Risk controls govern how Flint handles each payment attempt. Merchant-managed rules decide whether an attempt is allowed, blocked, challenged with 3DS, or held for review; lists hold the values rules match against; reviews queue held payments for a manual decision; and fraud warnings record issuer-reported fraud after a payment.
Rules use a strict JSON predicate grammar. Retrieve GET /v1/risk-rules/attributes before authoring rules: risk scoring is not enabled in every environment, and the registry reports which attributes your sandbox or live environment can use. Validate a candidate rule through POST /v1/risk-rules/validate; use POST /v1/risk-rules/evaluate for a side-effect-free match explanation.
Approving a review does not capture the payment; it only makes an unexpired manual authorization eligible for a later capture. Declining one may return 202 Accepted while cancellation or refund work completes: poll the review according to Retry-After or subscribe to the review.closed webhook event. Fraud warnings are distinct from the original risk assessment and can later link to a dispute. A null risk score means scoring was unavailable, not that the score was zero.
Reads require the risk.read scope, review actions require risk.reviews.write, and rule and list mutations require risk.controls.write.
For predicate examples, lifecycle guidance, error handling, and webhook behavior, see the Risk Controls guide.