtnOOHAjbD6rNxWWEeVOCj7JXSEPGJQ` |\n\nIn pseudo-code a valid HTTP Basic Authentication header would be constructed as follows:\n\n```ts\nconst apiKeyId = \"apk-1wtRxni5IsPsSpBLWpwr\";\nconst apiKeySecret = \"FWtnOOHAjbD6rNxWWEeVOCj7JXSEPGJQ\";\nconst authnValue = \"Basic \" + base64Encode(apiKeyId + \":\" + apiKeySecret);\nrequest.setHeader(\"Authorization\", authnValue);\n```\n\nUsing the values from the example a valid HTTP request would look like the following:\n\n```http\nGET /v1/agents/current HTTP/1.1\nAccept: application/json\nAuthorization: Basic YXBrLTF3dFJ4bmk1SXNQc1NwQkxXcHdyOkZXdG5PT0hBamJENnJOeFdXRWVWT0NqN0pYU0VQR0pR\n```\n\nMore information on the Basic scheme can be found in [RFC-7617 - The 'Basic' HTTP Authentication Scheme](https://datatracker.ietf.org/doc/html/rfc7617)."
      type: http
      scheme: basic
    BearerToken:
      description: 'Bearer tokens are temporary security credentials that can be used to authorize ''third parties'' (bearers) access to the Silverflow API on behalf of the agent.


        These tokens are created by calling the [createAgentBearerToken](#operation/createAgentBearerToken) endpoint.


        Once created the `token` field must be used in the HTTP `Authorization` header using the `Bearer` scheme.

        Here''s an example of an HTTP request with a bearer token:


        ```http

        GET /v1/merchants/mct-1hPdFhmgaBzMS191nIbJ HTTP/1.1

        Accept: application/json

        Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...40EFOgxf_3I6mPZ16bXqHd5tUyApgl0mNOAXPm5AhnA


        ```


        More information on the Bearer scheme can be found in [RFC-6750 - The OAuth 2.0 Authorization Framework: Bearer Token Usage](https://datatracker.ietf.org/doc/html/rfc6750).'
      type: http
      scheme: bearer
      bearerFormat: JWT
    MutualTLS:
      type: apiKey
      in: header
      name: '-'
      description: 'The client must set up mTLS connection with a valid X.509 client certificate signed by a customer-provided CA (certificate authority) that is registered to a specific agent. The customer-provided CA certificate must be shared and added to Silverflow''s trust store prior to calling endpoints.


        Certificate validation happens at the transport layer during TLS handshake. Tenant verification is performed by matching the agent key embedded in the client certificate against the agent key embedded in the trusted CA.

        '
x-refined-from:
- silverflow-openapi.yml
- silverflow-openapi.yml
x-tagGroups:
- name: ''
  tags:
  - Introduction
  - Release Notes
- name: Accounts
  tags:
  - Agents
  - API Keys
  - Bins
  - Merchants
  - Merchant Acceptors
  - Enrollments
  - Screenings
- name: Event Notifications
  tags:
  - Event Subscriptions
  - Charges Events
  - Disputes Events
  - Fraud Notification Events
  - Processor Tokens Events
  - Network Tokens Events
  - Report Events
  - Distribution Events
  - AMMF Submission Events
  - Reconciliation Events
  - Clearing Events
- name: 3DS Authentication
  tags:
  - 3DS Authentication
- name: BEP Authentication
  tags:
  - BEP Authentication
- name: Tokenization
  tags:
  - Processor Tokenization
  - Network Tokenization
- name: Charges
  tags:
  - Create Charges
  - Create Recurring
  - Retrieve Charges
  - Charge Actions
- name: Terminal-To-Cloud
  tags:
  - Create POS Charges
  - Retrieve POS Charges
  - POS Charge Actions
- name: Card Management
  tags:
  - Card Management
- name: Disputes
  tags:
  - Disputes
  - Documents
- name: Fraud Notifications
  tags:
  - Fraud Notifications
- name: Card Info
  tags:
  - Card Info
- name: Currency Conversion Rates
  tags:
  - Currency Conversion Rates
- name: Fees
  tags:
  - Fees
- name: Reconciliation
  tags:
  - Reconciliation Details
  - Network Funds Transfers
- name: Reports
  tags:
  - Reconciliation Reports
  - Settlement Reports
  - Card Network Reports
  - Dispute Reports
  - Fraud Notifications Reports
  - Charges Reports
  - Scheme Fee Reports
  - Retrieve Reports
  - Report Scheduling
  - Distributions
- name: Transaction Risk Assessment
  tags:
  - Transaction Risk Assessment
- name: File Subscriptions
  tags:
  - File Subscriptions