Skip to main content
Reviews are your team’s own compliance reviews: the screenings of yours that need a person (a possible sanctions or PEP match, a result flagged for review), the ones your ongoing monitoring or list screening opens, and the ones your team opens by hand. The portal is where your team works them. The Reviews API lets your own case system do the same, and keeps it in step through webhooks.
The Reviews API and its webhooks need the Reviews API and Webhooks add-on. Exports need the Audit Pack. Without the add-on an endpoint answers 403 module_not_enabled. Every endpoint also needs a credential with the intelligence scope.
These are your records, held for you. Reviews only ever contain your own screenings and your own team’s work. Anton’s own screening of payouts is separate and never appears in a review, a count or an event.

​
What the API returns

A review carries ids, codes, the masked subject (V*** S***) and your own reference for it (cust_7731). It never returns a name, a date of birth, contact details or the text of a note. Notes are stored in a vault, separately for your account. The API can add them but never reads them back. Your team reads them in the portal, and they appear in the case files your people export.

​
Recording decisions

Record a decision with a reason code. Send an Idempotency-Key with every change.
  • waiting_on_customer pauses the review’s due time while you ask your customer for something. Call resume when they answer.
  • A decision covered by your second-approver setting waits for someone on your team to approve it in the portal.
  • A decision your API credential makes that clears the subject (not_a_match, no_concern) always waits for a person, whatever your setting (approval_rule: api_clearance). That person must be independent of your API credentials. They cannot be the one who created the credential, or have a role that can create, rotate or revoke credentials (Admin, Technical). In practice that is your Compliance role. If nobody on your team qualifies, the decision is refused with 409 second_approver_unavailable.
  • Approving, sending a decision back and withdrawing one are done by people, in the portal. The API has no endpoints for them.
  • Reviews opened by your own payout rules (payout_held_by_rule, payee_risk_by_rule) are decided on their approval in the portal.

​
Events

Subscribe to intelligence.review.* with POST /v1/webhooks to keep your case system in step. See Webhook Events for the payloads. Events carry ids, codes and your own reference only.

​
Exports for your auditors

With the Audit Pack you can export your records at any time, for any review your account holds, whatever its status:
  • CSV: reviews opened in a date range (up to 366 days and 10,000 reviews per export).
  • Case file: one review’s formal record as a PDF, with the summary, decisions and approvals, the screening evidence and the audit trail.
Each export is recorded in your audit log: who exported what, when, and a SHA-256 digest of the file. Exports don’t take an Idempotency-Key, because each call is a separate audited export. A case file exported with an API credential leaves out note text and your team members’ names. Your people get notes in the case files they export.

​
Retention

Review records are kept for 7 years by default. An Admin can extend the period in the portal (beyond 7 years with the Audit Pack). It can never be shortened, and nothing is deleted early while your account is active. Get review settings shows the current period.