Preview

List payment device observations

GET
/providers/{providerID}/payments/{paymentID}/risk-assessments/{assessmentID}/device-observations

List recorded device observations for one assessment on one payment, newest observation first. Returns an empty list when none were recorded.

Returns 404 when the payment or assessment is missing, when the assessment is for a different payment, or when the payment belongs to another provider.

Pagination is cursor-based. Omit cursor to fetch the first page. Use nextCursor from each response to fetch the next page. The cursor is bound to this provider, this payment, and this assessment.

Auth: API key or bearer token. You need both the moov-money-devices.read and moov-money-payments.read scopes for this provider. A delegated caller, such as a connected application or a narrowed token, also needs both scopes. A token with only one of them returns 403.

Request
cURL
curl -X GET https://api.moov.money/providers/{providerID}/payments/{paymentID}/risk-assessments/{assessmentID}/device-observations \
  -u "$MOOV_API_KEY_ID:$MOOV_API_KEY_SECRET" \
  -H "X-Moov-Version: v2026.10.00"
Responses
200 400 401 403 404
The request completed successfully.
{
  "observations": [
    {
      "deviceType": "mobile",
      "location": {
        "city": "Columbus",
        "region": "OH"
      },
      "model": "iPhone 15 Pro",
      "observedOn": "2026-10-06T15:00:00Z",
      "os": "iOS",
      "osVersion": "26.2"
    }
  ]
}
Malformed request: the body or headers failed validation.
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.
Authentication missing, invalid, or insufficient.
Authentication present but the action is forbidden for this principal/claim.
The requested resource was not found.

Headers

X-Moov-Version

string
Set this header to the API version being targeted (e.g. v2026.10.00). When omitted, the server applies its default version.

Path parameters

providerID

string required
Your provider account ID.

paymentID

string required
Payout ID or request ID.

assessmentID

string required
Identifier of the assessment.

Query parameters

cursor

string
Opaque pagination cursor from a previous response’s nextCursor. Omit to fetch the first page.

limit

integer <int32>
Maximum number of observations to return. Defaults to 25. Values outside 1-100 return 400.

Response

Response envelope for device observations on one assessment.

observations

array<object> required
This page of device observations, newest observedOn first. Observations with no recorded time come last. Empty when none were recorded.
Show child attributes

observations[]

observedOn

string<date-time>
When this observation was recorded: the last time the device was active in this assessment. Omitted when it was not recorded.

deviceType

string<enum>
Recorded kind of device. Omitted when it was not recorded.
Possible values: mobile, desktop

model

string
Recorded device model. Omitted when it was not recorded.

os

string
Recorded operating system name. Omitted when it was not recorded.

osVersion

string
Recorded operating system version. Omitted when it was not recorded.

location

object
Recorded location. Omitted when it was not recorded.
Show child attributes

observations[].location

city

string
Recorded city. Omitted when it was not recorded.

region

string
Recorded region, such as a state. Omitted when it was not recorded.

nextCursor

string
Opaque cursor for the next page. Absent on the last page.

hasMore

boolean required
Whether another page of results follows this one.