Export fraud events
The events the same filters would list, as a CSV file, newest first: when each happened and how many attempts it gathered, what it was, the email, IP address, country and order, the rule it matched or the change that was made and by whom, and what a lookup of the address already knew (its provider and network, where it is, and whether it looked like a VPN, a data centre or a phone). Nothing is looked up to write the file: an address never looked up has those empty. Every event the filters match is in the file, however many: it is sent as it is read. Add check=1 for { rows }, how many it would have, which is not counted. A store exports at most 30 files every 10 minutes, orders, customers, fraud events and blacklist rules together, whoever asks: after that the answer is 429.
Needs the fraud.read permission (Read Fraud Protection). It is one of the heavier reads, and is counted against a smaller budget of its own: 60 a minute for each key.
Authorizations
A secret API key, made under Developers in the dashboard: Authorization: Bearer shoply_sk_...
Path Parameters
The store's ID. A key reaches the store it was made in: GET /key answers which.
Query Parameters
Only events of this reason. changes is every change to the rules and settings.
blacklist, vpn, country, unpaid_limit, dispute, refund, changes Part of an email address, an IP address or a rule's value.
1 for how many rows the file would have, as { rows }, in place of the file. Not counted against the store's exports, and refused with 429 where none are left.
1 Only events in this period.
today, yesterday, 7d, 30d, this_week, last_week, this_month, last_month, this_year Only events on or after this day, as YYYY-MM-DD. With to, in place of range.
Only events on or before this day, as YYYY-MM-DD.
The time zone those days are in, as an IANA name. Left out, UTC.
Response
The file itself, not a JSON envelope.
The response is of type file.

