--- title: "Create a Protect report" method: POST path: "/protect/report/create" tags: ["plaid"] --- # Create a Protect report `POST /protect/report/create` Use this endpoint to create a Protect report to document fraud incidents, investigation outcomes, or other risk events. This endpoint allows you to report various types of incidents including account takeovers, identity fraud, unauthorized transactions, and other security events. The reported data helps improve fraud detection models and provides valuable feedback to enhance the overall security of the Plaid network. Reports can be created for confirmed incidents that have been fully investigated, or for suspected incidents that require further review. You can associate reports with specific users, sessions, or transactions to provide comprehensive context about the incident. Each report must include `user_id`, or an `incident_event` with at least one supported identifier: `link_session_id`, `idv_session_id`, `protect_event_id`, `signal_client_transaction_id`, or `access_token`. Context fields such as `internal_reference`, `time`, `amount`, and `bank_account` do not satisfy this identifier requirement. ## Request body - ProtectReportCreateRequest — Request object for `/protect/report/create`. You must provide either `user_id`, or an `incident_event` with at least one supported identifier: `link_session_id`, `idv_session_id`, `protect_event_id`, `signal_client_transaction_id`, or `access_token`. Context fields such as `internal_reference`, `time`, `amount`, and `bank_account` do not satisfy this identifier requirement. - `client_id` string — Your Plaid API `client_id`. The `client_id` is required and may be provided either in the `PLAID-CLIENT-ID` header or as part of a request body. - `secret` string — Your Plaid API `secret`. The `secret` is required and may be provided either in the `PLAID-SECRET` header or as part of a request body. - `user_id` string — The Plaid User ID associated with the report. - `incident_event` ProtectIncidentEvent, nullable — Details about the incident event. - `protect_event_id` string, nullable — A globally unique identifier representing a Protect event that may be associated with this incident. - `link_session_id` string, nullable — A unique identifier for a Link session that may be associated with this incident. - `idv_session_id` string, nullable — A unique identifier for an Identity Verification session that may be associated with this incident. - `signal_client_transaction_id` string, nullable — The unique ID used to refer to a Signal transaction evaluation that may be associated with this incident. - `internal_reference` string, nullable — A unique ID representing the incident in your system. Personally identifiable information, such as an email address or phone number, should not be used in this field. - `time` string, date-time, nullable — The timestamp when the incident occurred, in ISO 8601 format (e.g., '2020-07-24T03:26:02Z'). - `amount` ProtectIncidentAmount, nullable — The monetary amount associated with the incident. - `iso_currency_code` string, nullable — The ISO-4217 currency code of the incident amount. Defaults to `USD` if not specified. - `value` number, double, required — The monetary value of the incident amount. - `access_token` string, nullable — The access token associated with the Item for which data is being requested. - `item_id` string, nullable — An `item_id` associated with the Item related to this incident. To identify an Item when creating a report, provide `access_token`. - `report_confidence` 'CONFIRMED' | 'SUSPECTED', required — The confidence level of the incident report. `CONFIRMED` indicates the incident has been verified and definitively occurred. `SUSPECTED` indicates the incident is believed to have occurred but has not been fully verified. - `report_type` 'USER_ACCOUNT_TAKEOVER' | 'FALSE_IDENTITY' | 'STOLEN_IDENTITY' | 'SYNTHETIC_IDENTITY' | 'MULTIPLE_USER_ACCOUNTS' | 'SCAM_VICTIM' | 'BANK_ACCOUNT_TAKEOVER' | 'BANK_CONNECTION_REVOKED' | 'CARD_TESTING' | 'UNAUTHORIZED_TRANSACTION' | 'CARD_CHARGEBACK' | 'ACH_RETURN' | 'DISPUTE' | 'FIRST_PARTY_FRAUD' | 'MISSED_PAYMENT' | 'LOAN_STACKING' | 'MONEY_LAUNDERING' | 'NO_FRAUD' | 'OTHER', required — The type of incident being reported. `USER_ACCOUNT_TAKEOVER` - Indicates that a legitimate user's account was accessed or controlled by an unauthorized party. `FALSE_IDENTITY` - Indicates that a user created an account using stolen or fabricated identity information. `STOLEN_IDENTITY` - Indicates that a user created an account using identity information belonging to a real individual without their consent. `SYNTHETIC_IDENTITY` - Indicates that a user created an account using a fake or partially fabricated identity (e.g., combining real and fake information to form a new persona). `MULTIPLE_USER_ACCOUNTS` - Indicates that the same individual is operating multiple accounts in violation of policy. `SCAM_VICTIM` - Indicates that the user was tricked into authorizing or sending funds as part of a scam. `BANK_ACCOUNT_TAKEOVER` - Indicates that a user's linked bank account was accessed or misused by an unauthorized party. `BANK_CONNECTION_REVOKED` - Indicates that a linked bank account connection was revoked by the financial institution, often due to suspected misuse, fraud, or security concerns. `CARD_TESTING` - Indicates that a card was used in small or repeated transactions to test its validity. `UNAUTHORIZED_TRANSACTION` - Indicates that a transaction was made without the user's consent or authorization. `CARD_CHARGEBACK` - Indicates that a card transaction was reversed via a chargeback claim. `ACH_RETURN` - Indicates that an ACH transaction was returned or reversed by the bank. `DISPUTE` - Indicates that a user filed a dispute regarding a transaction or account activity. `FIRST_PARTY_FRAUD` - Indicates that a user intentionally misrepresented themselves or their actions for financial gain. `MISSED_PAYMENT` - Indicates that a user failed to make a required payment on time. `LOAN_STACKING` - Indicates that a user applied for or took out multiple loans simultaneously beyond their ability to repay. `MONEY_LAUNDERING` - Indicates that funds are being moved through accounts to obscure their illicit origin. `NO_FRAUD` - Indicates that an investigation determined no fraudulent activity occurred on user/event (positive label). `OTHER` - Indicates that the case involves fraud or financial risk not covered by other report types. Requires notes describing the report. - `report_source` 'INTERNAL_REVIEW' | 'USER_SELF_REPORTED' | 'BANK_FEEDBACK' | 'NETWORK_FEEDBACK' | 'AUTOMATED_SYSTEM' | 'THIRD_PARTY_ALERT' | 'OTHER', required — The source that identified or reported the incident. `INTERNAL_REVIEW` - Incident was identified through internal fraud investigations or review processes. `USER_SELF_REPORTED` - Incident was reported directly by the affected user. `BANK_FEEDBACK` - Incident was identified through bank feedback, including ACH returns and connection revocations. `NETWORK_FEEDBACK` - Incident was identified through card network alerts or chargebacks. `AUTOMATED_SYSTEM` - Incident was detected by automated systems such as fraud models or rule engines. `THIRD_PARTY_ALERT` - Incident was identified through external vendor or consortium alerts. `OTHER` - Incident was identified through a source not covered by other categories. - `bank_account` ProtectBankAccount, nullable — Bank account information associated with the incident. - `account_id` string, nullable — Plaid's unique identifier for the account. - `account_number` string, nullable — Full account number of the bank account. - `routing_number` string, nullable — Routing number of the bank account. Must be present if `account_number` is present. - `ach_return_code` string, nullable — Must be a valid ACH return code (e.g. `R01`), required if `report_type` is `ACH_RETURN`. - `notes` string, nullable — Additional context or details about the report, required if `report_type` is `OTHER`. ## Response `200` OK - ProtectReportCreateResponse — Response object for /protect/report/create - `report_id` string, required — A unique identifier representing the submitted report. - `request_id` string, required — A unique identifier for the request, which can be used for troubleshooting. This identifier, like all Plaid identifiers, is case sensitive. --- [API](https://skmtc.net/plaid/apis/the-plaid-api.md) · [All operations](https://skmtc.net/plaid/apis/the-plaid-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/plaid/the-plaid-api/versions/64c4514ea59b/schema)