Transaction Monitoring

Evaluate transactions in real-time against configurable AML rules. When a rule triggers, an alert is created for investigation.

Evaluate a Transaction

Submit a transaction for rule evaluation:

cURL
Python

curl -X POST https://api.korastratum.com/api/v1/monitoring/evaluate \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Tenant-ID: YOUR_TENANT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "transaction_id": "txn_abc123",
    "customer_id": "cust_def456",
    "transaction_type": "TRANSFER",
    "amount": 15000.00,
    "currency": "USD",
    "direction": "OUTBOUND",
    "channel": "WIRE",
    "country": "KY"
  }'

response = requests.post(
    f"{BASE_URL}/monitoring/evaluate",
    headers=HEADERS,
    json={
        "transaction_id": "txn_abc123",
        "customer_id": "cust_def456",
        "transaction_type": "TRANSFER",
        "amount": 15000.00,
        "currency": "USD",
        "direction": "OUTBOUND",
        "channel": "WIRE",
        "country": "KY",
    },
)

result = response.json()

Response:

{
  "composite_score": 620,
  "risk_level": "HIGH",
  "decision": "REVIEW",
  "confidence": 0.86,
  "layer_scores": {
    "rules": 620,
    "behavioral": 40,
    "network": 0
  },
  "explanation": "High-value outbound transfer to a high-risk jurisdiction; matched 2 monitoring rules."
}

risk_level is one of LOW, HIGH, or CRITICAL; decision is CLEAR, REVIEW, or BLOCK. layer_scores breaks the composite score down by scoring layer, and explanation is a human-readable summary. Alerts raised by a triggered rule are retrieved separately via GET /monitoring/alerts.

Monitoring Rules

Rules define what triggers an alert. Each rule has a rule_type, its matching parameters, optional conditions that scope which transactions it applies to, a category, and a severity.

List Rules

curl https://api.korastratum.com/api/v1/monitoring/rules \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Tenant-ID: YOUR_TENANT_ID"

Create a Rule

Rules are typed: you choose a rule_type and supply the matching parameters, rather than composing generic field / operator / value conditions. A THRESHOLD rule that flags cash transactions at or above $10,000:

curl -X POST https://api.korastratum.com/api/v1/monitoring/rules \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Tenant-ID: YOUR_TENANT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "code": "LARGE_CASH_10K",
    "name": "Large cash transaction",
    "description": "Flag cash transactions at or above $10,000",
    "rule_type": "THRESHOLD",
    "category": "AML",
    "severity": "HIGH",
    "parameters": {
      "amount_threshold": 10000,
      "amount_operator": "GTE"
    },
    "conditions": {
      "transaction_types": ["CASH"]
    },
    "actions": {
      "create_alert": true,
      "alert_priority": "HIGH"
    }
  }'

code is a stable identifier, unique per tenant (re-using one returns 409). rule_type is one of THRESHOLD, VELOCITY, PATTERN, GEOGRAPHIC, BEHAVIORAL, NETWORK, BLACKLIST, CHARGEBACK_RATIO, DORMANT_REACTIVATION, NEW_DEVICE, CUSTOM. category is one of AML, FRAUD, SANCTIONS, STRUCTURING, TERRORIST_FINANCING, TAX_EVASION, CORRUPTION, OTHER. severity is LOW, MEDIUM, HIGH, or CRITICAL.

Amount operators

Amount comparisons use parameters.amount_operator against parameters.amount_threshold. These are the only comparison operators, and they apply to the amount — there is no generic per-field operator:

Operator	Meaning
`GT`	amount > threshold
`GTE`	amount ≥ threshold (default if omitted)
`LT`	amount < threshold
`LTE`	amount ≤ threshold
`EQ`	amount = threshold

No NOT_EQUALS

The engine has no NOT_EQUALS / NEQ operator (nor IN / BETWEEN / CONTAINS). Amount uses the five operators above; everything else is expressed through typed conditions (below).

Conditions (scoping which transactions a rule applies to)

conditions is an object (not an array) that narrows a rule to a subset of transactions. Categorical fields are inclusion lists — the rule applies only when the transaction's value is in the list:

Condition	Type	The rule applies when…
`min_amount` / `max_amount`	number	amount falls within the range
`transaction_types`	list	transaction type is in the list — e.g. `["CASH"]`
`directions`	list	direction is in the list — e.g. `["OUTBOUND"]`
`auth_status`	list	authorization status is in the list — e.g. `["DECLINED","FAILED"]`
`currencies`	list	currency is in the list
`customer_types`	list	customer type is in the list
`risk_categories`	list	customer risk category is in the list

Expressing “not equal”. Because these are inclusion lists, there is no “not equals”. To exclude a value, list the ones you do want to match (the complement). For example, to apply a rule to every transaction type except CASH, set "transaction_types": ["TRANSFER","WITHDRAWAL","DEPOSIT"] with the types you want covered. To apply a rule to all transaction types, simply omit transaction_types.

Update a Rule

PUT with the same schema as create:

curl -X PUT https://api.korastratum.com/api/v1/monitoring/rules/{rule_id} \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Tenant-ID: YOUR_TENANT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "code": "LARGE_CASH_10K",
    "name": "Large cash transaction",
    "rule_type": "THRESHOLD",
    "category": "AML",
    "severity": "HIGH",
    "parameters": { "amount_threshold": 25000, "amount_operator": "GTE" },
    "conditions": { "transaction_types": ["CASH"] },
    "actions": { "create_alert": true, "alert_priority": "HIGH" }
  }'

Enable / disable a rule (no delete)

Compliance rules are never hard-deleted (audit requirement) — disable or re-enable them instead:

# Disable
curl -X PUT https://api.korastratum.com/api/v1/monitoring/rules/{rule_id}/disable \
  -H "Authorization: Bearer YOUR_API_KEY" -H "X-Tenant-ID: YOUR_TENANT_ID"

# Re-enable
curl -X PUT https://api.korastratum.com/api/v1/monitoring/rules/{rule_id}/enable \
  -H "Authorization: Bearer YOUR_API_KEY" -H "X-Tenant-ID: YOUR_TENANT_ID"

Manage Alerts

List Alerts

# List all new alerts
curl "https://api.korastratum.com/api/v1/monitoring/alerts?status=NEW" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Tenant-ID: YOUR_TENANT_ID"

# List high-severity alerts
curl "https://api.korastratum.com/api/v1/monitoring/alerts?severity=HIGH" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Tenant-ID: YOUR_TENANT_ID"

Get Alert Details

curl https://api.korastratum.com/api/v1/monitoring/alerts/alt_abc123 \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Tenant-ID: YOUR_TENANT_ID"

Dispose an Alert

curl -X PUT https://api.korastratum.com/api/v1/monitoring/alerts/alt_abc123/disposition \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "X-Tenant-ID: YOUR_TENANT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "disposition": "TRUE_POSITIVE",
    "reason": "Suspicious pattern confirmed — filing SAR"
  }'

Alert statuses:

Status	Description
`NEW`	Alert just created
`UNDER_REVIEW`	Being investigated
`ESCALATED`	Escalated to senior reviewer
`CLOSED`	Resolved with disposition

Common Rule Patterns

Structuring Detection

Flag repeated transactions just below the reporting threshold — a PATTERN rule:

{
  "code": "STRUCTURING_JUST_BELOW_10K",
  "name": "Potential structuring",
  "description": "3+ transactions just below $10,000 within 24 hours",
  "rule_type": "PATTERN",
  "category": "STRUCTURING",
  "severity": "HIGH",
  "parameters": {
    "pattern_type": "STRUCTURING",
    "just_below_amount": 10000,
    "count_threshold": 3,
    "time_window_minutes": 1440
  },
  "actions": { "create_alert": true, "alert_priority": "HIGH" }
}

High-Risk Jurisdiction

Flag outbound transactions to sanctioned countries — a GEOGRAPHIC rule (the country list lives in parameters, and conditions.directions scopes it to outbound):

{
  "code": "SANCTIONED_JURISDICTION_OUT",
  "name": "High-risk jurisdiction transfer",
  "rule_type": "GEOGRAPHIC",
  "category": "SANCTIONS",
  "severity": "CRITICAL",
  "parameters": {
    "sanctioned_countries": ["IR", "KP", "SY", "CU"]
  },
  "conditions": { "directions": ["OUTBOUND"] },
  "actions": { "create_alert": true, "alert_priority": "CRITICAL" }
}

Unusual Amount

Flag large transfers/withdrawals — a THRESHOLD rule scoped by transaction_types:

{
  "code": "UNUSUAL_LARGE_AMOUNT",
  "name": "Unusual transaction amount",
  "rule_type": "THRESHOLD",
  "category": "AML",
  "severity": "MEDIUM",
  "parameters": { "amount_threshold": 50000, "amount_operator": "GTE" },
  "conditions": { "transaction_types": ["TRANSFER", "WITHDRAWAL"] },
  "actions": { "create_alert": true, "alert_priority": "MEDIUM" }
}

Evaluate a Transaction​

Monitoring Rules​

List Rules​

Create a Rule​

Amount operators​

Conditions (scoping which transactions a rule applies to)​

Update a Rule​

Enable / disable a rule (no delete)​

Manage Alerts​

List Alerts​

Get Alert Details​

Dispose an Alert​

Common Rule Patterns​

Structuring Detection​

High-Risk Jurisdiction​

Unusual Amount​