:::endpoint GET /v1/admin/fraud/detection/{detector}

One detector as [the list](/docs/api/admin/fraud-detection) has it, with the
people behind it: up to six of its open flags, the highest score first, and up
to six of its exceptions, the most recently changed first. Every open flag is
in the [flags](/docs/api/admin/fraud-flags) with `q` set to the detector's key,
every exception in the [overrides](/docs/api/admin/fraud-overrides) of that
detector.

`{detector}` is the detector's key, such as `max_countries`.

Needs a firm. Our own staff name one with the `Propper-Workspace` header.

## Request

```bash
curl "https://api.proppertrading.com/v1/admin/fraud/detection/max_countries" \
  -H "Authorization: Bearer ptat_9f2c1a44_3b8e7d2f5c9a1b4e6d8f0a2c4e6b8d1f" \
  -H "Propper-Workspace: acme"
```

## Response

{
    "data": {
        "object": "fraud_detector",
        "key": "max_countries",
        "name": "Too many countries",
        "description": "One account logging in from more countries than one person plausibly visits.",
        "category": "geo",
        "default_level": "flag",
        "access": false,
        "group": false,
        "level": "flag",
        "params": {
            "max_countries": 3,
            "window_days": 30
        },
        "overrides": 1,
        "flags_30d": 1,
        "open_flags": 1,
        "exposure": {
            "by_country_count": {
                "1": 11
            }
        },
        "fields": [
            {
                "key": "max_countries",
                "type": "integer",
                "default": 3,
                "min": 1,
                "max": 50,
                "unit": "",
                "options": [],
                "overridable": true,
                "label": "Countries allowed",
                "hint": "Distinct countries an account may log in from inside the window."
            },
            {
                "key": "window_days",
                "type": "integer",
                "default": 30,
                "min": 1,
                "max": 90,
                "unit": "d",
                "options": [],
                "overridable": true,
                "label": "Window",
                "hint": "The rolling period the countries are counted over."
            }
        ],
        "flags": [
            {
                "object": "fraud_flag",
                "id": "fflag_3x85eqb6rv9shy56",
                "detector": "max_countries",
                "category": "geo",
                "label": "Too many countries",
                "score": 71,
                "severity": "high",
                "level": "flag",
                "status": "open",
                "subject": "Aisha Moreau",
                "others": 0,
                "ip": "203.0.113.45",
                "restricted": false,
                "created_at": "2026-10-07T19:26:51+00:00",
                "reviewed_at": null,
                "action_url": "/admin/fraud?flag=fflag_3x85eqb6rv9shy56"
            }
        ],
        "exceptions": [
            {
                "object": "fraud_override",
                "id": "fovr_n936unrak5zz8u2k",
                "trader": {
                    "id": "usr_3mc4m89ax3excay2",
                    "name": "Tomasz Ahmed"
                },
                "level": null,
                "params": {
                    "max_countries": 8
                },
                "expires_at": "2026-12-09T19:26:51+00:00",
                "action_url": "/admin/fraud/overrides?override=fovr_n936unrak5zz8u2k"
            }
        ]
    },
    "meta": {
        "request_id": "req_01m50zcm4sy1vv4b4xy7cvhnqp"
    }
}

`flags` are rows of [the flags](/docs/api/admin/fraud-flags). `exceptions` are
overrides in force, each with the `trader` (null for a deleted account), the
`level` it sets or null to keep the firm's, the `params` it changes and when it
`expires_at`.

## Errors

| Status | Code                      | Meaning                                                                         |
| ------ | ------------------------- | ------------------------------------------------------------------------------- |
| 400    | `workspace_required`      | Asked by our own staff without naming a firm                                    |
| 401    | `invalid_token`           | Not a token, or the secret does not match                                       |
| 401    | `revoked_token`           | Signed out here or from another device                                          |
| 401    | `expired_token`           | Ninety days without use, or a set expiry passed                                 |
| 403    | `admin_access_required`   | This account no longer helps run the environment                                |
| 403    | `insufficient_scope`      | This device does not hold `admin:read`                                          |
| 403    | `workspace_not_permitted` | The `Propper-Workspace` header names an environment this account cannot act in  |
| 403    | `forbidden`               | Without `view_fraud`                                                            |
| 404    | `resource_not_found`      | No detector with that key                                                       |