Block an end user's DICT key queries

curl --request POST \
  --url https://spi.sandbox.lerian.net/api/v1/dict/internal/query-blocks \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "justification": "<string>",
  "payerId": "12345678901",
  "payerIdHash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://spi.sandbox.lerian.net/api/v1/dict/internal/query-blocks"

	payload := strings.NewReader("{\n  \"justification\": \"<string>\",\n  \"payerId\": \"12345678901\",\n  \"payerIdHash\": \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    justification: '<string>',
    payerId: '12345678901',
    payerIdHash: '9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08'
  })
};

fetch('https://spi.sandbox.lerian.net/api/v1/dict/internal/query-blocks', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://spi.sandbox.lerian.net/api/v1/dict/internal/query-blocks"

payload = {
    "justification": "<string>",
    "payerId": "12345678901",
    "payerIdHash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "blocked": true,
  "payerIdHash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
  "alreadyApplied": true
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

Block an end user's DICT key queries

Stops serving DICT key queries for one end user: DICT 8.4 section 13.2.3’s “o participante deve bloquear imediatamente o(s) usuario(s) em questao”, which the same sentence conditions on a human having verified fundada suspeita and elevado indicio of misuse. Every later key lookup naming this payer is refused 403 before any read — before the retained directory answer and before this deployment’s own registry — because the block is a statement about the person, not about our wire traffic. One identified operator, no second approval, mandatory justification, audited under the caller’s identity before and after the effect. Idempotent: an end user already blocked answers 200 with alreadyApplied. Name the end user by the hash the monitor read reports, or by their CPF/CNPJ, which is hashed here and never stored.

POST

api

dict

internal

query-blocks

Block an end user's DICT key queries

curl --request POST \
  --url https://spi.sandbox.lerian.net/api/v1/dict/internal/query-blocks \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "justification": "<string>",
  "payerId": "12345678901",
  "payerIdHash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://spi.sandbox.lerian.net/api/v1/dict/internal/query-blocks"

	payload := strings.NewReader("{\n  \"justification\": \"<string>\",\n  \"payerId\": \"12345678901\",\n  \"payerIdHash\": \"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    justification: '<string>',
    payerId: '12345678901',
    payerIdHash: '9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08'
  })
};

fetch('https://spi.sandbox.lerian.net/api/v1/dict/internal/query-blocks', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://spi.sandbox.lerian.net/api/v1/dict/internal/query-blocks"

payload = {
    "justification": "<string>",
    "payerId": "12345678901",
    "payerIdHash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "blocked": true,
  "payerIdHash": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
  "alreadyApplied": true
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

Authorizations

Authorization

string

header

required

JWT bearer token issued by the identity provider.

Body

application/json

justification

string

required

Why this end user is being blocked or released — the verified suspicion section 13.2.3 conditions the act on, in the operator's own words. Recorded in the audit trail under the caller's identity. Operator prose only: never a tax id, a Pix key, an account or a holder name.

Required string length: 8 - 384

payerId

string

The end user's CPF or CNPJ, digits only — the same identifier their key queries carry in PI-PayerId. Hashed immediately and never stored, logged or returned. Supply this OR payerIdHash, not both.

Pattern: ^([0-9]{11}|[0-9]{14})$

Example:

"12345678901"

payerIdHash

string

Keyed digest of the end user's CPF/CNPJ, as the monitor read reports it. Supply this OR payerId, not both.

Pattern: ^[0-9a-f]{64}$

Example:

"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"

Response

blocked

boolean

required

Whether this end user's DICT key queries are blocked after the call.

Example:

true

payerIdHash

string

required

Keyed digest of the end user this call acted on.

Example:

"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"

alreadyApplied

boolean

True when the end user was already on the requested side and nothing changed. The call is a success either way and is still audited under the caller's identity, so re-sending a request whose response was lost is safe.