Resolve review

POST
/providers/{providerID}/reviews/{reviewID}/resolutions

Resolve a pending review. Approve to let the payment proceed; reject to block it. Rejecting the last pending review on a cancellable payout (authorized or accepted) cancels that payout. Rejecting a request review cancels nothing: the request blocks new pay attempts, and a funded request is returned to the payer before disbursement.

Returns 201 with the resolved review. Re-resolving an already-resolved review returns 409. A review from another provider returns 404 without side effects. An invalid resolution value returns 400.

Auth: API key or bearer token. Scoped to the calling provider.

Request
cURL
curl -X POST https://api.moov.money/providers/{providerID}/reviews/{reviewID}/resolutions \
  -u "$MOOV_API_KEY_ID:$MOOV_API_KEY_SECRET" \
  -H "X-Moov-Version: v2026.10.00" \
  -H "Content-Type: application/json" \
  -d '{
  "notes": "Verified account holder",
  "resolution": "approved"
}'
Responses
201 400 401 403 404 409 422
The resource was successfully created.
{
  "review": {
    "assessmentScore": 0,
    "counterparty": {
      "displayName": "Jane Doe",
      "externalID": "C-2077",
      "funding": {
        "displayName": "Checking",
        "fundingType": "bank_account",
        "last4": "5612"
      },
      "participantID": "counterparty-id_user",
      "phoneNumber": "+15555551234"
    },
    "createdOn": "2026-08-31T12:00:00Z",
    "flaggedParticipantID": "3v2whagmwvbujhwbt7v3nl6ffq_user",
    "flaggedRole": "sender",
    "initiator": {
      "displayName": "Jane Smith",
      "externalID": "C-1042",
      "funding": {
        "displayName": "Checking",
        "fundingType": "bank_account",
        "last4": "5612"
      },
      "participantID": "participant-id_user"
    },
    "payout": {
      "amount": {
        "currency": {
          "code": "USD",
          "decimalPlaces": 2,
          "name": "US Dollar",
          "numericCode": "840"
        },
        "value": "100.00"
      },
      "payoutID": "pay_01HF5J9ZKQT4RXP8M2VYBN3D",
      "recipientName": "Jane Doe",
      "status": "initiated"
    },
    "reason": "Payout amount above review threshold",
    "request": {
      "amount": {
        "currency": {
          "code": "USD",
          "decimalPlaces": 2,
          "name": "US Dollar",
          "numericCode": "840"
        },
        "value": "100.00"
      },
      "createdOn": "2026-08-31T12:00:00Z",
      "requestID": "01HF5J9ZKQT4RXP8M2VYBN3D_req",
      "status": "created"
    },
    "reviewID": "prv_01HF5J9ZKQT4RXP8M2VYBN3D",
    "riskAssessmentID": "ras_01HF5J9ZKQT4RXP8M2VYBN3D",
    "status": "pending",
    "type": "payout"
  }
}
Malformed request: the body or headers failed validation.
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.
Authentication missing, invalid, or insufficient.
Authentication present but the action is forbidden for this principal/claim.
The requested resource was not found.
The request conflicts with the current state of the target resource.
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.
The request was well-formed but couldn’t be processed (e.g. card declined).
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.

Headers

X-Moov-Version

string
Set this header to the API version being targeted (e.g. v2026.10.00). When omitted, the server applies its default version.

Path parameters

providerID

string required
Your provider account ID.

reviewID

string required
Identifier of the review.

Request

application/json
Your resolution for a pending review. resolution must be approved or rejected.

resolution

string<enum> required
Your decision for this review. Must be approved or rejected.
Possible values: approved, rejected

notes

string
Optional free-form notes (max 512 characters).

Response

Response envelope for resolve review; the resolved review is nested under review.

review

object required
The resolved review summary.
Show child attributes

review

reviewID

string required
Unique system-assigned review identifier.

type

string<enum> required
Kind of payment under review. payout carries the payout summary; request carries the request summary.
Possible values: payout, request

status

string<enum> required
Current review status.
Possible values: pending, approved, rejected

reason

string
Human-readable reason the payment was placed in review.

riskAssessmentID

string
Risk assessment that produced this review, when available.

payout

object
Payout summary for the queue.
Show child attributes

review.payout

payoutID

string required
Unique system-assigned payout identifier.

amount

object required
Payout amount and currency.
Show child attributes

review.payout.amount

value

string required
Decimal amount as a string.

currency

object required
ISO 4217 currency descriptor.
Show child attributes

review.payout.amount.currency

code

string required
Uppercase 3-letter ISO 4217 currency code.

decimalPlaces

integer<uint8> required
Number of minor-unit decimal places for code. Required.

numericCode

string
ISO 4217 numeric currency code, if known. Informational only.

name

string
Human-readable currency name, if known. Informational only.

recipientName

string
Recipient display name when known (given + family), otherwise omitted.

status

string<enum> required
Current lifecycle status of the payout.
Possible values: initiated, authorized, accepted, claiming, completed, failed, payout_failed, cancelled, expired, denied

request

object
Request summary for the queue. Present when the subject is a request.
Show child attributes

review.request

requestID

string required
Unique system-assigned request identifier.

amount

object required
Request amount and currency.
Show child attributes

review.request.amount

value

string required
Decimal amount as a string.

currency

object required
ISO 4217 currency descriptor.
Show child attributes

review.request.amount.currency

code

string required
Uppercase 3-letter ISO 4217 currency code.

decimalPlaces

integer<uint8> required
Number of minor-unit decimal places for code. Required.

numericCode

string
ISO 4217 numeric currency code, if known. Informational only.

name

string
Human-readable currency name, if known. Informational only.

status

string<enum> required
Current lifecycle status of the request.
Possible values: created, authenticated, declined, cancelled, expired, paying, funded, disbursing, disbursement_failed, completed, reversing, reversal_failed, reversed, denied

memo

string
Requester-authored message, when present.

expiresOn

string<date-time> required
When the request expires. Always set: a request carries a fixed expiry from creation.

createdOn

string<date-time> required
When the request was created.

createdOn

string<date-time> required
When the review was created.

holdExpiresOn

string<date-time>
When the review hold stops blocking the payment. Omitted when the hold has no expiration. Expiration does not resolve the review.

resolvedOn

string<date-time>
When the review was resolved. Omitted while pending.

assessmentScore

number<double>
Known assessment score from 0 to 100. A recorded zero is a real score. Omitted when no score was recorded.

flaggedParticipantID

string
Participant who was assessed for this review. Omitted when that subject is unknown.

flaggedRole

string<enum>
Recorded role of the assessed subject. Omitted when the role was not recorded.
Possible values: sender, requester, payer

initiator

object
The participant who started the payment: the sender of a payout or the requester of a request. A name comes from your relationship with the party or from the name recorded on the payment, never from the profile of a participant that is not yours. Fields that are not known are omitted. Omitted when no initiator is recorded.
Show child attributes

review.initiator

participantID

string required
The initiator’s participant ID.

externalID

string
Your external ID for the initiator.

displayName

string
The initiator’s current name (given + family). Omitted when unknown.

funding

object
The initiator’s instrument for this payment: the funding source a payout sends from, or the funding destination a request pays into. Omitted until the instrument is known.
Show child attributes

review.initiator.funding

fundingType

string<enum> required
Instrument discriminator.
Possible values: card, bank_account

displayName

string
Human-readable display label, such as the account nickname or card brand. Omitted when unknown.

last4

string
Last four digits of the card number for card, or of the bank account number for bank_account. Omitted when unknown. At most 4 characters.

counterparty

object
The other party: the recipient of a payout or the payer of a request. The same name rule as initiator applies. Fields that are unbound or not known are omitted. Omitted when no counterparty is recorded.
Show child attributes

review.counterparty

displayName

string
Counterparty display name (given + family) when known.

phoneNumber

string
Counterparty phone number in E.164 form when known.

participantID

string
The party’s participant ID, once the party is bound to the payment. Omitted for an unbound party, such as the recipient of an unclaimed payout or the payer of an open request. The ID does not give access to the record of a participant that is not yours.

externalID

string
Your external ID for the party. Present only when the party is your participant.

funding

object
The instrument the party used for this payment. Omitted until the instrument is known.
Show child attributes

review.counterparty.funding

fundingType

string<enum> required
Instrument discriminator.
Possible values: card, bank_account

displayName

string
Human-readable display label, such as the account nickname or card brand. Omitted when unknown.

last4

string
Last four digits of the card number for card, or of the bank account number for bank_account. Omitted when unknown. At most 4 characters.