cURL

curl --request POST --fail-with-body --max-time 30 \
  "${AMLOK_API_BASE_URL}/v1/monitors" \
  --header "Authorization: Bearer ${AMLOK_API_KEY}" \
  --header "Accept: application/json" \
  --header 'Idempotency-Key: idem_example_1001' \
  --header 'Content-Type: application/json' \
  --data '{
  "subject_id": "biz_example",
  "baseline_snapshot_id": "rsk_baseline",
  "resource_types": [
    "bank_transaction",
    "lien"
  ],
  "attribute_keys": [
    "operating_inflows"
  ],
  "cadence": "daily",
  "ruleset_version": "monitor-v1"
}'

import os
import requests

base_url = os.environ["AMLOK_API_BASE_URL"].rstrip("/")
headers = {'Accept': 'application/json',
 'Idempotency-Key': 'idem_example_1001',
 'Content-Type': 'application/json'}
headers["Authorization"] = "Bearer " + os.environ["AMLOK_API_KEY"]

response = requests.request(
    "POST", base_url + "/v1/monitors",
    headers=headers, timeout=30, allow_redirects=False,
    json={'subject_id': 'biz_example',
 'baseline_snapshot_id': 'rsk_baseline',
 'resource_types': ['bank_transaction', 'lien'],
 'attribute_keys': ['operating_inflows'],
 'cadence': 'daily',
 'ruleset_version': 'monitor-v1'},
)
response.raise_for_status()
print(response.json())

const baseUrl = process.env.AMLOK_API_BASE_URL;
const apiKey = process.env.AMLOK_API_KEY;
if (!baseUrl || !apiKey) throw new Error("Configure AMLOK_API_BASE_URL and AMLOK_API_KEY");
const headers = {
  "Accept": "application/json",
  "Idempotency-Key": "idem_example_1001",
  "Content-Type": "application/json"
};
headers.Authorization = `Bearer ${apiKey}`;
const response = await fetch(baseUrl.replace(/\/$/, "") + "/v1/monitors", {
  method: "POST", headers,
  redirect: "error", signal: AbortSignal.timeout(30000),
  body: JSON.stringify({
  "subject_id": "biz_example",
  "baseline_snapshot_id": "rsk_baseline",
  "resource_types": [
    "bank_transaction",
    "lien"
  ],
  "attribute_keys": [
    "operating_inflows"
  ],
  "cadence": "daily",
  "ruleset_version": "monitor-v1"
}),
});
if (!response.ok) throw new Error(`AMLOK returned HTTP ${response.status}`);
console.log(await response.json());

{
  "data": {
    "id": "mon_example",
    "object": "monitor",
    "subject_id": "biz_example",
    "created_at": "2026-10-23T14:00:00Z",
    "updated_at": "2026-10-23T14:00:00Z",
    "record_version": 1,
    "source_refs": [],
    "data_status": "partial",
    "missing_fields": [],
    "schema_version": "1.4.2",
    "client_reference": "app-1029",
    "baseline_snapshot_id": "rsk_baseline",
    "resource_types": [
      "bank_transaction",
      "lien"
    ],
    "attribute_keys": [
      "operating_inflows"
    ],
    "status": "active",
    "cadence": "daily",
    "ruleset_version": "monitor-v1",
    "last_evaluated_at": null,
    "next_evaluation_at": null,
    "blocked_reason": null,
    "monitoring_period_id": "monitoring_period_example"
  },
  "meta": {
    "request_id": "req_example",
    "schema_version": "1.4.2",
    "generated_at": "2026-10-23T14:00:00Z",
    "data_status": "partial"
  }
}

Risk

Create monitor

Configure ongoing monitoring against a baseline.

Required scope: monitoring:write. Refresh frequency remains subject to provider and consent limits. Once account cancellation is submitted, processing and usage deductions stop immediately. Reject new operational commands with 409 invalid_state; pending work is cancelled without another debit. Read-only reporting remains available until workspace deletion. Discover approved baselines through GET /v1/monitoring-baselines. Supply its snapshot_id as baseline_snapshot_id; it must be ready and belong to this subject and workspace. Multiple monitors do not create multiple Signal account-month charges. Signal charges the full agreed monthly rate once per borrower/business/workspace at 00:00 UTC on the first day of the month, before monitoring proceeds. First activation during a month charges the full monthly rate immediately, without proration; the next charge is at the next month boundary. Repeated monitor creation, pauses, resumes, checks and reassessments do not add charges in an already paid period. Insufficient credits block monitoring without a debit or debt; funding resumes only the current period after its single successful charge, without charging missed inactive months. User-paused monitoring remains paused until the user resumes it. Account cancellation stops processing and all further deductions immediately. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt.

POST

monitors

cURL

curl --request POST --fail-with-body --max-time 30 \
  "${AMLOK_API_BASE_URL}/v1/monitors" \
  --header "Authorization: Bearer ${AMLOK_API_KEY}" \
  --header "Accept: application/json" \
  --header 'Idempotency-Key: idem_example_1001' \
  --header 'Content-Type: application/json' \
  --data '{
  "subject_id": "biz_example",
  "baseline_snapshot_id": "rsk_baseline",
  "resource_types": [
    "bank_transaction",
    "lien"
  ],
  "attribute_keys": [
    "operating_inflows"
  ],
  "cadence": "daily",
  "ruleset_version": "monitor-v1"
}'

import os
import requests

base_url = os.environ["AMLOK_API_BASE_URL"].rstrip("/")
headers = {'Accept': 'application/json',
 'Idempotency-Key': 'idem_example_1001',
 'Content-Type': 'application/json'}
headers["Authorization"] = "Bearer " + os.environ["AMLOK_API_KEY"]

response = requests.request(
    "POST", base_url + "/v1/monitors",
    headers=headers, timeout=30, allow_redirects=False,
    json={'subject_id': 'biz_example',
 'baseline_snapshot_id': 'rsk_baseline',
 'resource_types': ['bank_transaction', 'lien'],
 'attribute_keys': ['operating_inflows'],
 'cadence': 'daily',
 'ruleset_version': 'monitor-v1'},
)
response.raise_for_status()
print(response.json())

const baseUrl = process.env.AMLOK_API_BASE_URL;
const apiKey = process.env.AMLOK_API_KEY;
if (!baseUrl || !apiKey) throw new Error("Configure AMLOK_API_BASE_URL and AMLOK_API_KEY");
const headers = {
  "Accept": "application/json",
  "Idempotency-Key": "idem_example_1001",
  "Content-Type": "application/json"
};
headers.Authorization = `Bearer ${apiKey}`;
const response = await fetch(baseUrl.replace(/\/$/, "") + "/v1/monitors", {
  method: "POST", headers,
  redirect: "error", signal: AbortSignal.timeout(30000),
  body: JSON.stringify({
  "subject_id": "biz_example",
  "baseline_snapshot_id": "rsk_baseline",
  "resource_types": [
    "bank_transaction",
    "lien"
  ],
  "attribute_keys": [
    "operating_inflows"
  ],
  "cadence": "daily",
  "ruleset_version": "monitor-v1"
}),
});
if (!response.ok) throw new Error(`AMLOK returned HTTP ${response.status}`);
console.log(await response.json());

{
  "data": {
    "id": "mon_example",
    "object": "monitor",
    "subject_id": "biz_example",
    "created_at": "2026-10-23T14:00:00Z",
    "updated_at": "2026-10-23T14:00:00Z",
    "record_version": 1,
    "source_refs": [],
    "data_status": "partial",
    "missing_fields": [],
    "schema_version": "1.4.2",
    "client_reference": "app-1029",
    "baseline_snapshot_id": "rsk_baseline",
    "resource_types": [
      "bank_transaction",
      "lien"
    ],
    "attribute_keys": [
      "operating_inflows"
    ],
    "status": "active",
    "cadence": "daily",
    "ruleset_version": "monitor-v1",
    "last_evaluated_at": null,
    "next_evaluation_at": null,
    "blocked_reason": null,
    "monitoring_period_id": "monitoring_period_example"
  },
  "meta": {
    "request_id": "req_example",
    "schema_version": "1.4.2",
    "generated_at": "2026-10-23T14:00:00Z",
    "data_status": "partial"
  }
}

Required scope: monitoring:write Configure ongoing monitoring against a baseline. Required scope: monitoring:write. Refresh frequency remains subject to provider and consent limits. Once account cancellation is submitted, processing and usage deductions stop immediately. Reject new operational commands with 409 invalid_state; pending work is cancelled without another debit. Read-only reporting remains available until workspace deletion. Discover approved baselines through GET /v1/monitoring-baselines. Supply its snapshot_id as baseline_snapshot_id; it must be ready and belong to this subject and workspace. Multiple monitors do not create multiple Signal account-month charges. Signal charges the full agreed monthly rate once per borrower/business/workspace at 00:00 UTC on the first day of the month, before monitoring proceeds. First activation during a month charges the full monthly rate immediately, without proration; the next charge is at the next month boundary. Repeated monitor creation, pauses, resumes, checks and reassessments do not add charges in an already paid period. Insufficient credits block monitoring without a debit or debt; funding resumes only the current period after its single successful charge, without charging missed inactive months. User-paused monitoring remains paused until the user resumes it. Account cancellation stops processing and all further deductions immediately. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt. Product scope · Processing lifecycle · Errors

Authorizations

Authorization

string

header

required

Server-to-server API key bound to exactly one workspace, institution tenant and environment. No caller-supplied workspace override is accepted. Do not use in public browser code.

Headers

X-Request-ID

string

Optional caller correlation ID; the response includes AMLOK request_id.

Idempotency-Key

string

required

Reuse for retries of the same intended command and identical payload. Retention: 24 hours.

Body

application/json

subject_id

string

required

Borrower to monitor.

Minimum string length: 1

baseline_snapshot_id

string

required

Original approved assessment.

Minimum string length: 1

resource_types

enum<string>[]

required

Requested source domains.

Minimum array length: 1

Available options:

connection,

consent,

sync_job,

business,

person,

relationship,

verification,

verification_check,

screening_match,

document,

bank_account,

account_balance,

bank_transaction,

recurring_stream,

income_observation,

merchant_account,

payment,

processor_transaction,

payout,

refund,

dispute,

counterparty,

order,

order_line,

subscription,

ledger_account,

journal,

journal_line,

invoice,

bill,

credit_note,

accounting_payment,

financial_statement,

statement_line,

tax_obligation,

product,

location,

inventory_balance,

inventory_movement,

purchase_order,

shipment,

production_order,

project,

application,

credit_facility,

loan,

installment,

repayment,

collateral,

guarantee,

covenant,

decision,

lien_search,

lien,

filing_event,

attribute,

risk_snapshot,

monitor,

alert,

workflow_run,

requirement,

audit_event,

reconciliation_link

attribute_keys

string[]

required

Metrics to track.

Minimum array length: 1

cadence

string

required

ID from GET /v1/configuration cadences. Invalid IDs return 422 validation_error. Source freshness is not guaranteed by this schedule.

Minimum string length: 1

ruleset_version

string

required

Approved ID from GET /v1/configuration rulesets; validate attributes and resource types against it.

Minimum string length: 1

Response

Configure ongoing monitoring against a baseline.

data

monitor · object

required

Configured monitoring scope, baseline and refresh policy. Population depends on source and tenant entitlement.

Show child attributes

Get started

Endpoints

Essentials

Create monitor

Authorizations

Headers

Body

Response