---
updatedAt: 2026-09-29T08:15:57.000Z
agentTools:
projectIndex: https://docs.sumsub.com/llms.txt
---
# Get applicant fraud networks
# Overview
Use this method to retrieve the [fraud networks](https://docs.sumsub.com/sumsub/docs/fraud-networks-detection) related to a certain applicant, provided such networks exist. The response would contain the found networks sorted by the date they were modified.
### Note
If you want to get:
- All existing fraud networks, use [this method](/reference/get-fraud-networks).
- A certain fraud network by `networkId`, use [this method](reference/get-fraud-network-by-id).
## Required permissions
To use this method:
* Your [app token](https://docs.sumsub.com/sumsub/docs/app-tokens) must have the **View fraud networks** [permission](https://docs.sumsub.com/sumsub/docs/user-roles#permissions).
* **Fraud Networks** must be enabled as a feature on your account.
Both conditions are required — missing either one returns a `403 Forbidden`. If **Fraud Networks** is not enabled for your account, contact your CSM or Sumsub support.
# Request example
The following request example returns all the found fraud networks related to the specified `applicantId`.
```curl
curl -X GET \
'https://api.sumsub.com/resources/applicantFraudNetworks/-/byApplicant/6527f4f021031b3dec0000e1' \
-H 'X-App-Token: ' \
-H 'X-App-Access-Sig: ' \
-H 'X-App-Access-Ts: '
```
# Response explained
| Name | Type | Description |
| :-------- | :---------------------------------------- | :-------------------------------------------------------------- |
| `network` | [Object](#network-attributes) | Includes the attributes of the network. |
| `stats` | [Object](#stats-attributes) | Includes the statistic attributes related to the network. |
| `notes` | [Array of objects](#notes-element-fields) | Contains the note added to the case and the `notes` attributes. |
## `network` attributes
| Name | Type | Description |
| :----------- | :---------------------------------------- | :----------------------------------------------------------------------------------------------------------------------------- |
| `id` | String | Unique network identifier. |
| `createdAt` | Date | Date and time when the network was created (format `YYYY-MM-DD hh:mm:ss+0000`, for example, `2023-10-12 14:38:42+0000`). |
| `modifiedAt` | Date | Date and time when the network was last modified (format `YYYY-MM-DD hh:mm:ss+0000`, for example, `2023-10-12 14:38:42+0000`). |
| `nodes` | [Array of objects](#nodes-element-fields) | Includes the data that explains how the applicant is associated with the network. |
### `nodes` element fields
| Name | Type | Description |
| :------------------- | :------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------- |
| `id` | String | Unique applicant identifier. |
| `externalUserId` | String | Unique applicant identifier as registered on your side. |
| `ips` | Array of strings | Array of IP addresses connected with the applicant. |
| `deviceFingerprints` | Array of strings | Array of device fingerprints connected with the applicant. |
| `imageTemplates` | [Array of objects](#imagetemplates-element-fields) | Includes the data about the applicant documents, their types and identifiers. |
| `addedAt` | Date | Date and time when the applicant was added to the network (format `YYYY-MM-DD hh:mm:ss+0000`, for example, `2023-10-12 14:38:42+0000`). |
### `imageTemplates` element fields
| Name | Type | Description |
| :----------------- | :------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `templateType` | String | Type of connection including `address`, `fingerprint`, `ip`, `poaTemplate`, `documentTemplate`, `selfieTemplate`, `cookie`, `livenessDevice`, `mobileCookie`. |
| `address` | String | Applicant POA address (not empty for `templateType=address`). |
| `referenceImageId` | Integer | Unique applicant image identifier that belongs to the applicant of the same [node](#nodes-object). |
| `idDocType` | String | Applicant document type. |
| `idDocSubType` | String | Applicant document subtype. |
| `imageTemplateId` | String | Unique template identification number. Similar documents, selfies, or other images have the same `imageTemplateId`. |
## `stats` attributes
[block:parameters]
{
"data": {
"h-0": "Name",
"h-1": "Type",
"h-2": "Description",
"0-0": "`GREEN`",
"0-1": "Integer",
"0-2": "Amount of approved applicants.",
"1-0": "`RED`",
"1-1": "Integer",
"1-2": "Amount of rejected applicants",
"2-0": "`size`",
"2-1": "Integer",
"2-2": "Network size.",
"3-0": "`networkReasons`",
"3-1": "String",
"3-2": "Indicates the reasons for network creation and its similarities.
\nPossible values:address — applicants added POA with the same addresses.fingerprint — applicants used shared devices when going through the KYC check.ip — applicants used the same IP addresses.poaTemplate — applicants have similar POA.documentTemplate — applicants have similar documents.selfieTemplate — selfies of the applicants have the same background.cookie — another indicator that applicants used shared devices during the KYC check.livenessDevice — indicates that applicants used shared device and camera during the Liveness check.mobileCookie — a high-confidence signal confirming that applicants used the same mobile device throughout the KYC verification.
",
"4-0": "`topCountries`",
"4-1": "Map of String,Integer pairs",
"4-2": "Top applicant countries with a counter.",
"5-0": "`medianAge`",
"5-1": "Double",
"5-2": "Median age of the applicants included in the network."
},
"cols": 3,
"rows": 6,
"align": [
"left",
"left",
"left"
]
}
[/block]
## `notes` element fields
[block:parameters]
{
"data": {
"h-0": "Name",
"h-1": "Type",
"h-2": "Description",
"0-0": "`id`",
"0-1": "String",
"0-2": "Unique note identifier.",
"1-0": "`targetId`",
"1-1": "Integer",
"1-2": "Object (`networkId`) the note relates to.",
"2-0": "`targetType`",
"2-1": "String",
"2-2": "`applicantFraudNetwork`. \nIn general case, it also could be `applicant`, `transaction`, `amlCase`, `kytCase`.",
"3-0": "`note`",
"3-1": "String",
"3-2": "Note added to the case.",
"4-0": "`createdAt`",
"4-1": "Date",
"4-2": "Date and time when the note was created (format `YYYY-MM-DD hh:mm:ss+0000`, for example, `2023-10-12 14:38:42+0000`).",
"5-0": "`modifiedAt`",
"5-1": "Date",
"5-2": "Date and time when the note was last modified (format `YYYY-MM-DD hh:mm:ss+0000`, for example, `2023-10-12 14:38:42+0000`).",
"6-0": "`createdBy`",
"6-1": "String",
"6-2": "Note creator name.",
"7-0": "`tags`",
"7-1": "Array of strings",
"7-2": "[Added tags](https://docs.sumsub.com/sumsub/docs/review-results-in-applicant-profile#assign-tags).",
"8-0": "`attachments`",
"8-1": "Array of strings",
"8-2": "Information about the note attachments.",
"9-0": "`clientNote`",
"9-1": "Boolean",
"9-2": "`true`."
},
"cols": 3,
"rows": 10,
"align": [
"left",
"left",
"left"
]
}
[/block]
### Response example
```json
{
"list": {
"items": [
{
"network": {
"id": "6527f5885694ddb4054b658a",
"createdAt": "2023-10-12 14:38:42+0000",
"modifiedAt": "2023-10-12 14:38:42+0000",
"nodes": [
{
"id": "6527f4f021031b3dec0000e1", // applicant id in the Sumsub system
"externalUserId": "someUniqueUserId", // applicant identifier as registered on your side
"ips": [
"111.111.11.11",
"222.222.22.222",
"333.333.33.333",
"444.444.44.44"
],
"deviceFingerprints": [
"6a901dd64f8d68aa5b93bbfad112849e"
],
"imageTemplates": [
{
"templateType": "poaTemplate",
"referenceImageId": 1121273889, // image id within the applicant
"idDocType": "UTILITY_BILL",
"idDocSubType": "FRONT_SIDE",
"imageTemplateId": "cd6070288f0645c29d76712c514e62c0" // unique id of the group of POAs
},
...
{
"templateType": "poaTemplate",
"referenceImageId": 1667162048,
"idDocType": "DRIVERS",
"idDocSubType": "BACK_SIDE",
"imageTemplateId": "139a87b4645441fdb0916be110f7e1c2"
}
],
"addedAt": "2023-10-12 14:38:42+0000"
},
{
"id": "6527f4a521031b3dec9785cd",
"ips": [
"111.111.11.11",
"222.222.22.222",
"333.333.33.333"
],
"deviceFingerprints": [
"6a901dd64f8d68aa5b93bbfad112849e"
]...}
'''
],
},
"stats": {
"GREEN": 0,
"RED": 1,
"size": 4,
"networkReasons": [
"documentTemplate",
"poaTemplate",
"fingerprint"
],
"topCountries": {
"ALB": 1,
"DZA": 1
}
},
"notes": [
{
"id": "652804f23ad8116578e0d619",
"targetId": "6527f5885694ddb4054b658a",
"targetType": "applicantFraudNetwork",
"note": "Due to suspected fraud, access must be restricted to determine further action.",
"createdAt": "2023-10-12 14:38:42+0000",
"modifiedAt": "2023-10-12 14:38:42+0000",
"createdBy": "Service",
"tags": [
"fraud" // tags as set up in the global settings section
]
},
...
]
}
"totalItems": 1
}
}
```
# OpenAPI definition
```json
{
"openapi": "3.1.0",
"info": {
"title": "sumsub-api",
"version": "1.0"
},
"servers": [
{
"url": "https://api.sumsub.com"
}
],
"components": {
"securitySchemes": {
"sec0": {
"type": "apiKey",
"name": "X-App-Token",
"in": "header",
"x-default": ""
}
}
},
"security": [
{
"sec0": []
}
],
"paths": {
"/resources/applicantFraudNetworks/-/byApplicant/{applicantId}": {
"get": {
"summary": "Get applicant fraud networks",
"description": "",
"operationId": "get-applicant-fraud-networks",
"parameters": [
{
"name": "applicantId",
"in": "path",
"description": "Unique applicant identifier in the Sumsub system.
This identifier is a random combination of 24 digits and lowercase Latin characters. It is automatically generated when the applicant is created on the Sumsub side, and can be found in the [Dashboard](https://cockpit.sumsub.com/checkus/#/applicants/individual?limit=10&page=0).
If the `applicantId` is unknown to you, use the [Get applicant data (externalUserId)](https://docs.sumsub.com/sumsub/reference/get-applicant-data-via-externaluserid) method to fetch it.",
"schema": {
"type": "string"
},
"required": true
}
],
"deprecated": false
}
}
},
"x-readme": {
"headers": [],
"explorer-enabled": true,
"proxy-enabled": true
},
"x-readme-fauxas": true
}
```