:::endpoint GET /v1/admin/payouts/{payout}/fraud

The tab Fraud of the website's Payouts screen: the flags involving the
trader, open ones first, the restrictions in force and what they take, and the
overrides made for them. A restriction is lifted by its `id`, with
[lift a fraud restriction](/docs/api/admin/fraud-restriction-lift).

Needs a firm. Our own staff name one with the `Propper-Workspace` header.

## Request

```bash
curl "https://api.proppertrading.com/v1/admin/payouts/po_pk2jjt25cw5swbwv/fraud" \
  -H "Authorization: Bearer ptat_9f2c1a44_3b8e7d2f5c9a1b4e6d8f0a2c4e6b8d1f" \
  -H "Propper-Workspace: acme"
```

## Response

```json
{
    "data": {
        "object": "payout_fraud",
        "flags": [
            {
                "id": "fflag_a7gfz99ayqrn7yda",
                "detector": "shared_device",
                "category": "device",
                "label": "Shared device",
                "score": 70,
                "severity": "high",
                "level": "flag",
                "status": "open",
                "subject": "dxFeed E2E",
                "others": 2,
                "ip": "127.0.0.1",
                "restricted": false,
                "created_at": "2026-09-30T16:27:50+00:00",
                "reviewed_at": null
            }
        ],
        "total": 1,
        "restrictions": [],
        "takes": [],
        "overrides": []
    },
    "meta": {
        "request_id": "req_01m50qhejqe3mgt8v6zs1fa977"
    }
}
```

| Field          | Description |
| -------------- | ----------- |
| `flags`        | Up to fifty flags involving the trader, open ones first, then newest first. `label` is the detector's name in words, `subject` the person it is about and `others` how many more it involves |
| `total`        | Every flag involving the trader, closed ones too |
| `restrictions` | What fraud detection holds against the trader now, each with its `detector` and `detector_name` in words, the `flag` that caused it and `since` |
| `takes`        | What a restriction takes from a trader in this firm, such as `hold_payouts` |
| `overrides`    | Exceptions made for the trader, with the `detector` and `detector_name`, the `level`, the `reason`, `expires_at` and whether it is `active` |

## Errors

| Status | Code                      | Meaning                                                                         |
| ------ | ------------------------- | ------------------------------------------------------------------------------- |
| 400    | `workspace_required`      | Asked by our own staff without naming a firm                                    |
| 401    | `invalid_token`           | Not a token, or the secret does not match                                       |
| 401    | `revoked_token`           | Signed out here or from another device                                          |
| 401    | `expired_token`           | Ninety days without use, or a set expiry passed                                 |
| 403    | `admin_access_required`   | This account no longer helps run the environment                                |
| 403    | `insufficient_scope`      | This device does not hold `admin:read`                                          |
| 403    | `workspace_not_permitted` | The `Propper-Workspace` header names an environment this account cannot act in |
| 403    | `forbidden`               | Without `view_payouts` and `view_fraud`                                                            |
| 404    | `resource_not_found`      | No payout with that id in this firm                                             |