Authenticate every workspace request.
Use the bearer token issued to an activated workspace. The service resolves organization, edition, role, and product entitlement from the authenticated profile; client-supplied tenant identifiers are not trusted.
Authorization: Bearer <workspace-token>
Accept: application/jsonUpload a batch or connect recurring ingestion.
The Review Pack accepts one CSV or XLSX file. Continuous workspaces can use recurring uploads and approved API ingestion. A batch identifier is retained through generated alerts, cases, and reports.
POST /scan/runs/upload
Authorization: Bearer <workspace-token>
Content-Type: multipart/form-data
file=@transactions.csv{
"id": "run_01J...",
"status": "processing",
"file_name": "transactions.csv",
"tx_count": 8240,
"created_at": "2026-08-03T04:00:00Z"
}Read deterministic detection results.
Poll /scan/runs/:id for completion and /scan/runs/:id/results for flagged accounts. Each result carries its score, severity, matched rule reasons, evidence, and source batch.
Move evidence through cases and reports.
| Surface | Primary operations | Human boundary |
|---|---|---|
/alerts | List, inspect, assign, and disposition rule hits. | Analyst confirms meaning and next action. |
/cases | Create a case, attach alerts, add notes, and export evidence. | Reviewer owns escalation and closure. |
/str-reports | Create and review the workspace's suspicious-activity report record. | Drafts require editing and approval; filing is not automatic. |
Treat limits and retries as protocol.
- 400Malformed file, request shape, or unsupported value.
- 401 / 403Missing identity, role, product entitlement, or organization access.
- 409Duplicate or conflicting idempotent operation.
- 422Valid transport with rows or fields that fail validation.
- 429Product row or request boundary reached; processing pauses without an overage charge.
Use idempotency keys on retryable ingestion and scoring requests. Product limits are 10,000 rows for a Review Pack and 25,000 rows per billing month for Continuous.
Need a bank integration scope?
Discuss the interface →