---
title: "Finalize case"
method: POST
path: "/v1/{id}/finalize"
tags: ["Update Fraud Case"]
---

# Finalize case

`POST /v1/{id}/finalize`

Finalizes the fraud case identified by `{id}`. This action is allowed only if
every transaction in the case has `customerDecision = RISK` or `NO_RISK`.

Once finalized:
  - All transactions become immutable.
  - Case status is set to `CLOSED`.
  - An optional comment can be stored on the case
  - `resolutionStatus` is derived for the case:
      - `NO_RISK` if all transactions are `NO_RISK`
      - `RISK` if at least one transaction is `RISK`

## Path parameters

- `id` string, uuid, required

## Query parameters

- `auditUser` string, required

## Request body

- FinalizeCaseRequest
  - `comment` string, nullable — Optional plain text comment on case (set via PATCH or finalize).

## Response `200`

Case finalized successfully — returns updated case

- FraudCaseResponse
  - `id` string, uuid, required — Unique identifier of the fraud case
  - `status` 'OPEN' | 'PENDING' | 'CLOSED', required — Current status of the fraud case
  - `cardId` string, biginteger, required — Unique identifier of the card on the fraud case
  - `createdTime` string, date-time, required — Time when the fraud case was created
  - `lastUpdatedTime` string, date-time, required — Time when the fraud case was last updated
  - `comment` string, nullable — Optional plain text comment on case (set via PATCH or finalize).
  - `resolutionStatus` 'RISK' | 'NO_RISK' — Final case resolution derived when the case is CLOSED: - NO_RISK if all transactions are NO_RISK - RISK if at least one transaction is RISK Omitted for OPEN or PENDING cases.
  - `transactions` Transaction[], required — List of transactions associated with this case
    - `transactionId` string, required — Unique identifier of the transaction on the case
    - `customerDecision` 'PENDING' | 'NO_RISK' | 'RISK', required — Customer’s decision on this transaction
    - `customerComment` string, nullable — Optional plain text comment provided by the customer on this transaction
    - `lastUpdatedTime` string, date-time — Time when this transaction was last updated
    - `reason` union — Polymorphic reason associated with a non-PENDING decision.
      - object — Concrete `reason` object when `type = RISK`.
        - `type` 'RISK' | 'NO_RISK', required — Discriminator for the polymorphic reason object.
        - `code` 'ISSUANCE_OF_A_PAYMENT_ORDER_BY_FRAUDSTER' | 'LOST_OR_STOLEN_CARD' | 'CARD_NOT_RECEIVED' | 'COUNTERFEIT_CARD' | 'CARD_DETAILS_THEFT' | 'MODIFICATION_OF_A_PAYMENT_ORDER_BY_FRAUDSTER' | 'MANIPULATION_OF_PAYER' | 'UNAUTHORIZED_PAYMENT_TRANSACTION' | 'OTHER', required — Reason code to use when `customerDecision = RISK`.
      - object — Concrete `reason` object when `type = NO_RISK`.
        - `type` 'RISK' | 'NO_RISK', required — Discriminator for the polymorphic reason object.
        - `code` 'GENUINE', required — Reason code to use when `customerDecision = NO_RISK`.
    - `additionalAttributes` object — Optional key–value attributes. Omitted when empty. Keys and values may change without notice. Values may be primitives or objects.

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not found
- `409` — Conflict
- `422` — Unprocessable Entity
- `500` — Internal server error

---

[API](https://skmtc.net/enfuce/apis/transfer-api.md) · [All operations](https://skmtc.net/enfuce/apis/transfer-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/enfuce/transfer-api/versions/dc4a41118f80/schema)