Retrieves Hawk-generated customer case statistics by internal case ID. Returns customer risk rating, flagging results, and screening data.
Internal Hawk case ID
Case found; all data sources returned successfully. The response contains the complete case payload.
Internal Hawk case ID
Correlation ID linking this case to the original request
Tenant identifier
Customer identifier associated with this case
Account identifier associated with this case
Timestamp when processing of the case completed (ISO 8601 UTC)
Current lifecycle status of the case. One of: OPEN, NOT_OPENED, AUTO_CLOSED
Current processing status of the case. One of: new, unsuspicious, relieved, unsubstantiated, opening, machine-review, operator-review, accepted, escalated, sar-filing, sar-filed, reopening, reopened
ID of the user the case is assigned to
Type of check that created this case (AMLChecks or CustomerChecks)
Source tags applied to this case
Category assigned to the tenant
Customer Risk Rating statistics
Email addresses of the customer
Name of the customer
Customer status. One of: proceeded, blocked
Type of customer
Risk level assigned to the customer
Total risk points scored
Risk factors identified
Flagging results from risk assessment
Countries that matched this flag
Flag identifier
Per-hit screening detail, one entry per screening hit on the case.
A single screening hit with enriched match detail (matched list record, score, list source, and SAN/SCO classification).
Reference to the matched list entry / record in the source list.
JSON path in the submitted transaction/customer payload where the matched value was found — tells you which field the hit is on (for example the counterparty, account-holder, or usage field). Look up the value in the payload you submitted.
Data provider the matched list entry originates from.
Match score for this hit on a 0-100 scale (higher means a closer match).
Screening areas the matched entity is listed under (e.g. SANCTIONS, PEP, ADVERSE_MEDIA, OTHER_WATCHLIST).
Names of the source lists the matched entity appears on.
Distinguishes SAN from SCO for sanctions hits: true when the match is a Sanctions Control & Ownership (SCO) record, false for a direct sanctions-list (SAN) record.
Name of the matched list entity (the watchlist record's primary name). Personal data.
Alternative names recorded for the matched entity (AKA / also-known-as and native-script names). The name that actually triggered the match may be an alias rather than the primary name. Personal data.
Countries associated with the matched entity (nationality, residence, or registration geography), as recorded by the data provider.
Dates of birth recorded for the matched entity. Sensitive personal data — see Data protection.
Identity documents / identifiers recorded for the matched entity (national ID, passport, company registration number, etc.). Sensitive personal data — see Data protection.
An identity document or identifier recorded for a matched screening entity.
Kind of identifier (for example national ID, passport, or company registration number).
The identifier value. Sensitive personal data.
Additional context on the identifier, such as the specific document type when type is generic (for example SIREN, NIT, or passport).
Narrative notes recorded on the matched entity by the data provider — the list classification notes plus the provider's free-text profile narrative (for example adverse-media summaries or sanctions-listing details). May be lengthy. Personal data.
Source references for the matched entity (data-provider source links).
A source reference for a matched screening entity.
The kind of source reference.
Link to the source record, when the reference is a URL.
Source citation text, when the reference is textual rather than a plain link.
Case notes associated with this customer case
A single case note
Unique identifier of the note
ID of the user who created the note
Tenant identifier
Associated case identifier
Content of the note
Timestamp when the note was created
Type of the note
Subtype of the note
ID of the item related to the subtype
Details of the user who created the case note
User identifier
Email address of the user
Full name of the user
URL or reference to the user's profile picture
List of attachments associated with this note
An attachment uploaded with a case note
Unique identifier of the attachment
Name of the attached file
Size of the file in bytes
Case found, but one or more data sources (for example screening) were temporarily unavailable, so some fields may be missing. Why: a downstream data source did not respond in time. Recover: retry with exponential backoff until you receive 200.
Internal Hawk case ID
Correlation ID linking this case to the original request
Tenant identifier
Customer identifier associated with this case
Account identifier associated with this case
Timestamp when processing of the case completed (ISO 8601 UTC)
Current lifecycle status of the case. One of: OPEN, NOT_OPENED, AUTO_CLOSED
Current processing status of the case. One of: new, unsuspicious, relieved, unsubstantiated, opening, machine-review, operator-review, accepted, escalated, sar-filing, sar-filed, reopening, reopened
ID of the user the case is assigned to
Type of check that created this case (AMLChecks or CustomerChecks)
Source tags applied to this case
Category assigned to the tenant
Customer Risk Rating statistics
Email addresses of the customer
Name of the customer
Customer status. One of: proceeded, blocked
Type of customer
Risk level assigned to the customer
Total risk points scored
Risk factors identified
Flagging results from risk assessment
Countries that matched this flag
Flag identifier
Per-hit screening detail, one entry per screening hit on the case.
A single screening hit with enriched match detail (matched list record, score, list source, and SAN/SCO classification).
Reference to the matched list entry / record in the source list.
JSON path in the submitted transaction/customer payload where the matched value was found — tells you which field the hit is on (for example the counterparty, account-holder, or usage field). Look up the value in the payload you submitted.
Data provider the matched list entry originates from.
Match score for this hit on a 0-100 scale (higher means a closer match).
Screening areas the matched entity is listed under (e.g. SANCTIONS, PEP, ADVERSE_MEDIA, OTHER_WATCHLIST).
Names of the source lists the matched entity appears on.
Distinguishes SAN from SCO for sanctions hits: true when the match is a Sanctions Control & Ownership (SCO) record, false for a direct sanctions-list (SAN) record.
Name of the matched list entity (the watchlist record's primary name). Personal data.
Alternative names recorded for the matched entity (AKA / also-known-as and native-script names). The name that actually triggered the match may be an alias rather than the primary name. Personal data.
Countries associated with the matched entity (nationality, residence, or registration geography), as recorded by the data provider.
Dates of birth recorded for the matched entity. Sensitive personal data — see Data protection.
Identity documents / identifiers recorded for the matched entity (national ID, passport, company registration number, etc.). Sensitive personal data — see Data protection.
An identity document or identifier recorded for a matched screening entity.
Kind of identifier (for example national ID, passport, or company registration number).
The identifier value. Sensitive personal data.
Additional context on the identifier, such as the specific document type when type is generic (for example SIREN, NIT, or passport).
Narrative notes recorded on the matched entity by the data provider — the list classification notes plus the provider's free-text profile narrative (for example adverse-media summaries or sanctions-listing details). May be lengthy. Personal data.
Source references for the matched entity (data-provider source links).
A source reference for a matched screening entity.
The kind of source reference.
Link to the source record, when the reference is a URL.
Source citation text, when the reference is textual rather than a plain link.
Case notes associated with this customer case
A single case note
Unique identifier of the note
ID of the user who created the note
Tenant identifier
Associated case identifier
Content of the note
Timestamp when the note was created
Type of the note
Subtype of the note
ID of the item related to the subtype
Details of the user who created the case note
User identifier
Email address of the user
Full name of the user
URL or reference to the user's profile picture
List of attachments associated with this note
An attachment uploaded with a case note
Unique identifier of the attachment
Name of the attached file
Size of the file in bytes
Missing or invalid API key. Why: the api-key header was absent or not valid for this tenant. Recover: send a valid tenant API key in the api-key header.
{
"errors": [
"Missing or invalid API key"
]
}List of error messages
No customer case exists for the given caseId. Why: the ID is unknown or belongs to a transaction case. Recover: verify the caseId from the original submission response and that you are calling the customer endpoint.
{
"errors": [
"Customer case not found"
]
}List of error messages
Rate limit exceeded. Why: requests exceeded the per-second limit agreed for your tenant (shared with POST/PATCH /v2/customer-checks). Recover: pause and retry with exponential backoff — for example 1s, 2s, 4s with jitter — and keep overall throughput under the limit.
{
"errors": [
"Rate limit exceeded"
]
}List of error messages
The case was found but could not be assembled for the response. Why: a transient internal error. Recover: retry with backoff; if it persists, contact Hawk.
{
"errors": [
"Failed to detokenize customer case"
]
}List of error messages