---
title: "Report what happened after a decision"
method: POST
path: "/decisions/{decision_id}/outcome"
tags: ["Decisions"]
---

# Report what happened after a decision

`POST /decisions/{decision_id}/outcome`

## Request

- Base URL: `https://developers.ozav.io/v2`
- URL: `https://developers.ozav.io/v2/decisions/{decision_id}/outcome`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Tells OZAV how the case ended. An outcome is recorded once: a second report returns
`409 OUTCOME_ALREADY_RECORDED`. Outcomes help OZAV measure and improve its rules.

## Path parameters

- `decision_id` string, required

## Request body

- DecisionOutcomeRequest
  - `outcome` 'confirmed_risk' | 'false_positive' | 'completed' | 'reversed' | 'chargeback', required: - `confirmed_risk` - the risk was real. - `false_positive` - the flag was wrong. - `completed` - the operation went ahead and completed normally. - `reversed` - the operation was reversed or refunded. - `chargeback` - the operation ended in a chargeback.
  - `note` string: Optional free text.

## Response `200`

The decision with its outcome.

- Decision
  - `id` string, required: The decision id (`ozav_dec_...`).
  - `object` 'decision', required: Always the literal `decision`.
  - `type` 'name.match' | 'destination.ownership' | 'wallet.risk' | 'transaction.outbound', required: The decision type requested.
  - `effect` 'ALLOW' | 'REVIEW' | 'DENY', required: `ALLOW`, `REVIEW` (a person should look) or `DENY` (OZAV holds the proof of the risk).
  - `reasons` object[], required: Why. When `effect` is not `ALLOW`, only the reasons that caused it.
    - `code` string, required: Stable machine code, e.g. `NAME_MATCHES_SANCTIONS_LIST`.
    - `message` string, required: A human-readable sentence.
  - `checks` object[], required: Each check that ran and what it found.
    - `check` string, required: `sanctions_list`, `designated_addresses` or `destination_ownership`.
    - `result` string, required: What the check found.
  - `policy_version` string, required: The version of OZAV's rules that produced the verdict.
  - `outcome` 'confirmed_risk' | 'false_positive' | 'completed' | 'reversed' | 'chargeback' | 'null', nullable, required: The outcome you reported, or `null`.
  - `outcome_at` string, date-time, nullable, required: When the outcome was reported.
  - `created_at` string, date-time, required: When the decision was made.

## Other responses

- `400`: The request is invalid.
- `401`: Missing or invalid API key.
- `404`: The resource does not exist, is not visible to the caller, or the id was malformed for this position (see "Resource ids" under Errors). These share one status; `code` and `message` tell them apart.
- `409`: Conflict (e.g. IDEMPOTENCY_KEY_REUSED).
- `503`: A dependency OZAV needs (storage, a resource lookup) could not be reached, so OZAV fails closed rather than guess. Safe to retry with the same `Idempotency-Key` where the operation accepts one.

---

[API](https://skmtc.dev/ozav/apis/ozav-api.md) - [All operations](https://skmtc.dev/ozav/apis/ozav-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ozav/apis/ozav-api/revisions/4133dc2109d7?raw)