openapi: 3.1.0
info:
  title: Fraud Reports API
  version: 'v1'
  description: API used for creating and retrieving fraud reports.
servers:
  - url: https://api.loopreturns.com/api/2026-10
    description: 2026-10 (Stable)
  - url: https://api.loopreturns.com/api/2026-07
    description: 2026-07
  - url: https://api.loopreturns.com/api/unstable
    description: Unstable (Preview)
tags:
  - name: Return Actions
paths:
  /returns/{id}/fraud-report:
    post:
      summary: Create Fraud Report
      operationId: createFraudReport
      description: |
        Attach a fraud report to a return.

        ### Required API key scope
        - Returns
      tags:
        - Return Actions
      security:
        - api_key: []
      parameters:
        - in: path
          name: id
          schema:
            type: integer
          required: true
          description: The return's unique identifier.
          example: 23141
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateReturnFraudReportRequest'
      responses:
        "201":
          $ref: '#/components/responses/CreateFraudReport'
        "401":
          $ref: '#/components/responses/Unauthorized'
        "404":
          $ref: '#/components/responses/NotFound'
        "409":
          $ref: '#/components/responses/Conflict'
        "422":
          $ref: '#/components/responses/Unprocessable'
    delete:
      summary: Delete Fraud Report
      operationId: deleteFraudReport
      description: |
        Delete the fraud report attached to a return.

        ### Required API key scope
        - Returns
      tags:
        - Return Actions
      security:
        - api_key: []
      parameters:
        - in: path
          name: id
          schema:
            type: integer
          required: true
          description: The return's unique identifier.
          example: 23141
      responses:
        "200":
          description: 'Success'
          content:
            application/json:
              schema:
                type: integer
                description: The number of fraud reports deleted.
                example: 1
        "401":
          $ref: '#/components/responses/Unauthorized'
        "404":
          $ref: '#/components/responses/NotFound'
components:
  responses:
    CreateFraudReport:
      description: 'Success'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ReturnFraudReport'
    Unauthorized:
      description: Unauthorized
      content:
        application/json:
          schema:
            type: object
            required:
              - errors
            properties:
              errors:
                type: string
                example: 'Unauthorized.'
    Unprocessable:
      description: 'Unprocessable'
      content:
        application/json:
          schema:
            oneOf:
              - $ref: '#/components/schemas/InvalidCategory'
              - $ref: '#/components/schemas/InvalidComment'
    Conflict:
      description: Conflict
      content:
        application/json:
          schema:
            type: object
            properties:
              errors:
                type: object
                properties:
                  message:
                    type: string
                    example: 'Fraud report already exists.'
    NotFound:
      description: Resource Not Found
      content:
        application/json:
          schema:
            type: object
            properties:
              errors:
                type: object
                properties:
                  message:
                    type: string
                    example: 'No return found with this ID.'
  schemas:
    ReturnFraudReport:
      type: object
      required:
        - id
        - return_id
        - category
        - created_at
      properties:
        category:
          type: string
          enum:
            - package-never-received
            - package-is-empty
            - package-is-missing-items
            - instant-return-charge-failed
            - keep-item-abuse
            - splitting-returns-to-avoid-restrictions
            - item-is-worn
            - other
          description: The category under which the fraudulent return falls.
        comment:
          type: [string, "null"]
          description: >
            Any additional context associated with the fraudulent return.
            This property is required if the `category` is set to `other`.
          example: This is a sample comment.
        created_at:
          type: string
          format: date-time
          description: "The date and time at which the fraud report was created."
          example: 2024-10-25T16:44:47.038Z
        return_id:
          type: integer
          example: 23141
          description: The return's unique identifier.
        id:
          type: integer
          example: 87
          description: The fraud report's unique identifier.
    CreateReturnFraudReportRequest:
      type: object
      properties:
        category:
          type: [string, "null"]
          enum:
            - package-never-received
            - package-is-empty
            - package-is-missing-items
            - instant-return-charge-failed
            - keep-item-abuse
            - splitting-returns-to-avoid-restrictions
            - item-is-worn
            - other
            - null
          description: The category under which the fraudulent return falls.
        comment:
          type: [string, "null"]
          maxLength: 512
          description: Any additional context associated with the fraudulent return.
          example: This is a sample comment.
    InvalidComment:
      type: object
      properties:
        message:
          type: string
          example: 'The comment field must not be greater than 512 characters.'
        errors:
          type: object
    InvalidCategory:
      type: object
      properties:
        message:
          type: string
          example: 'Must be one of the following values: package-never-received,
            package-is-empty, package-is-missing-items, instant-return-charge-failed,
            keep-item-abuse, splitting-returns-to-avoid-restrictions, item-is-worn, other'
        errors:
          type: object
  securitySchemes:
    api_key:
      type: 'apiKey'
      name: 'X-Authorization'
      in: 'header'