List reviews

GET
/providers/{providerID}/reviews

List the reviews scoped to your provider, newest first. A review’s subject is a payout or a request; both kinds appear in this one queue. Reviews from other providers are never returned. Returns an empty list when none match.

status defaults to pending, the active review queue.

Pagination is cursor-based. Omit cursor to fetch the first page; use nextCursor from each response to fetch the next page.

Auth: API key or bearer token. Scoped to the calling provider.

Request
cURL
curl -X GET https://api.moov.money/providers/{providerID}/reviews \
  -u "$MOOV_API_KEY_ID:$MOOV_API_KEY_SECRET" \
  -H "X-Moov-Version: v2026.10.00"
Responses
200 400 401 403 422
The request completed successfully.
{
  "reviews": [
    {
      "assessmentScore": 0,
      "counterparty": {
        "displayName": "Jane Doe",
        "externalID": "C-2077",
        "funding": {
          "displayName": "Checking",
          "fundingType": "bank_account",
          "last4": "5612"
        },
        "participantID": "counterparty-id_user",
        "phoneNumber": "+15555551234"
      },
      "createdOn": "2026-08-31T12:00:00Z",
      "flaggedParticipantID": "3v2whagmwvbujhwbt7v3nl6ffq_user",
      "flaggedRole": "sender",
      "initiator": {
        "displayName": "Jane Smith",
        "externalID": "C-1042",
        "funding": {
          "displayName": "Checking",
          "fundingType": "bank_account",
          "last4": "5612"
        },
        "participantID": "participant-id_user"
      },
      "payout": {
        "amount": {
          "currency": {
            "code": "USD",
            "decimalPlaces": 2,
            "name": "US Dollar",
            "numericCode": "840"
          },
          "value": "100.00"
        },
        "payoutID": "pay_01HF5J9ZKQT4RXP8M2VYBN3D",
        "recipientName": "Jane Doe",
        "status": "initiated"
      },
      "reason": "Payout amount above review threshold",
      "request": {
        "amount": {
          "currency": {
            "code": "USD",
            "decimalPlaces": 2,
            "name": "US Dollar",
            "numericCode": "840"
          },
          "value": "100.00"
        },
        "createdOn": "2026-08-31T12:00:00Z",
        "requestID": "01HF5J9ZKQT4RXP8M2VYBN3D_req",
        "status": "created"
      },
      "reviewID": "prv_01HF5J9ZKQT4RXP8M2VYBN3D",
      "riskAssessmentID": "ras_01HF5J9ZKQT4RXP8M2VYBN3D",
      "status": "pending",
      "type": "payout"
    }
  ]
}
Malformed request: the body or headers failed validation.
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.
Authentication missing, invalid, or insufficient.
Authentication present but the action is forbidden for this principal/claim.
The request was well-formed but couldn’t be processed (e.g. card declined).
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.

Headers

X-Moov-Version

string
Set this header to the API version being targeted (e.g. v2026.10.00). When omitted, the server applies its default version.

Path parameters

providerID

string required
Your provider account ID.

Query parameters

status

string
Filter by review status. Defaults to pending when omitted; unrecognized values return 400.
Possible values: pending, approved, rejected

q

string
Case-insensitive search for reviews within your provider. An exact review ID or payment ID matches that review. An exact participant ID (it ends in _user) or your exact external ID for a participant matches the reviews of that assessed subject. Any other value matches a substring of the assessed subject’s given, family, or full name. A value that contains only digits and phone punctuation, with at least three digits, also matches the subject’s phone number by its digits. Emails never match. Leading and trailing spaces are ignored. Returns 422 with problem type invalid-request when the trimmed value is longer than 100 characters, or when it contains only digits and phone punctuation with fewer than three digits. The cursor carries this filter. Send the same value with nextCursor.

type

string
Filter by the payment kind under review. The cursor carries this filter. Send the same value with nextCursor.
Possible values: payout, request

participantID

string
Filter to reviews whose assessed subject is this participant. Accepts the participant’s participantID or your externalID for them. Only the assessed subject matches. The cursor carries this filter. Send the same value with nextCursor.

limitGroupID

string
Filter to reviews whose assessed subject has an active membership in this limit group. The cursor carries this filter. Send the same value with nextCursor.

scoreMin

number <double>
Inclusive lower bound on a known assessment score, from 0 to 100. Setting this filter excludes reviews that have no known score. The default pending queue still includes those reviews. A scoreMin that is greater than scoreMax returns 400. The cursor carries this filter. Send the same value with nextCursor.

scoreMax

number <double>
Inclusive upper bound on a known assessment score, from 0 to 100. Setting this filter excludes reviews that have no known score. The default pending queue still includes those reviews. A scoreMax that is less than scoreMin returns 400. The cursor carries this filter. Send the same value with nextCursor.

createdFrom

string <date-time>
Inclusive lower bound on review creation time. The cursor carries this filter. Send the same value with nextCursor.

createdTo

string <date-time>
Exclusive upper bound on review creation time. The cursor carries this filter. Send the same value with nextCursor.

cursor

string
Opaque pagination cursor from a previous response’s nextCursor. Omit to fetch the first page.

limit

integer <int32>
Maximum number of reviews to return. Defaults to 25; values outside 1-100 return 400.

Response

Response envelope for list reviews.

reviews

array<object> required
The page of review summaries, newest first.
Show child attributes

reviews[]

reviewID

string required
Unique system-assigned review identifier.

type

string<enum> required
Kind of payment under review. payout carries the payout summary; request carries the request summary.
Possible values: payout, request

status

string<enum> required
Current review status.
Possible values: pending, approved, rejected

reason

string
Human-readable reason the payment was placed in review.

riskAssessmentID

string
Risk assessment that produced this review, when available.

payout

object
Payout summary for the queue.
Show child attributes

reviews[].payout

payoutID

string required
Unique system-assigned payout identifier.

amount

object required
Payout amount and currency.
Show child attributes

reviews[].payout.amount

value

string required
Decimal amount as a string.

currency

object required
ISO 4217 currency descriptor.
Show child attributes

reviews[].payout.amount.currency

code

string required
Uppercase 3-letter ISO 4217 currency code.

decimalPlaces

integer<uint8> required
Number of minor-unit decimal places for code. Required.

numericCode

string
ISO 4217 numeric currency code, if known. Informational only.

name

string
Human-readable currency name, if known. Informational only.

recipientName

string
Recipient display name when known (given + family), otherwise omitted.

status

string<enum> required
Current lifecycle status of the payout.
Possible values: initiated, authorized, accepted, claiming, completed, failed, payout_failed, cancelled, expired, denied

request

object
Request summary for the queue. Present when the subject is a request.
Show child attributes

reviews[].request

requestID

string required
Unique system-assigned request identifier.

amount

object required
Request amount and currency.
Show child attributes

reviews[].request.amount

value

string required
Decimal amount as a string.

currency

object required
ISO 4217 currency descriptor.
Show child attributes

reviews[].request.amount.currency

code

string required
Uppercase 3-letter ISO 4217 currency code.

decimalPlaces

integer<uint8> required
Number of minor-unit decimal places for code. Required.

numericCode

string
ISO 4217 numeric currency code, if known. Informational only.

name

string
Human-readable currency name, if known. Informational only.

status

string<enum> required
Current lifecycle status of the request.
Possible values: created, authenticated, declined, cancelled, expired, paying, funded, disbursing, disbursement_failed, completed, reversing, reversal_failed, reversed, denied

memo

string
Requester-authored message, when present.

expiresOn

string<date-time> required
When the request expires. Always set: a request carries a fixed expiry from creation.

createdOn

string<date-time> required
When the request was created.

createdOn

string<date-time> required
When the review was created.

holdExpiresOn

string<date-time>
When the review hold stops blocking the payment. Omitted when the hold has no expiration. Expiration does not resolve the review.

resolvedOn

string<date-time>
When the review was resolved. Omitted while pending.

assessmentScore

number<double>
Known assessment score from 0 to 100. A recorded zero is a real score. Omitted when no score was recorded.

flaggedParticipantID

string
Participant who was assessed for this review. Omitted when that subject is unknown.

flaggedRole

string<enum>
Recorded role of the assessed subject. Omitted when the role was not recorded.
Possible values: sender, requester, payer

initiator

object
The participant who started the payment: the sender of a payout or the requester of a request. A name comes from your relationship with the party or from the name recorded on the payment, never from the profile of a participant that is not yours. Fields that are not known are omitted. Omitted when no initiator is recorded.
Show child attributes

reviews[].initiator

participantID

string required
The initiator’s participant ID.

externalID

string
Your external ID for the initiator.

displayName

string
The initiator’s current name (given + family). Omitted when unknown.

funding

object
The initiator’s instrument for this payment: the funding source a payout sends from, or the funding destination a request pays into. Omitted until the instrument is known.
Show child attributes

reviews[].initiator.funding

fundingType

string<enum> required
Instrument discriminator.
Possible values: card, bank_account

displayName

string
Human-readable display label, such as the account nickname or card brand. Omitted when unknown.

last4

string
Last four digits of the card number for card, or of the bank account number for bank_account. Omitted when unknown. At most 4 characters.

counterparty

object
The other party: the recipient of a payout or the payer of a request. The same name rule as initiator applies. Fields that are unbound or not known are omitted. Omitted when no counterparty is recorded.
Show child attributes

reviews[].counterparty

displayName

string
Counterparty display name (given + family) when known.

phoneNumber

string
Counterparty phone number in E.164 form when known.

participantID

string
The party’s participant ID, once the party is bound to the payment. Omitted for an unbound party, such as the recipient of an unclaimed payout or the payer of an open request. The ID does not give access to the record of a participant that is not yours.

externalID

string
Your external ID for the party. Present only when the party is your participant.

funding

object
The instrument the party used for this payment. Omitted until the instrument is known.
Show child attributes

reviews[].counterparty.funding

fundingType

string<enum> required
Instrument discriminator.
Possible values: card, bank_account

displayName

string
Human-readable display label, such as the account nickname or card brand. Omitted when unknown.

last4

string
Last four digits of the card number for card, or of the bank account number for bank_account. Omitted when unknown. At most 4 characters.

nextCursor

string
Opaque cursor for the next page; absent on the last page.

hasMore

boolean required
Whether another page of results follows this one.