:::endpoint PUT /v1/admin/fraud/detection

Change any part of [the detectors](/docs/api/admin/fraud-detection): the firm's
settings, what Restrict takes, and any number of detectors. What is left out
keeps its value. Each part that is sent is checked whole, by the rules the
website uses: half a `global` is refused rather than merged.

It takes effect at once. Access checks that were cached for a trader are thrown
away, so a detector put on Block refuses the next request.

Needs a firm. Our own staff name one with the `Propper-Workspace` header.

## Request

| Field       | Description |
| ----------- | ----------- |
| `global`    | All five of `enabled`, `sensitivity`, `notify_admins`, `escalation_enabled` and `escalation_score` (a whole number from 30 to 100, checked even while escalation is off) |
| `restrict`  | All four of `block_new_orders`, `hold_payouts`, `block_purchases` and `hold_affiliate_payouts`, each true or false |
| `detectors` | By key, each with a `level` and its `params`. A detector with thresholds needs `params`, and a threshold left out goes back to its default. An integer is a whole number from `min` to `max`, a choice one of its `options`, a country list up to 250 codes of two letters |

At least one of the three.

```bash
curl -X PUT "https://api.proppertrading.com/v1/admin/fraud/detection" \
  -H "Authorization: Bearer ptat_9f2c1a44_3b8e7d2f5c9a1b4e6d8f0a2c4e6b8d1f" \
  -H "Propper-Workspace: acme" \
  -H "Content-Type: application/json" \
  -d '{"detectors": {"max_countries": {"level": "flag", "params": {"max_countries": 4, "window_days": 30}}}}'
```

## Response

[The detectors](/docs/api/admin/fraud-detection) as they are now.

## Errors

| Status | Code                      | Meaning                                                                                                                                                                       |
| ------ | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 400    | `workspace_required`      | Asked by our own staff without naming a firm                                                                                                                                  |
| 401    | `invalid_token`           | Not a token, or the secret does not match                                                                                                                                     |
| 401    | `revoked_token`           | Signed out here or from another device                                                                                                                                        |
| 401    | `expired_token`           | Ninety days without use, or a set expiry passed                                                                                                                               |
| 403    | `admin_access_required`   | This account no longer helps run the environment                                                                                                                              |
| 403    | `insufficient_scope`      | This device does not hold `admin:write`                                                                                                                                       |
| 403    | `workspace_not_permitted` | The `Propper-Workspace` header names an environment this account cannot act in                                                                                                |
| 403    | `forbidden`               | Without `manage_fraud`                                                                                                                                                        |
| 422    | `validation_failed`       | Nothing to save, a part that is not whole, an unknown detector, a level or threshold out of range. `param` names the field, such as `detectors.shared_ip.params.max_accounts` |