---
title: "Get Protect user insights"
method: POST
path: "/protect/user/insights/get"
tags: ["plaid"]
---

# Get Protect user insights

`POST /protect/user/insights/get`

Use this endpoint to get basic information about a user as it relates to their fraud profile with Protect.

## Request body

- ProtectUserInsightsGetRequest — Request object for /protect/user/insights/get
  - `client_id` string — Your Plaid API `client_id`. The `client_id` is required and may be provided either in the `PLAID-CLIENT-ID` header or as part of a request body.
  - `secret` string — Your Plaid API `secret`. The `secret` is required and may be provided either in the `PLAID-SECRET` header or as part of a request body.
  - `user_id` string — The Plaid User ID. Either `user_id` or `client_user_id` must be provided.
  - `client_user_id` string — A unique ID representing the end user. Either `user_id` or `client_user_id` must be provided.

## Response `200`

OK

- ProtectUserInsightsGetResponse — Response object for /protect/user/insights/get
  - `user_id` string, required — The Plaid User ID. If a `client_user_id` was provided in the request instead of a `user_id`, a new `user_id` will be generated if one doesn't already exist for that `client_user_id`.
  - `latest_scored_event` LatestScoredEvent, nullable, required — The latest scored event for a user.
    - `event_id` string, required — The event ID.
    - `timestamp` string, date-time, required — The timestamp of the event, in [ISO 8601](https://wikipedia.org/wiki/ISO_8601) format, e.g. `"2017-09-14T14:42:19.350Z"`
    - `event_type` string — The type of event.
    - `trust_index` TrustIndex, nullable, required — Represents a calculated Trust Index Score.
      - `score` integer, required — The overall trust index score.
      - `model` string, required — The versioned name of the Trust Index model used for scoring.
      - `subscores` TrustIndexSubscores, nullable, required — Contains sub-score metadata.
        - `device_and_connection` TrustIndexSubscore, nullable — Represents Trust Index Subscore.
          - `score` integer, required — The subscore score.
        - `bank_account_insights` TrustIndexSubscore, nullable — Represents Trust Index Subscore.
          - `score` integer, required — The subscore score.
    - `fraud_attributes` FraudAttributes, nullable, required — Event fraud attributes as an arbitrary set of key-value pairs. The set of attributes returned varies by model.
  - `reports` ProtectReport[] — List of Protect reports associated with this user, limited to the most recent 100 reports in reverse chronological order (newest first).
    - `report_id` string, required — A unique identifier representing the submitted report.
    - `incident_event` ProtectIncidentEventResponse, nullable, required — Details about the incident event.
      - `protect_event_id` string, nullable — A globally unique identifier representing a Protect event that may be associated with this incident.
      - `link_session_id` string, nullable — A unique identifier for a Link session that may be associated with this incident.
      - `idv_session_id` string, nullable — A unique identifier for an Identity Verification session that may be associated with this incident.
      - `signal_client_transaction_id` string, nullable — The unique ID used to refer to a Signal transaction evaluation that may be associated with this incident.
      - `internal_reference` string, nullable — A unique ID representing the incident in your system. Personally identifiable information, such as an email address or phone number, should not be used in this field.
      - `time` string, date-time, nullable — The timestamp when the incident occurred, in ISO 8601 format (e.g., '2020-07-24T03:26:02Z').
      - `amount` ProtectIncidentAmount, nullable — The monetary amount associated with the incident.
        - `iso_currency_code` string, nullable — The ISO-4217 currency code of the incident amount. Defaults to `USD` if not specified.
        - `value` number, double, required — The monetary value of the incident amount.
      - `item_id` string, nullable — The `item_id` associated with the Item related to this incident.
    - `report_confidence` 'CONFIRMED' | 'SUSPECTED', required — The confidence level of the incident report. `CONFIRMED` indicates the incident has been verified and definitively occurred. `SUSPECTED` indicates the incident is believed to have occurred but has not been fully verified.
    - `report_type` 'USER_ACCOUNT_TAKEOVER' | 'FALSE_IDENTITY' | 'STOLEN_IDENTITY' | 'SYNTHETIC_IDENTITY' | 'MULTIPLE_USER_ACCOUNTS' | 'SCAM_VICTIM' | 'BANK_ACCOUNT_TAKEOVER' | 'BANK_CONNECTION_REVOKED' | 'CARD_TESTING' | 'UNAUTHORIZED_TRANSACTION' | 'CARD_CHARGEBACK' | 'ACH_RETURN' | 'DISPUTE' | 'FIRST_PARTY_FRAUD' | 'MISSED_PAYMENT' | 'LOAN_STACKING' | 'MONEY_LAUNDERING' | 'NO_FRAUD' | 'OTHER', required — The type of incident being reported. `USER_ACCOUNT_TAKEOVER` - Indicates that a legitimate user's account was accessed or controlled by an unauthorized party. `FALSE_IDENTITY` - Indicates that a user created an account using stolen or fabricated identity information. `STOLEN_IDENTITY` - Indicates that a user created an account using identity information belonging to a real individual without their consent. `SYNTHETIC_IDENTITY` - Indicates that a user created an account using a fake or partially fabricated identity (e.g., combining real and fake information to form a new persona). `MULTIPLE_USER_ACCOUNTS` - Indicates that the same individual is operating multiple accounts in violation of policy. `SCAM_VICTIM` - Indicates that the user was tricked into authorizing or sending funds as part of a scam. `BANK_ACCOUNT_TAKEOVER` - Indicates that a user's linked bank account was accessed or misused by an unauthorized party. `BANK_CONNECTION_REVOKED` - Indicates that a linked bank account connection was revoked by the financial institution, often due to suspected misuse, fraud, or security concerns. `CARD_TESTING` - Indicates that a card was used in small or repeated transactions to test its validity. `UNAUTHORIZED_TRANSACTION` - Indicates that a transaction was made without the user's consent or authorization. `CARD_CHARGEBACK` - Indicates that a card transaction was reversed via a chargeback claim. `ACH_RETURN` - Indicates that an ACH transaction was returned or reversed by the bank. `DISPUTE` - Indicates that a user filed a dispute regarding a transaction or account activity. `FIRST_PARTY_FRAUD` - Indicates that a user intentionally misrepresented themselves or their actions for financial gain. `MISSED_PAYMENT` - Indicates that a user failed to make a required payment on time. `LOAN_STACKING` - Indicates that a user applied for or took out multiple loans simultaneously beyond their ability to repay. `MONEY_LAUNDERING` - Indicates that funds are being moved through accounts to obscure their illicit origin. `NO_FRAUD` - Indicates that an investigation determined no fraudulent activity occurred on user/event (positive label). `OTHER` - Indicates that the case involves fraud or financial risk not covered by other report types. Requires notes describing the report.
    - `report_source` 'INTERNAL_REVIEW' | 'USER_SELF_REPORTED' | 'BANK_FEEDBACK' | 'NETWORK_FEEDBACK' | 'AUTOMATED_SYSTEM' | 'THIRD_PARTY_ALERT' | 'OTHER', required — The source that identified or reported the incident. `INTERNAL_REVIEW` - Incident was identified through internal fraud investigations or review processes. `USER_SELF_REPORTED` - Incident was reported directly by the affected user. `BANK_FEEDBACK` - Incident was identified through bank feedback, including ACH returns and connection revocations. `NETWORK_FEEDBACK` - Incident was identified through card network alerts or chargebacks. `AUTOMATED_SYSTEM` - Incident was detected by automated systems such as fraud models or rule engines. `THIRD_PARTY_ALERT` - Incident was identified through external vendor or consortium alerts. `OTHER` - Incident was identified through a source not covered by other categories.
    - `bank_account` ProtectBankAccount, nullable, required — Bank account information associated with the incident.
      - `account_id` string, nullable — Plaid's unique identifier for the account.
      - `account_number` string, nullable — Full account number of the bank account.
      - `routing_number` string, nullable — Routing number of the bank account. Must be present if `account_number` is present.
    - `ach_return_code` string, nullable, required — ACH return code if the report type is `ACH_RETURN` (e.g. `R01`).
    - `notes` string, nullable, required — Additional context or details about the report.
    - `created_at` string, date-time, required — The timestamp when the report was created, in ISO 8601 format (e.g., '2020-07-24T03:26:02Z').
  - `request_id` string, required — A unique identifier for the request, which can be used for troubleshooting. This identifier, like all Plaid identifiers, is case sensitive.

---

[API](https://skmtc.net/plaid/apis/the-plaid-api.md) · [All operations](https://skmtc.net/plaid/apis/the-plaid-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/plaid/the-plaid-api/versions/64c4514ea59b/schema)