Create report

Requires reports:write, Authorization: Bearer $GOWALY_API_KEY, Content-Type: application/json, and Idempotency-Key.

narrative and evidence_files are required for report creation. evidence_files must contain 1–9 evidence metadata objects. File bytes are not embedded in report JSON. A supported scam classification is also required: prefer scam_type, or use the supported taxonomy path.

{
  "identifier": "demo-recipient@example.invalid",
  "type": "email",
  "scam_type": "fake_merchant_fake_buyer_scam",
  "narrative": "A synthetic seller requested payment and did not deliver the test item.",
  "consent_truthful": true,
  "consent_prevention_use": true,
  "partner_report_reference": "demo-report-001",
  "evidence_files": [
    {
      "filename": "evidence.png",
      "content_type": "image/png",
      "declared_size": 12345
    }
  ]
}

{
  "request_id": "req_123e4567-e89b-42d3-a456-426614174000",
  "report_id": "rpt_123e4567-e89b-42d3-a456-426614174000",
  "public_reference_code": "GWA-DEMO-001",
  "partner_report_reference": "demo-report-001",
  "status": "pending",
  "display_status": "submitted",
  "uploads": [
    {
      "evidence_id": "evd_123e4567-e89b-42d3-a456-426614174000",
      "upload_url": "https://uploads.example.invalid/signed-object",
      "expires_at": "2026-10-15T13:00:00.000Z",
      "required_headers": {
        "content-type": "image/png"
      },
      "confirm_url": "/api/v1/reports/rpt_123e4567-e89b-42d3-a456-426614174000/evidence/evd_123e4567-e89b-42d3-a456-426614174000/confirm",
      "confirmed": false
    }
  ]
}

Both consent concepts must resolve true. A normal narrative has 20–2000 trimmed supported characters; payment_method other permits a minimum of 1. Consult the canonical OpenAPI for exact bounds.

Optional inputs include amount and incident_date. Follow canonical Commercial OpenAPI bounds for these and other request properties.

Production Commercial OpenAPI

partner_report_reference is optional and scoped to the client and environment. It must follow canonical OpenAPI limits and cannot contain control characters. Conflicting reuse returns 409 PARTNER_REFERENCE_CONFLICT.

Set GOWALY_BASE_URL, GOWALY_API_KEY, and IDEMPOTENCY_KEY on your server. Keep the same idempotency key and semantic payload when retrying an uncertain outcome.

# Run in your server environment. Requires reports:write.
curl --request POST "$GOWALY_BASE_URL/api/v1/reports" \
  --header "Authorization: Bearer $GOWALY_API_KEY" \
  --header "Content-Type: application/json" \
  --header "Idempotency-Key: $IDEMPOTENCY_KEY" \
  --data '{
  "identifier": "demo-recipient@example.invalid",
  "type": "email",
  "scam_type": "fake_merchant_fake_buyer_scam",
  "narrative": "A synthetic seller requested payment and did not deliver the test item.",
  "consent_truthful": true,
  "consent_prevention_use": true,
  "partner_report_reference": "demo-report-001",
  "evidence_files": [
    {
      "filename": "evidence.png",
      "content_type": "image/png",
      "declared_size": 12345
    }
  ]
}'

• request_id
• report_id
• public_reference_code
• partner_report_reference
• status
• display_status
• uploads

For a new report, status is pending and display_status is submitted. Store report_id for subsequent status and evidence operations.

Complete error contract

For card_payment, online_payment_gateway, pos_agent_payment, and other, type and identifier may both be absent. If one is present, both must be supplied and valid. The backend may create a hidden internal identity: do not construct, persist, or expose it.

If a network error or 5xx leaves the outcome unclear, retry with the same Idempotency-Key and the same semantic payload.

Idempotency rules