> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Read DICT query-monitoring indicators > Reports the two query indicators DICT 8.4 section 13.2.3 obliges every participant to keep: DICT key queries per payment order sent to the SPI (VCD/EOS) and NOT FOUND/(NOT FOUND+FOUND), for the participant as a whole and for each end user, over the configured rolling window. It also lists the end users whose own ratio breached the per-user threshold over at least the minimum query count, and the blocks currently in force. A listing is an indication to verify, not a verdict — the section requires a human to establish that the behaviour is unjustified before anyone is blocked. End users appear only as a keyed digest of their CPF/CNPJ; no document is stored or returned. Internal admin endpoint. ## OpenAPI ````yaml /es/openapi/v3-current/spi-dict.yaml get /api/v1/dict/internal/query-monitor openapi: 3.1.0 info: contact: email: contact@lerian.studio name: Lerian Studio url: https://lerian.studio description: >- OpenAPI 3.1 surface for the DICT (Diretório de Identificadores de Contas Transacionais) capability of Lerian SPI, the direct integration between the institution and the Brazilian Instant Payment System (SPI/Pix). It covers the PIX key lifecycle, portability and ownership claims, the MED 2.0 dispute surface (infraction reports, refunds, fraud markers, and funds recoveries), antifraud statistics, synchronous DICT reports, and the internal operations that keep the key directory consistent. license: name: Lerian Studio General License title: Lerian SPI — DICT API version: 1.0.0 servers: - url: https://spi.sandbox.lerian.net security: [] tags: - description: 'PIX key lifecycle: register, list, search, lookup, delete, and statistics.' name: Keys - description: >- PIX key portability and ownership claims through their full lifecycle (initiate, confirm, reject, cancel, acknowledge, complete). name: Claims - description: 'DICT infraction reports: list and retrieve.' name: Infractions - description: 'DICT refund requests: create, list, and retrieve.' name: Refunds - description: 'PIX fraud markers: create, list, and statistics.' name: Fraud Markers - description: >- Durable MED operation-intent status: the operationId every create/lifecycle-transition backlog route returns or references on every outcome, queryable independently of the business resource. name: Operations - description: >- Synchronous reports over Lerian SPI's own DICT record: COUNT(*) summaries of keys (by type/status) and claims (by type/status + open-past-deadline). COUNT-only — DICT holds no money. name: Reports - description: >- Internal DICT operations: reconciliation runs, claim deadline processing, and orphaned-key cleanup. name: Internal paths: /api/v1/dict/internal/query-monitor: get: tags: - Internal summary: Read DICT query-monitoring indicators description: >- Reports the two query indicators DICT 8.4 section 13.2.3 obliges every participant to keep: DICT key queries per payment order sent to the SPI (VCD/EOS) and NOT FOUND/(NOT FOUND+FOUND), for the participant as a whole and for each end user, over the configured rolling window. It also lists the end users whose own ratio breached the per-user threshold over at least the minimum query count, and the blocks currently in force. A listing is an indication to verify, not a verdict — the section requires a human to establish that the behaviour is unjustified before anyone is blocked. End users appear only as a keyed digest of their CPF/CNPJ; no document is stored or returned. Internal admin endpoint. operationId: readDICTQueryMonitor responses: '200': content: application/json: schema: $ref: '#/components/schemas/DICTQueryMonitorResponse' description: >- This deployment's live DICT section 13.2.3 indicators, the end users they name, and the blocks in force. description: OK '422': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Unprocessable Entity '500': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Internal Server Error '503': content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Service Unavailable default: content: application/problem+json: schema: $ref: '#/components/schemas/Detail' description: Error security: - BearerAuth: [] components: schemas: DICTQueryMonitorResponse: additionalProperties: false properties: blocks: description: >- Blocks currently in force, newest first. Read from the live block list rather than from the audit trail, so it is always the effect actually in place. items: $ref: '#/components/schemas/DICTQueryBlockResponse' type: array participant: $ref: '#/components/schemas/DICTQueryParticipantIndicatorsResponse' description: Both indicators for the PSP as a whole. suspects: description: >- End users whose own NOT FOUND ratio breached the per-user threshold over at least the minimum query count, worst first. A listing is an indication to verify, never a verdict: section 13.2.3 requires a human to establish that the behaviour is unjustified before anyone is blocked. items: $ref: '#/components/schemas/DICTQuerySuspectResponse' type: array thresholds: $ref: '#/components/schemas/DICTQueryThresholdsResponse' description: The parameters this deployment judges against. windowFrom: description: Start of the assessed window (RFC 3339, UTC). examples: - '2026-08-20T14:00:00Z' type: string windowTo: description: >- End of the assessed window (RFC 3339, UTC) — the instant it was read. examples: - '2026-08-21T13:19:25Z' type: string required: - windowFrom - windowTo - thresholds - participant - suspects - blocks type: object Detail: additionalProperties: false properties: code: description: >- Stable, machine-readable domain error code scoped to the emitting service (format: -NNNN). type: string correlationId: description: Request-scoped correlation identifier echoing X-Request-ID. examples: - req-7a3f9c2e type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string upstream: $ref: '#/components/schemas/Upstream' description: >- RFC 9457 extension member: the error a proxied third-party provider reported. Absent unless the emitting service explicitly surfaced one. required: - correlationId type: object DICTQueryBlockResponse: additionalProperties: false properties: actor: description: The operator who placed the block. examples: - user:fred type: string blockedAt: description: When the block was placed (RFC 3339, UTC). examples: - '2026-08-21T13:19:25Z' type: string justification: description: Why the block was placed, in the operator's own words. examples: - read-attack pattern confirmed with the fraud team type: string payerIdHash: description: >- Keyed digest of the blocked end user's CPF/CNPJ, as the monitor read reports it. examples: - 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 type: string required: - payerIdHash type: object DICTQueryParticipantIndicatorsResponse: additionalProperties: false properties: found: description: Key queries the DICT answered FOUND (HTTP 200) in the window. examples: - 9400 format: int64 type: integer noPaymentOrderInWindow: description: >- True when the window holds key queries and not one payment order, which is what makes the VCD/EOS ratio undefined rather than merely large. examples: - false type: boolean notFound: description: Key queries the DICT answered NOT FOUND (HTTP 404) in the window. examples: - 600 format: int64 type: integer notFoundBasisPoints: description: >- NOT FOUND/(NOT FOUND+FOUND) in basis points: 600 is 6%. Footnote 15 treats percentages above 7% for the participant as a good indication of suspicious behaviour. examples: - 600 format: int64 type: integer notFoundBreached: description: >- True when the ratio exceeded the configured participant threshold over at least the configured minimum query count. examples: - false type: boolean orderRatioBasisPoints: description: >- Key queries per payment order (VCD/EOS) in basis points: 12195 is 1.22. Footnote 14 treats values near or above 2 as anomalous. A window holding queries and no payment order at all is undefined and reports an unreachable value. examples: - 12195 format: int64 type: integer orderRatioBreached: description: >- True when VCD/EOS reached the configured threshold over at least the configured minimum query count. examples: - false type: boolean paymentOrders: description: >- Payment orders this rail sent to the SPI in the window — the EOS of section 13.2.3. examples: - 8200 format: int64 type: integer queries: description: Total key queries in the window — the VCD of section 13.2.3. examples: - 10000 format: int64 type: integer required: - paymentOrders - notFoundBasisPoints - notFoundBreached - orderRatioBasisPoints - noPaymentOrderInWindow - orderRatioBreached - found - notFound - queries type: object DICTQuerySuspectResponse: additionalProperties: false properties: found: description: Key queries the DICT answered FOUND for this end user in the window. examples: - 60 format: int64 type: integer notFound: description: >- Key queries the DICT answered NOT FOUND for this end user in the window. examples: - 140 format: int64 type: integer notFoundBasisPoints: description: 'This end user''s own NOT FOUND ratio in basis points: 7000 is 70%.' examples: - 7000 format: int64 type: integer payerIdHash: description: >- Keyed digest (HMAC-SHA256 under this deployment's own pepper) of the end user's CPF/CNPJ. The document itself is never stored or returned; this hash is what identifies the subject to the block verb, and resolving it to a person happens in the operator's own systems. examples: - 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 type: string required: - payerIdHash - found - notFound - notFoundBasisPoints type: object DICTQueryThresholdsResponse: additionalProperties: false properties: orderRatioBasisPoints: description: 'VCD/EOS threshold in basis points (manual default: 20000, i.e. 2.0).' examples: - 20000 format: int64 type: integer participantMinQueries: description: >- Queries below which the participant ratio is not judged. The manual states no participant floor — it states one only per user — so this is a parameter section 13.2.3 leaves to the participant. examples: - 100 format: int64 type: integer participantNotFoundBasisPoints: description: >- Participant NOT FOUND threshold in basis points (manual default: 700, i.e. 7%). examples: - 700 format: int64 type: integer payerMinQueries: description: >- Footnote 15's own floor, verbatim: an end user is judged only from 100 queries in the last 24 hours. It is a rule, not a rounding — 99 queries are not judged at all. examples: - 100 format: int64 type: integer payerNotFoundBasisPoints: description: >- Per-user NOT FOUND threshold in basis points (manual default: 2000, i.e. 20%). examples: - 2000 format: int64 type: integer windowHours: description: The rolling window both indicators are measured over. examples: - 24 format: int64 type: integer required: - windowHours - participantNotFoundBasisPoints - participantMinQueries - payerNotFoundBasisPoints - payerMinQueries - orderRatioBasisPoints type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object Upstream: additionalProperties: false properties: code: description: The upstream provider's own error code, verbatim. examples: - E4001 type: string message: description: >- The upstream provider's own error message, verbatim (bounded, never its raw response body). examples: - account not found at provider type: string type: object securitySchemes: BearerAuth: bearerFormat: JWT description: JWT bearer token issued by the identity provider. scheme: bearer type: http ````