> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amlok.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Retrieve collected and enriched borrower data

> Retrieve collected and enriched borrower data using the AMLOK institution API.

The Data API exposes authorized bank, payment, accounting and other integration records before and after underwriting. It includes the typed normalized representation, enrichment fields, field provenance, missing-value reasons, provider extensions, permitted source payloads and document references. AMLOK handles processing; you do not invoke its internal stages.

## Three read operations

| Operation | Purpose |
| - | - |
| [GET /v1/data/records](https://docs.amlok.io/api-reference/endpoints/data/list-data-records.md) | Page through all currently authorized records for a borrower at one consistent snapshot |
| [`GET /v1/data/records/{id}`](https://docs.amlok.io/api-reference/endpoints/data/get-data-record) | Retrieve an exact immutable record version |
| [GET /v1/data/changes](https://docs.amlok.io/api-reference/endpoints/data/list-data-changes.md) | Keep a downstream copy up to date without repeatedly downloading the full history |

The Data API requires data:read. It is independent of Insights and Signal execution. The underlying integration, borrower consent, purpose and provider entitlement must still authorize access. An empty result means no matching authorized records at that snapshot; inspect connection readiness and coverage before concluding there was no activity.

## Bootstrap without missing changes

```bash theme={null}
curl --request GET --fail-with-body --max-time 30 \
  "${AMLOK_API_BASE_URL}/v1/data/records?borrower_id=bor_synthetic" \
  --header "Authorization: Bearer ${AMLOK_API_KEY}" \
  --header 'Accept: application/json'
```

1. Supply borrower\_id. Optionally filter by connection\_id, integration\_id or resource\_type, such as bank\_transaction, bank\_account or invoice.
2. Persist page.snapshot\_id, page.as\_of and page.changes\_cursor from the first page. The server captures the snapshot and its change-feed boundary atomically.
3. Fetch every page using next\_cursor with the same borrower and filters. The snapshot freezes membership and record versions; current authorization is rechecked on each read.
4. After committing the complete snapshot, call the changes endpoint with the saved changes\_cursor. It already binds borrower, filters and authorization.
5. Apply each batch idempotently using change ID and logical resource version. Follow next\_cursor while has\_more is true; after the final committed batch persist resume\_cursor, including on empty results.

Changes cover upsert, removed and access\_changed. An upsert points to the exact DataRecord version to retrieve. Removed or newly restricted content may expose permitted metadata only. Do not mistake a provider deletion or access withdrawal for zero activity, and handle local retained copies according to the applicable authorization/retention policy.

A stale or mismatched cursor fails explicitly. On 410, deliberately reconcile a new full snapshot; never silently skip the missing interval. Pagination never truncates the dataset. The data.updated notification identifies a connection with new committed data; use your cursor to collect the changes. Webhooks are a wake-up signal, not the record transport.

## Understand each record

* id identifies an immutable DataRecord version; resource\_id identifies the logical normalized record, whose record\_version increases on change.
* resource\_type selects one of the existing typed normalized schemas. normalized.object, normalized.id and normalized.record\_version match the envelope; the server rejects inconsistent representations.
* normalized includes all authorized populated fields. Financial enrichment can appear in those typed fields, while broader assessment dimensions and policy results are returned in the risk package.
* field\_provenance, source\_refs, missing\_fields and namespaced extensions retain source attribution and provider details. Do not invent unavailable values.
* source\_payload contains authorized provider-native business fields when retained and permitted. not\_retained, restricted and not\_applicable use a null value and an explicit reason. Credentials, secrets and unrelated borrower data are never part of the public data.
* document\_ids link original files and reports. Discover and download them with the [document API](https://docs.amlok.io/api-reference/documents.md).

“All available data” means the complete authorized representation, including data not selected as evidence for a particular assessment. It does not override provider licensing or promise fields the provider did not supply. Restricted data is explicitly identified rather than silently represented as an empty successful result.

## Assessments and exports

The [risk package](https://docs.amlok.io/api-reference/risk-package.md) contains assessment-level enrichments, financial dimensions, policy results and limitations. [Evidence](https://docs.amlok.io/api-reference/evidence-traceability.md) freezes the exact inputs used for a particular result. EvidenceSummary.data\_record\_id connects that assessment input to its exact DataRecord version when applicable. A newer collected record never changes an older risk package.

For a bulk download, create an export with kind data, data\_snapshot\_id from the list response, and format json or csv. The snapshot preserves the selected borrower and filters. Expired snapshots return 410; do not substitute a newer snapshot without the caller requesting it. Export access requires data:read and source authorization at creation, retrieval and download in addition to export scope.

Data Lookup imports these same schemas. Choose Amlok API to explore the full contract, or a provider to view its applicable data/evidence schemas and the documented upstream field mappings.

## Verification assessments

Use `resource_type=verification_assessment` to retrieve authorized KYC/KYB results. The typed object at `normalized.assessment` is the same [verification structure](https://docs.amlok.io/api-reference/verification.md) used in risk packages. Related parties, coverage and reports retain their exact source versions. This derived resource can have null connection and integration IDs because it combines multiple sources.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.