:::endpoint POST /v1/admin/fraud/overrides

Make an exception for one trader on one detector. It takes effect at once:
access checks cached for the trader are thrown away.

A trader has at most one override per detector. Asking for a second is refused
with `409 override_exists`, which names the one in the way in `override`, so
the app can open that one instead.

Needs a firm. Our own staff name one with the `Propper-Workspace` header.

## Request

| Field        | Description |
| ------------ | ----------- |
| `user_id`    | The trader, by id. A trader of this firm who has not deleted their account |
| `detector`   | The detector's key. Not a trading rule |
| `level`      | `off`, `monitor`, `flag`, `restrict` or `block`, or null to keep the firm's level. Off exempts the trader, and an override can switch on for one trader a detector the firm has off |
| `params`     | Only the thresholds that differ, by key, and only those the detector's `fields` mark `overridable`. Ranges as for [the detectors](/docs/api/admin/fraud-detection-update) |
| `reason`     | Up to 1000 characters |
| `expires_at` | An instant after now, or null for no end. The website sends the end of the chosen day in the admin's own time zone |

A level or at least one threshold, or there is nothing to override.

```bash
curl -X POST "https://api.proppertrading.com/v1/admin/fraud/overrides" \
  -H "Authorization: Bearer ptat_9f2c1a44_3b8e7d2f5c9a1b4e6d8f0a2c4e6b8d1f" \
  -H "Propper-Workspace: acme" \
  -H "Idempotency-Key: 2a4c6e8b-0d2f-4a4c-9e6b-8d0f2a4c6e8a" \
  -H "Content-Type: application/json" \
  -d '{"user_id": "usr_aqms4nt797jdkttb", "detector": "max_countries", "params": {"max_countries": 8}, "reason": "Travels for work, asked by email on 3 October.", "expires_at": "2026-12-09T22:59:59Z"}'
```

## Response

`201`, with the new [override](/docs/api/admin/fraud-override).

## Errors

| Status | Code                      | Meaning                                                                                                                                                                           |
| ------ | ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 400    | `workspace_required`      | Asked by our own staff without naming a firm                                                                                                                                      |
| 400    | `missing_idempotency_key` | A POST without an `Idempotency-Key` header                                                                                                                                        |
| 401    | `invalid_token`           | Not a token, or the secret does not match                                                                                                                                         |
| 401    | `revoked_token`           | Signed out here or from another device                                                                                                                                            |
| 401    | `expired_token`           | Ninety days without use, or a set expiry passed                                                                                                                                   |
| 403    | `admin_access_required`   | This account no longer helps run the environment                                                                                                                                  |
| 403    | `insufficient_scope`      | This device does not hold `admin:write`                                                                                                                                           |
| 403    | `workspace_not_permitted` | The `Propper-Workspace` header names an environment this account cannot act in                                                                                                    |
| 403    | `forbidden`               | Without `manage_fraud`                                                                                                                                                            |
| 409    | `override_exists`         | The trader already has an override on this detector, named in `override`                                                                                                          |
| 422    | `validation_failed`       | No such trader or detector, nothing to override, a threshold this detector does not let one trader change, or one out of range, a reason over 1000 characters, an end in the past |