Preview

Open participant review

POST
/providers/{providerID}/participant-reviews

Open a participant review for one of your participants. A participant has at most one pending review with your provider. An open request for a participant with a pending review joins that review instead of opening a new one: its assessmentID is added to the review’s assessmentIDs, and its reason is recorded as a note on the review. A pending review does not block payments.

Opening is asynchronous. Returns 202 when Moov Money accepts the request. A 202 does not mean the review is open. The 202 body is not defined yet. An opened review appears in the participant’s review list. The completion and rejection reporting contract is not defined yet (ADR 024 Q10).

Send an X-Idempotency-Key header so a retried request is processed once. Replaying the same key with the same body returns 202 again. Replaying it with a different body returns a 409 with error code idempotency-key-reused. Returns a 409 with error code idempotency-request-in-progress when a request with this key is still running. Returns 400 when the header is missing or malformed.

A participant without a relationship with your provider returns 404. Returns 422 when the body fails validation.

Auth: API key or bearer token. Scoped to the calling provider. Requires participant-review write access.

Request
cURL
curl -X POST https://api.moov.money/providers/{providerID}/participant-reviews \
  -u "$MOOV_API_KEY_ID:$MOOV_API_KEY_SECRET" \
  -H "X-Moov-Version: v2026.10.00" \
  -H "X-Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "assessmentID": "ras_01HF5J9ZKQT4RXP8M2VYBN3D",
  "participantID": "3v2whagmwvbujhwbt7v3nl6ffq_user",
  "reason": "Investigate sign-in activity"
}'
Responses
202 400 401 403 404 409 422
The request was accepted for asynchronous processing. The change may not be applied yet. The response body is not defined; do not depend on it.
Malformed request: the body or headers failed validation.
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.
Authentication missing, invalid, or insufficient.
Authentication present but the action is forbidden for this principal/claim.
The requested resource was not found.
The request conflicts with the current state of the target resource.
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.
The request was well-formed but couldn’t be processed (e.g. card declined).
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.

Headers

X-Moov-Version

string
Set this header to the API version being targeted (e.g. v2026.10.00). When omitted, the server applies its default version.

X-Idempotency-Key

string required
Client-supplied key that identifies this create request, 1 to 255 characters. Send the header once. Retries with the same key are processed once for 24 hours after the request completes.

Path parameters

providerID

string required
Your provider account ID.

Request

application/json
Open a participant review for one of your participants.

participantID

string required
Participant to review: their participantID, or your externalID for them. Both resolve to the same participant. The participant must have a relationship with your provider.

reason

string [1 to 512] characters required
Why you are opening the review. 1 to 512 characters.

assessmentID

string
Risk assessment that prompted the review, when there is one.