Transaction Monitoring & AML

A monitoring case is a review opened when a rule fires, a risk score crosses a threshold, or an operator files a manual review. Status is the lifecycle of the whole object. The audit trail is GET /v1/monitoring/cases/{case_id}/activity. Linked transactions and cards are nested lists. Comments and files attach supporting notes and uploads.

Queues receive cases. A queue has a name, description, default assignee, and routing rules. A newly opened case matches a queue when every rule on that queue matches. When more than one queue matches, the case is assigned to the queue with the earliest created_at.

Every creating POST accepts an optional Idempotency-Key. Replay of the same method, path, and body within 24 hours returns the original status and payload. All operations are program-scoped: send X-Program-ID when the API key can access more than one program.

Status

Status	Meaning
`OPEN`	New and unworked, or returned to the queue.
`IN_REVIEW`	An operator is working the case.
`ESCALATED`	Raised above the first-line queue.
`CLOSED`	Terminal. `resolution` is set.

Allowed transitions:

From	To
`OPEN`	`IN_REVIEW`, `ESCALATED`, `CLOSED`
`IN_REVIEW`	`OPEN`, `ESCALATED`, `CLOSED`
`ESCALATED`	`IN_REVIEW`, `CLOSED`
`CLOSED`	(terminal)

PATCH status, resolution, assignee_id, priority, and queue_id on PATCH /v1/monitoring/cases/{case_id}. Closing requires status CLOSED and resolution. Comments and files are accepted in every status except CLOSED.

stateDiagram-v2
  [*] --> OPEN: opened
  OPEN --> IN_REVIEW: start review
  OPEN --> ESCALATED: escalate
  OPEN --> CLOSED: close
  IN_REVIEW --> OPEN: return to queue
  IN_REVIEW --> ESCALATED: escalate
  IN_REVIEW --> CLOSED: close
  ESCALATED --> IN_REVIEW: de-escalate
  ESCALATED --> CLOSED: close

                    ┌─────────────────────────────────┐
  opened ──────────►│              OPEN               │
                    └───┬──────────┬──────────┬───────┘
                        │          │          │
             start      │          │          │ close
             review     │          │ escalate │
                        v          v          v
                   IN_REVIEW   ESCALATED   CLOSED
                        │          │
                        │ escalate │ de-escalate
                        └────►─────┘
                        │          │
                        └── close ─┴──► CLOSED

Resolution

resolution is null until close. Required values:

Resolution	Meaning
`NO_ACTION`	Review complete; no further program action.
`CONFIRMED_FRAUD`	The activity is fraud.
`FALSE_POSITIVE`	The trigger did not indicate abuse.
`SAR_FILED`	A suspicious-activity report was filed.

Trigger

trigger.type is RULE, MANUAL, or SCORE.

RULE: a matching rule opened the case. rule_id is set.
SCORE: a risk score crossed a threshold. score is 0–100.
MANUAL: an operator opened the case. rule_id and score are null.

risk_score on the case is the numeric signal (0–100) assigned at open. priority (LOW, MEDIUM, HIGH, CRITICAL) is operator urgency and is distinct from risk_score. sla_due_at is the deadline for the first operator action.

Queues

POST /v1/monitoring/queues creates a queue. Routing rules compare TRIGGER_TYPE, CATEGORY, PRIORITY, RISK_SCORE, or WALLET_ID with IS_ONE_OF, IS_NOT_ONE_OF, IS_GREATER_THAN, or IS_LESS_THAN. An empty rules list matches every unrouted case.

default_assignee_id is copied onto matching cases at open. PATCH assignee_id on the case to reassign.

Delete a queue only after every case in OPEN, IN_REVIEW, or ESCALATED has moved off it.

Files

POST /v1/monitoring/cases/{case_id}/files creates a file record and returns a presigned upload_url. PUT the file bytes to that URL before upload_url_expires_at. List responses omit download URLs. Retrieve a file to obtain download_url once upload_status is UPLOADED.