> ## Documentation Index > Fetch the complete documentation index at: https://developers.portao3.com.br/llms.txt > Use this file to discover all available pages before exploring further. # List an organization's Pix infractions > Lists the organization's Pix infractions (MED), from all of its accounts and wallets: the reports other institutions opened against Pix it received (`direction` `RECEIVED`), and the ones Portão 3 opened about Pix it sent (`SENT`). The list is not paginated and comes in no guaranteed order. Only the infractions of the environment in `x-environment` are listed, so send `x-environment: LIVE` for production ones. Only Portão 3's own services and back office can read Pix infractions. ## OpenAPI ````yaml /api-reference/banking.openapi.json get /realms/{realmId}/organizations/{organizationId}/pix-infraction openapi: 3.0.3 info: title: Banking version: 1.0.0 description: >- Portão 3 banking API. Every endpoint requires a bearer token in the Authorization header (Authorization: Bearer ) unless its page states otherwise; see the Authentication guide. That requirement is not repeated per endpoint. Generated by tools/openapi from code (routes + security) and the hand-written spec (request/response bodies). Banking attaches a zod validationSchema at the route; request bodies are resolved from it (object + array roots). Responses have no presenter layer, so they stay tier=unknown. Confidence tiers: generated:typed=300 copied:manual=0 unknown=20. servers: - url: https://api.banking.v2.portao3.com.br/ description: production - url: https://api.banking.dev.3pers.com.br/ description: development security: [] tags: - name: Accounts - name: Account Limits - name: Wallets - name: Transaction Limits - name: Transfers - name: Cards - name: Card Limits - name: Cards 3DS - name: Pix Payments - name: Pix Keys - name: PIX Charges - name: PIX Automatic - name: PIX Initiation (Open Finance) - name: PIX Infractions (MED) - name: Boleto Payments - name: Boleto Charges - name: TED Payments - name: Transactions - name: Transaction Reversals - name: Spend Review - name: Cashback - name: Currency Codes paths: /realms/{realmId}/organizations/{organizationId}/pix-infraction: get: tags: - PIX Infractions (MED) summary: List an organization's Pix infractions description: >- Lists the organization's Pix infractions (MED), from all of its accounts and wallets: the reports other institutions opened against Pix it received (`direction` `RECEIVED`), and the ones Portão 3 opened about Pix it sent (`SENT`). operationId: getRealmsByRealmIdOrganizationsByOrganizationIdPixInfraction parameters: - name: realmId in: path required: true description: |- ID of the realm. Format: `UUID` schema: type: string format: uuid example: f495ff0c-ab54-4f99-8e92-ca8682e4de9b - name: organizationId in: path required: true description: |- ID of the organization. Format: `UUID` schema: type: string format: uuid example: c4bd3f21-dfbd-44e8-8055-68ba15bed410 - name: x-environment in: header required: false description: >- Environment whose infractions you list: `LIVE` (production) or `TEST` (sandbox). When you omit it, you get the `TEST` infractions; any other value is rejected. schema: type: string enum: - LIVE - TEST example: LIVE responses: '200': description: Successful response content: application/json: schema: type: array items: type: object properties: _id: type: string description: ID of the infraction (24 hexadecimal characters). example: 6727d4e1b4d3e80012c9a5a3 environment: type: string enum: - LIVE - TEST description: >- Environment of the infraction: `LIVE` (production) or `TEST` (sandbox). example: LIVE realmId: type: string description: ID of the realm. example: f495ff0c-ab54-4f99-8e92-ca8682e4de9b organizationId: type: string description: ID of the organization. example: c4bd3f21-dfbd-44e8-8055-68ba15bed410 accountId: type: string description: ID of the organization's account. example: 66f2a1c7b4d3e80012c9a0b4 walletId: type: string description: ID of the wallet that sent or received the Pix. example: 66f2a3d1b4d3e80012c9a0d2 transactionId: type: string description: ID of the Pix transaction in the wallet's statement. example: 6726b1c2b4d3e80012c9a4f7 endToEndId: type: string description: >- End-to-end ID of the Pix (32 characters). Absent or empty on a few older reports. example: E12345678202610281415a1B2c3D4e5F direction: type: string enum: - SENT - RECEIVED description: >- Which side the wallet is on: `RECEIVED` — another institution reported a Pix the wallet received (the payer says it was a fraud); `SENT` — Portão 3 reported a Pix the wallet sent, at the organization's request. example: RECEIVED reason: type: string enum: - REFUND_REQUEST - REFUND_CANCELLED description: >- `REFUND_REQUEST` — the report asks for the money back; `REFUND_CANCELLED` — the bank marked the request as cancelled. On a report Portão 3 just opened, until the bank's first update, it is the value sent with it, and cancels nothing. Some older cancelled reports still say `REFUND_REQUEST`. Read `status` to know whether a report was cancelled. example: REFUND_REQUEST situationType: type: string enum: - SCAM - ACCOUNT_TAKEOVER - COERCION - FRAUDULENT_ACCESS - OTHER - UNKNOWN description: >- What the report says happened: `SCAM` — the payer was deceived into paying; `ACCOUNT_TAKEOVER` — someone took over the payer's account; `COERCION` — the payer was forced to pay; `FRAUDULENT_ACCESS` — someone used the payer's account without permission; `OTHER` — anything else, or not stated. `UNKNOWN` appears only on a report you just opened with it, until the bank's first update (it is reported as `OTHER`). example: SCAM reportDetails: type: string nullable: true description: >- What happened, in the reporter's words. Empty or `null` on some older reports. example: >- Paguei por um produto que nunca recebi. O vendedor parou de responder. external: type: object properties: infractionId: type: string description: >- The bank's ID of the report. Empty on some older reports. example: 3f9c2a71-8d4e-4b6a-9e15-2c7d0b8a4f63 fraudMarkerId: type: string description: >- A second reference the bank gives the report. Empty when the bank sent none. example: b7e14c90-2f3a-4d8b-a6c5-91e0d3f72b48 required: - infractionId - fraudMarkerId description: References of the report at the bank. status: type: string enum: - OPEN - ACKNOWLEDGED - CLOSED - CANCELLED - CREATED description: >- Where the report stands: `CREATED` — just opened by Portão 3, until the bank's first update; `OPEN` — opened, waiting for the receiver's institution; `ACKNOWLEDGED` — the receiver's institution is analyzing it; `CLOSED` — the analysis is over (see `analysisResult`); `CANCELLED` — the report was withdrawn. `CLOSED` and `CANCELLED` are final. example: CLOSED reportParticipant: type: object properties: id: type: string description: >- Code of the institution that opened the report, as the bank sent it on some older reports (without leading zeros). Empty or absent on the others — read `bankIspb`. example: '' bankIspb: type: string description: ISPB (8 digits) of the payer's institution. example: '12345678' name: type: string description: Name of the payer. example: Mariana Souza email: type: string description: >- Contact e-mail of the institution that opened the report, on some older reports only. Empty or absent on the others. example: '' phone: type: string description: >- Contact phone of the institution that opened the report, as that institution wrote it (not in a standard format), on some older reports only. Empty or absent on the others. example: '' description: The side that opened the report (the payer's). counterpartyParticipant: type: object properties: id: type: string description: >- Code of the receiving institution, as the bank sent it on some older reports. Empty or absent on the others. example: '' bankIspb: type: string description: >- ISPB (8 digits) of the receiver's institution, when known. example: '87654321' name: type: string description: Name of the receiver, when known. Often empty. example: Gráfica Aurora Ltda description: The side the report is against (the receiver's). analysisResult: type: string enum: - AGREED - DISAGREED - PENDING description: >- The receiver's institution's conclusion: `AGREED` — it agrees the Pix was a fraud; `DISAGREED` — it doesn't; `PENDING` — no conclusion recorded. Final only once `status` is `CLOSED`: on a report you received it can already say `AGREED` while the report is `OPEN` or `ACKNOWLEDGED`. example: AGREED analysisDetails: type: string description: >- Notes of the analysis, when the receiver's institution wrote any. Empty otherwise. example: >- Recebedor notificado; valor bloqueado e devolvido ao pagador. effectiveAt: type: string description: >- When the report was opened at the bank (ISO 8601, UTC). Not always the bank's time: on a report Portão 3 just opened (until the bank's first update) and on the records written when a wallet is blocked for fraud, it is when the record was written — on some older ones, a moment before it. example: '2026-10-28T17:20:11.000Z' changedAt: type: string description: >- When the report's last change was recorded (ISO 8601, UTC). On a few older reports that never recorded one, the time of your request. example: '2026-11-03T12:05:42.318Z' createdAt: type: string description: When the infraction was recorded (ISO 8601, UTC). example: '2026-10-28T17:20:13.402Z' format: date-time updatedAt: type: string description: When the infraction was last updated (ISO 8601, UTC). example: '2026-11-03T12:05:42.320Z' format: date-time __v: type: number description: Internal version of the record. example: 0 required: - _id - environment - realmId - organizationId - accountId - walletId - transactionId - direction - reason - situationType - reportDetails - external - status - analysisResult - analysisDetails - effectiveAt - changedAt - createdAt - updatedAt - __v description: >- A Pix infraction report (MED — the Central Bank's special refund mechanism): a claim that a Pix was a fraud, opened by the payer's institution against the receiver's so the money can be blocked and returned. `direction` says which side the wallet is on. '403': description: >- `USER_NOT_HAVE_WALLET_PERMISSION` — You are not a Portão 3 service or back-office operator. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - USER_NOT_HAVE_WALLET_PERMISSION description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - BANKING description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: USER_NOT_HAVE_WALLET_PERMISSION origin: BANKING message: You do not have permission to perform this action '422': description: >- `BAD_REQUEST` — A path parameter is not a valid ID; `fields` lists each one. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - BAD_REQUEST description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - BANKING description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. fields: type: array description: >- One entry per invalid request field (validation errors only). items: type: object properties: field: type: string description: >- Path of the invalid field, e.g. `label` or `values[0].value`. example: label message: type: string description: Why the field was rejected. example: label is required code: type: string description: >- `_` — e.g. `LABEL_REQUIRED`, `TYPE_ONE_OF`, `VALUES_VALUE_TYPE_ERROR`. example: LABEL_REQUIRED values: type: array items: type: string description: >- The accepted values, when the field is an enumeration. required: - field - message - code required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: BAD_REQUEST origin: BANKING message: >- Bad Request: Your request is invalid or incomplete. Please make sure you are requesting with the right fields. fields: - field: organizationId message: Invalid UUID code: ORGANIZATIONID_UUID ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.