Skip to main content
List MED infractions visible in the selected payer-side owner scope.

​
Endpoint

POST /v3/infractions/list

​
Authentication and target

Use an account credential for its bound account, or a user credential with both X-ISPB and X-Account-Number. If an account credential sends those headers, both must be present and must match its bound account. Platform credentials are not accepted. All requests require the standard HMAC-SHA256 headers. The selected account determines payer-side MED owner scope; receiver-side operations are not exposed by these routes. The curl example below uses an ACCOUNT credential bound to the operated account, so it omits X-ISPB and X-Account-Number. If X-Client-ID identifies a USER credential, add both target headers and include their exact trimmed values in the canonical header set before calculating X-Signature.

​
Request body

Every field is optional: numeric page, page_size, and status; numeric Unix-millisecond start_time and end_time; string case_id, infraction_report_id, and connected_transaction_id.

​
Success data

items[] with infraction/transaction/account/case/report IDs, numeric status, display text, decimal-string amount, numeric create/update times; plus numeric pagination fields.

​
Behavior and validation

This layer forwards filters as supplied and asserts no local default pagination, limit, or time window.

​
Errors

Every call can fail for missing or invalid signature headers, an expired timestamp, nonce replay, an invalid body hash or signature, insufficient permission, or a downstream service error. Endpoint-specific errors include: Common account-owner, MED RPC, signature, and mapped provider errors.

​
Example request

​
Example response