FraudAlert
object type
A FraudAlert — the merchant TRIAGE register over the derived fraud-signal layer: a signal crossing a policy threshold raises an alert naming the signal family (void_no_sale · return_refund_abuse · discount_override_abuse · override_pattern · cash_over_short · dispute_chargeback), the normalized score (0..100) vs the crossed threshold, the implicated staff principal and/or facility, the scoring window, and the triggering records. SIGNALS, NOT ENFORCEMENT: the / authority layer enforces; an alert only records and asks. SYSTEM-RAISED end to end — no create surface exists; the merchant triages: acknowledge (open → acknowledged — investigating; disarms the age-out), then confirm (a KEPT immutable finding — terminal but NOT doomed) or dismiss (a false positive — the reason is REQUIRED). Untriaged alerts age out after 30 days (open → expired, the scheduled lane). Triage identity/notes are the revision causes (History + the org-bus render actor + reason + instant — never duplicated fields). NOT searchable (sensitive review data — reached via the A17_FRAUD-gated paginated listing, never name-found); the listing pages NEWEST-first and drops doomed (dismissed/expired) per the - law while confirmed findings stay listed.
Fields
| Field | Type | Notes |
|---|---|---|
id | ID ID! | The record’s id — a UUID the platform assigned when the record was created; every reference to this record uses it. |
sysId | String String! | The group-scoped human-facing system id (FA-…). |
type | String String! | The kind of record — always FraudAlert here. |
caption | String String! | The record’s display name — what people see it called. |
status | String String! | The FSM state: open | acknowledged | confirmed | dismissed | expired. |
parentId | ID ID! | The parent = the org GROUP; parentId === rootId always (the WebhookSubscription class — the register is group custody). |
rootId | ID ID! | The org-group family root. |
createdAt | String String! | When the record was created, as a UTC timestamp. |
updatedAt | String String! | When the record last changed, as a UTC timestamp. |
revisionNum | Int Int! | How many times this record has been edited; the first save is 0. |
revision | ID ID! | The OCC revision token — supply it on every mutation of this record; rotates on every write. |
refCaptions | RefCaption [RefCaption!]! | The server-composed captions of this record's declared references (the referenced-caption rule) — one row per referenced id; see RefCaption. |
signalKind | String String! | WHICH derived-signal family fired (void_no_sale · return_refund_abuse · discount_override_abuse · override_pattern · cash_over_short · dispute_chargeback — the two-layer law: the canon's six, membership IS the vocabulary). |
score | Int Int! | The scorer's normalized score for the window (0..100). |
threshold | Int Int! | The policy bound the score crossed (the same scale — v1 canned consts; the policy layer composes real merchant thresholds later, disclosed). |
reason | String String! | The scorer's bounded human explanation (≤500) — never raw event data. |
periodKey | String String! | The scoring window — a UTC month (YYYY-MM) or day (YYYY-MM-DD); the scorer picks the grain per signal kind. |
implicatedUserId | ID | The implicated staff principal (scored per cashier); in-group-gated at raise, ANY status (the review judges PAST conduct); null when the signal implicates a facility/period only. |
logicalFacilityId | ID | The implicated facility (scored per LF); in-group-gated at raise; null when the signal implicates a person/period only. |
constructRefs | TaskConstructRef [TaskConstructRef!]! | The triggering records (≤20 — the Task {type, id} structured-ref shape reused, the Suggestion evidenceRefs precedent): advisory evidence the scorer derived from the lake; nothing gates on them, a purged target renders as a tombstone. |
expiresAt | String String! | WHEN an untriaged (open) alert ages out (raise + 30 days — the scheduled lane fires open → expired; acknowledging disarms it). |