Review a sample case

In this tutorial, you list cases, choose one case, and open its detail response.

This path only reads tenant data and leaves it unchanged.

What you need

Complete Make your first API call first, then keep the same terminal open.

Your terminal should already have:

UFX_TENANT_SLUG
UFX_API_BASE_URL
UFX_ACCESS_TOKEN

Your token needs the read:cases and read:case permissions, and your tenant needs at least one open case.

List open cases

Request the open cases for your tenant:

curl -sS "${UFX_API_BASE_URL}/v2/${UFX_TENANT_SLUG}/cases?status=OPEN" \
  -H "Authorization: Bearer ${UFX_ACCESS_TOKEN}"

The response has the same data.cases array you saw in the first tutorial:

{
  "data": {
    "cases": [
      {
        "case_id": "case-abc123",
        "created_at": "2024-01-15T10:30:00Z",
        "overall_risk_score": 3,
        "status": "OPEN",
        "website_account_id": "account-abc123"
      }
    ]
  }
}

Copy one case_id value:

export UFX_CASE_ID="PASTE_CASE_ID_HERE"

Open the case

Request the case detail:

curl -sS "${UFX_API_BASE_URL}/v2/${UFX_TENANT_SLUG}/cases/${UFX_CASE_ID}" \
  -H "Authorization: Bearer ${UFX_ACCESS_TOKEN}"

Read the case detail

The response body wraps the case in data:

{
  "data": {
    "case_id": "case-abc123",
    "tenant_id": "00000000-0000-4000-8000-000000000000",
    "website_account_id": "account-abc123",
    "session_id": "a1b2c3d4-20240115-103500000",
    "unique_id": "8f1e2d3c-4b5a-6978-8a9b-0c1d2e3f4a5b",
    "end_user_is_blocked": false,
    "status": "OPEN",
    "created_at": "2024-01-15T10:30:00Z",
    "current_state": {
      "state_id": "7a54d2a4-5e2f-4b72-9a4a-3276b4af0c11",
      "case_status": "OPEN",
      "session_status": "ACTIVE",
      "score": 4,
      "changed_at": "2024-01-15T10:35:00Z",
      "changed_by": "system",
      "reason": "Case created from model prediction"
    },
    "details": {
      "overall_risk_score": 3,
      "fraud_labels": ["Account Takeover"],
      "primary_fraud_label": "Account Takeover",
      "summary": "Account takeover attempt detected from suspicious IP",
      "recommended_action": "BLOCK"
    }
  }
}

This example shows only the fields used in this tutorial. See the API reference for the full case response schema.

Find these fields in your response:

data.case_id, the identifier you can use in later case requests
data.website_account_id, the end-user account linked to the case
data.end_user_is_blocked, whether UrbanFox blocks the linked end-user account
data.status, the case lifecycle status
data.details.overall_risk_score, the risk score for the case
data.details.primary_fraud_label, the primary fraud category identified for the case
data.details.recommended_action, the suggested response (MONITOR, CHALLENGE, BLOCK, or ESCALATE), or null when UrbanFox does not recommend an action

Finish

You have now followed a read-only case review path:

list open cases
choose a case
open the case detail
read the main case fields