{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"redocly_category":"Guides","product":"Fraud Prevention","type":"markdown"},"seo":{"title":"Search and export recommendations via API","description":"Everything about Mosaic Journeys, SDKs, and APIs","siteUrl":"https://developer.transmitsecurity.com/","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"search-and-export-recommendations-via-api","__idx":0},"children":["Search and export recommendations via API"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Fraud Prevention lets you query historical actions for your tenant programmatically within a bounded time window. Use it to build investigation workflows, export records in bulk for offline analytics, or feed downstream fraud-review systems."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Results include the same action and recommandation details as ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/risk/recommendations.openapi/other/getriskrecommendation"},"children":["Recommendations API"]},"—the same ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["context"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["risk_signals"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["transaction_data"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["recommendation"]}," objects—so any existing integration can consume historical actions without learning a second schema."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"query-actions","__idx":1},"children":["Query actions"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/risk/actions-search.openapi/other/searchactions"},"children":["Search Actions API"]}," to retrieve a paginated list of actions. Both ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["start_time"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["end_time"]}," are required as Unix epoch time in milliseconds."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Tip"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Keep the time window as narrow as your use case allows: a tighter range keeps responses fast and pagination predictable. When iterating across multiple pages, fix ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["start_time"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["end_time"]}," once and reuse the same values on every subsequent call."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Rate limit:"]}," 20 requests per 60 seconds per tenant."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Authorization"]},": Requests are authorized with a client access token obtained via the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/token.openapi/other/getaccesstoken"},"children":["token endpoint"]},". The token authenticates requests and scopes results to your tenant."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"basic-query","__idx":2},"children":["Basic query"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Retrieve the first page of all actions for a 24-hour window:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"http","header":{"controls":{"copy":{}}},"source":"GET https://api.transmitsecurity.io/risk/v1/search/actions?start_time=1779600000000&end_time=1779686400000\nAuthorization: Bearer <access_token>\n","lang":"http"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"filter-by-recommendation-and-action-type","__idx":3},"children":["Filter by recommendation and action type"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Narrow results to login actions that received a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["DENY"]}," recommendation. The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["filters"]}," parameter accepts URL-encoded JSON:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"http","header":{"controls":{"copy":{}}},"source":"GET https://api.transmitsecurity.io/risk/v1/search/actions\n  ?start_time=1779600000000\n  &end_time=1779686400000\n  &filters=<url-encoded-json>\nAuthorization: Bearer <access_token>\n","lang":"http"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Decoded filter value:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"and\": [\n    { \"field\": \"recommendation.type\", \"operator\": \"eq\", \"value\": \"DENY\" },\n    { \"field\": \"context.action_type\", \"operator\": \"eq\", \"value\": \"login\" }\n  ]\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can also filter on a single condition or use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["or"]}," instead of ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["and"]},". Supported operators include ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["eq"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["neq"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["lt"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["gt"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["between"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["in"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["nin"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"bulk-export","__idx":4},"children":["Bulk export"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To export all actions within a window, page through results using ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["skip"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["take"]},":"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["take"]},": page size, up to 400 items per request (default: 100)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["skip"]},": offset, up to 10,000"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["fields"]}," parameter to return only the fields you need, which reduces response size significantly for large exports:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"http","header":{"controls":{"copy":{}}},"source":"GET https://api.transmitsecurity.io/risk/v1/search/actions\n  ?start_time=1779600000000\n  &end_time=1779686400000\n  &take=400\n  &skip=0\n  &fields=<url-encoded-json>\nAuthorization: Bearer <access_token>\n","lang":"http"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Decoded ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["fields"]}," value:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"[\"id\", \"issued_at\", \"recommendation.type\", \"risk_score\", \"context.user_id\", \"context.action_type\"]\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For datasets larger than 10,000 items, split the export into shorter, non-overlapping time windows and run requests for each segment."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"api-reference","__idx":5},"children":["API reference"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For the full parameter list, filter syntax, and response schema, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/openapi/risk/actions-search.openapi/other/searchactions"},"children":["Search actions"]},"."]}]},"headings":[{"value":"Search and export recommendations via API","id":"search-and-export-recommendations-via-api","depth":1},{"value":"Query actions","id":"query-actions","depth":2},{"value":"Basic query","id":"basic-query","depth":3},{"value":"Filter by recommendation and action type","id":"filter-by-recommendation-and-action-type","depth":3},{"value":"Bulk export","id":"bulk-export","depth":2},{"value":"API reference","id":"api-reference","depth":2}],"frontmatter":{"markdown":{"toc":{"depth":2}},"seo":{"title":"Search and export recommendations via API"}},"lastModified":"2026-05-28T08:12:23.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/risk/search-recommendations","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}