Search the participant's fraud markers at BACEN

curl --request POST \
  --url https://api.example.com/api/v1/dict/fraud-markers/search \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "participantISPB": "12345678",
  "taxIdNumber": "52998224725",
  "key": "usuario@example.com",
  "limit": 20,
  "modifiedAfter": "2026-09-01T00:00:00Z",
  "modifiedBefore": "2026-09-30T23:59:59Z",
  "status": "REGISTERED"
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/api/v1/dict/fraud-markers/search"

	payload := strings.NewReader("{\n  \"participantISPB\": \"12345678\",\n  \"taxIdNumber\": \"52998224725\",\n  \"key\": \"usuario@example.com\",\n  \"limit\": 20,\n  \"modifiedAfter\": \"2026-09-01T00:00:00Z\",\n  \"modifiedBefore\": \"2026-09-30T23:59:59Z\",\n  \"status\": \"REGISTERED\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    participantISPB: '12345678',
    taxIdNumber: '52998224725',
    key: 'usuario@example.com',
    limit: 20,
    modifiedAfter: '2026-09-01T00:00:00Z',
    modifiedBefore: '2026-09-30T23:59:59Z',
    status: 'REGISTERED'
  })
};

fetch('https://api.example.com/api/v1/dict/fraud-markers/search', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.example.com/api/v1/dict/fraud-markers/search"

payload = {
    "participantISPB": "12345678",
    "taxIdNumber": "52998224725",
    "key": "usuario@example.com",
    "limit": 20,
    "modifiedAfter": "2026-09-01T00:00:00Z",
    "modifiedBefore": "2026-09-30T23:59:59Z",
    "status": "REGISTERED"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "hasMore": true,
  "items": [
    {
      "createdAt": "2026-06-14T12:00:00Z",
      "fraudType": "MULE_ACCOUNT",
      "id": "550e8400-e29b-41d4-a716-446655440002",
      "keyValueHash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "ownerTaxIdHash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "participantISPB": "12345678",
      "reportStatus": "SENT",
      "status": "ACTIVE",
      "updatedAt": "2026-06-14T12:00:00Z",
      "bacen": {
        "correlationId": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
        "lastModified": "2026-06-14T12:00:00Z",
        "responseTime": "2026-06-14T12:00:00Z"
      },
      "bacenCreationTime": "2026-06-14T12:00:00Z",
      "keyValue": "usuario@example.com",
      "originInfractionReportId": "550e8400-e29b-41d4-a716-446655440005",
      "originInfractionReporterISPB": "12345678",
      "originOperationId": "01930000-0000-7000-8000-000000000000",
      "ownerTaxId": "52998224725"
    }
  ],
  "requestId": "<string>"
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

Search the participant's fraud markers at BACEN

Reads BACEN’s listFraudMarkers for one document and answers the page verbatim: the fraud markers the participant itself made, narrowed by the optional key, status and modification window. A read sent as POST so the CPF/CNPJ travels in the JSON body, never in a URL; it stores nothing locally (GET /api/v1/dict/fraud-markers stays the local registry). An empty list when BACEN holds none. 403 for a participant outside the caller’s scope; 422 for an invalid body or when BACEN rejects the query; 429 with Retry-After when throttled; 503 when BACEN cannot be reached.

POST

api

dict

fraud-markers

Search the participant's fraud markers at BACEN

curl --request POST \
  --url https://api.example.com/api/v1/dict/fraud-markers/search \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "participantISPB": "12345678",
  "taxIdNumber": "52998224725",
  "key": "usuario@example.com",
  "limit": 20,
  "modifiedAfter": "2026-09-01T00:00:00Z",
  "modifiedBefore": "2026-09-30T23:59:59Z",
  "status": "REGISTERED"
}
'

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/api/v1/dict/fraud-markers/search"

	payload := strings.NewReader("{\n  \"participantISPB\": \"12345678\",\n  \"taxIdNumber\": \"52998224725\",\n  \"key\": \"usuario@example.com\",\n  \"limit\": 20,\n  \"modifiedAfter\": \"2026-09-01T00:00:00Z\",\n  \"modifiedBefore\": \"2026-09-30T23:59:59Z\",\n  \"status\": \"REGISTERED\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    participantISPB: '12345678',
    taxIdNumber: '52998224725',
    key: 'usuario@example.com',
    limit: 20,
    modifiedAfter: '2026-09-01T00:00:00Z',
    modifiedBefore: '2026-09-30T23:59:59Z',
    status: 'REGISTERED'
  })
};

fetch('https://api.example.com/api/v1/dict/fraud-markers/search', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.example.com/api/v1/dict/fraud-markers/search"

payload = {
    "participantISPB": "12345678",
    "taxIdNumber": "52998224725",
    "key": "usuario@example.com",
    "limit": 20,
    "modifiedAfter": "2026-09-01T00:00:00Z",
    "modifiedBefore": "2026-09-30T23:59:59Z",
    "status": "REGISTERED"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "hasMore": true,
  "items": [
    {
      "createdAt": "2026-06-14T12:00:00Z",
      "fraudType": "MULE_ACCOUNT",
      "id": "550e8400-e29b-41d4-a716-446655440002",
      "keyValueHash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "ownerTaxIdHash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "participantISPB": "12345678",
      "reportStatus": "SENT",
      "status": "ACTIVE",
      "updatedAt": "2026-06-14T12:00:00Z",
      "bacen": {
        "correlationId": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
        "lastModified": "2026-06-14T12:00:00Z",
        "responseTime": "2026-06-14T12:00:00Z"
      },
      "bacenCreationTime": "2026-06-14T12:00:00Z",
      "keyValue": "usuario@example.com",
      "originInfractionReportId": "550e8400-e29b-41d4-a716-446655440005",
      "originInfractionReporterISPB": "12345678",
      "originOperationId": "01930000-0000-7000-8000-000000000000",
      "ownerTaxId": "52998224725"
    }
  ],
  "requestId": "<string>"
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

{
  "correlationId": "req-7a3f9c2e",
  "code": "<string>",
  "detail": "Property foo is required but is missing.",
  "errors": [
    {
      "location": "<string>",
      "message": "<string>",
      "value": "<unknown>"
    }
  ],
  "instance": "https://example.com/error-log/abc123",
  "status": 400,
  "title": "Bad Request",
  "type": "https://example.com/errors/example",
  "upstream": {
    "code": "E4001",
    "message": "account not found at provider"
  }
}

Authorizations

Authorization

string

header

required

JWT bearer token issued by the identity provider.

Body

application/json

participantISPB

string

required

ISPB (8 digits or uppercase letters) of the participant whose own fraud markers are searched; gated to the calling direct's scope (the direct itself or an indirect it sponsors) and sent to BACEN as Participant.

Pattern: ^[0-9A-Z]{8}$

Example:

"12345678"

taxIdNumber

string

required

CPF (11 digits) or CNPJ (14 digits) the markers are associated with. Required by BACEN's listFraudMarkers, whose TaxIdNumber pattern is numeric.

Pattern: ^(?:[0-9]{11}|[0-9]{14})$

Example:

"52998224725"

key

string

Optional Pix key the markers are associated with; BACEN requires it to belong to taxIdNumber's owner. A blank value is treated as absent.

Maximum string length: 77

Example:

"usuario@example.com"

limit

integer<int64>

Optional maximum number of markers BACEN returns (1 to 200). Omitted leaves BACEN's default of 20.

Required range: 1 <= x <= 200

Example:

20

modifiedAfter

string<date-time>

Optional lower bound (RFC 3339): markers modified at or after this instant.

Example:

"2026-09-01T00:00:00Z"

modifiedBefore

string<date-time>

Optional upper bound (RFC 3339): markers modified at or before this instant. Must not be earlier than modifiedAfter.

Example:

"2026-09-30T23:59:59Z"

status

enum<string>

Optional BACEN FraudMarkerStatus filter: REGISTERED (active) or CANCELLED. Omitted returns both.

Available options:

REGISTERED,

CANCELLED

Example:

"REGISTERED"

Response

hasMore

boolean

required

BACEN's HasMoreElements: more markers match than this page carries.

items

object[]

required

The participant's own fraud markers BACEN answered for the filters, as BACEN projects them. Nothing is stored locally. participantISPB is the searched participant (listFraudMarkers answers only that participant's markers); status uses the local vocabulary (REGISTERED -> ACTIVE, CANCELLED -> INACTIVE); keyValueHash, ownerTaxIdHash and reportStatus are empty because the markers are not local records; createdAt and updatedAt are BACEN's CreationTime and LastModified.

Show child attributes

requestId

string

Request-scoped identifier echoing X-Request-ID, for pivoting from response to trace. This is OUR OWN echo, distinct from any item's bacen.correlationId, which is BACEN's own value.