Retrieves Hawk-generated AML case statistics by internal case ID. Returns rule execution results, AML decisions, and screening data.
Internal Hawk case ID (returned in the original POST /v1/transaction-checks response)
Case found; all data sources returned successfully. The response contains the complete case payload.
Internal Hawk case ID
Correlation ID linking this case to the original request
Tenant identifier
Customer identifier associated with this transaction
Account identifier associated with this case
Timestamp when processing of the case completed (ISO 8601 UTC)
Current lifecycle status of the case. One of: OPEN, NOT_OPENED, AUTO_CLOSED
Current processing status of the case. One of: new, unsuspicious, relieved, unsubstantiated, opening, machine-review, operator-review, accepted, escalated, sar-filing, sar-filed, reopening, reopened
ID of the user the case is assigned to
Type of check that created this case (AMLChecks or CustomerChecks)
Source tags applied to this case
Category assigned to the tenant
Decision taken on this case
Case status at the time of decision. One of: OPEN, NOT_OPENED, AUTO_CLOSED
Transaction status resulting from the decision. One of: proceeded, blocked, unblocked, none
Processing status resulting from the decision. One of: new, unsuspicious, relieved, unsubstantiated
Type of decision taken. One of: complete, incomplete, immediate
Latest transaction status update
Updated transaction status. One of: proceeded, blocked, unblocked, none
Updated processing status. One of: new, unsuspicious, relieved, unsubstantiated
Decision type that triggered the update. One of: complete, incomplete, immediate
Operator answer associated with the status update
AML-specific case statistics
Transaction flow. One of: inbound, outbound
Total funds with currency, currency first (e.g. "EUR 1234.56")
Identifier provided by the tenant. Not unique — multiple POSTs with the same value create separate cases. Use caseId to identify a specific case.
Transaction status from AML perspective. One of: proceeded, blocked, unblocked, none
Investigation workflow status. One of: opening, unsuspicious, machine-review, relieved, new, initial-review, waiting-for-operator, operator-review, request-for-information, accepted, escalated, sar-filing, sar-filed, reopening, reopened
Transaction result code. One of: FRAUD_SUSPICION, CARD_STOLEN, CARD_LOST, INSUFFICIENT_FUNDS, SUSPICIOUS_MERCHANT_SETUP, INVALID_CVV, INVALID_AVS, USAGE_RESTRICTED, BLOCKED_CASH, IDENTITY_ISSUE, PIN_LIMIT_EXCEEDED, PICKUP_CARD_FRAUD, BLOCKED_ORIGINAL_CREDIT
Per-hit screening detail, one entry per screening hit on the case.
A single screening hit with enriched match detail (matched list record, score, list source, and SAN/SCO classification).
Reference to the matched list entry / record in the source list.
JSON path in the submitted transaction/customer payload where the matched value was found — tells you which field the hit is on (for example the counterparty, account-holder, or usage field). Look up the value in the payload you submitted.
Data provider the matched list entry originates from.
Match score for this hit on a 0-100 scale (higher means a closer match).
Screening areas the matched entity is listed under (e.g. SANCTIONS, PEP, ADVERSE_MEDIA, OTHER_WATCHLIST).
Names of the source lists the matched entity appears on.
Distinguishes SAN from SCO for sanctions hits: true when the match is a Sanctions Control & Ownership (SCO) record, false for a direct sanctions-list (SAN) record.
Name of the matched list entity (the watchlist record's primary name). Personal data.
Alternative names recorded for the matched entity (AKA / also-known-as and native-script names). The name that actually triggered the match may be an alias rather than the primary name. Personal data.
Countries associated with the matched entity (nationality, residence, or registration geography), as recorded by the data provider.
Dates of birth recorded for the matched entity. Sensitive personal data — see Data protection.
Identity documents / identifiers recorded for the matched entity (national ID, passport, company registration number, etc.). Sensitive personal data — see Data protection.
An identity document or identifier recorded for a matched screening entity.
Kind of identifier (for example national ID, passport, or company registration number).
The identifier value. Sensitive personal data.
Additional context on the identifier, such as the specific document type when type is generic (for example SIREN, NIT, or passport).
Narrative notes recorded on the matched entity by the data provider — the list classification notes plus the provider's free-text profile narrative (for example adverse-media summaries or sanctions-listing details). May be lengthy. Personal data.
Source references for the matched entity (data-provider source links).
A source reference for a matched screening entity.
The kind of source reference.
Link to the source record, when the reference is a URL.
Source citation text, when the reference is textual rather than a plain link.
Results of rule execution grouped by outcome
Rules that resulted in an OPEN decision
Name of the decision
Case status resulting from this rule
Transaction status resulting from this rule
Processing status resulting from this rule
Individual rule instance results
Unique identifier of the rule instance
Human-readable name of the rule instance
Whether this rule instance is blocking
Numeric score or value produced by the rule instance
Categories this rule instance belongs to
Rule-specific result details. Free-form; fields vary by rule (the parent decisionName identifies the rule). Aggregation rules additionally include relatedCaseIds — the case IDs of the other transactions that contributed to the rule firing; each can be re-read via GET /v1/transaction-checks/{caseId}. Rules that provide relatedCaseIds include Volume Risk, Frequency of Changes, Dormant Account Activation, Account-Based Frequency, Suspicious Average Ticket Size, Account-Based Volume Increase/Decrease, Counter Party Volume, and Unusual Counter Party Based Frequency. See the "Retrieve case results via the API" knowledge base article for the authoritative per-rule field reference.
Rule-specific configuration. Free-form; fields vary by rule (the parent decisionName identifies the rule).
Rules that did not result in an OPEN decision
Name of the decision
Case status resulting from this rule
Transaction status resulting from this rule
Processing status resulting from this rule
Individual rule instance results
Unique identifier of the rule instance
Human-readable name of the rule instance
Whether this rule instance is blocking
Numeric score or value produced by the rule instance
Categories this rule instance belongs to
Rule-specific result details. Free-form; fields vary by rule (the parent decisionName identifies the rule). Aggregation rules additionally include relatedCaseIds — the case IDs of the other transactions that contributed to the rule firing; each can be re-read via GET /v1/transaction-checks/{caseId}. Rules that provide relatedCaseIds include Volume Risk, Frequency of Changes, Dormant Account Activation, Account-Based Frequency, Suspicious Average Ticket Size, Account-Based Volume Increase/Decrease, Counter Party Volume, and Unusual Counter Party Based Frequency. See the "Retrieve case results via the API" knowledge base article for the authoritative per-rule field reference.
Rule-specific configuration. Free-form; fields vary by rule (the parent decisionName identifies the rule).
Rules that resulted in an AUTO_CLOSED decision
Name of the decision
Case status resulting from this rule
Transaction status resulting from this rule
Processing status resulting from this rule
Individual rule instance results
Unique identifier of the rule instance
Human-readable name of the rule instance
Whether this rule instance is blocking
Numeric score or value produced by the rule instance
Categories this rule instance belongs to
Rule-specific result details. Free-form; fields vary by rule (the parent decisionName identifies the rule). Aggregation rules additionally include relatedCaseIds — the case IDs of the other transactions that contributed to the rule firing; each can be re-read via GET /v1/transaction-checks/{caseId}. Rules that provide relatedCaseIds include Volume Risk, Frequency of Changes, Dormant Account Activation, Account-Based Frequency, Suspicious Average Ticket Size, Account-Based Volume Increase/Decrease, Counter Party Volume, and Unusual Counter Party Based Frequency. See the "Retrieve case results via the API" knowledge base article for the authoritative per-rule field reference.
Rule-specific configuration. Free-form; fields vary by rule (the parent decisionName identifies the rule).
Counterparty information for the transaction
Country of the counterparty bank (ISO 3166 alpha-2)
Case notes associated with this transaction case
A single case note
Unique identifier of the note
ID of the user who created the note
Tenant identifier
Associated case identifier
Content of the note
Timestamp when the note was created
Type of the note
Subtype of the note
ID of the item related to the subtype
Details of the user who created the case note
User identifier
Email address of the user
Full name of the user
URL or reference to the user's profile picture
List of attachments associated with this note
An attachment uploaded with a case note
Unique identifier of the attachment
Name of the attached file
Size of the file in bytes
Case found, but one or more data sources (for example screening) were temporarily unavailable, so some fields may be missing. Why: a downstream data source did not respond in time. Recover: retry with exponential backoff until you receive 200.
Internal Hawk case ID
Correlation ID linking this case to the original request
Tenant identifier
Customer identifier associated with this transaction
Account identifier associated with this case
Timestamp when processing of the case completed (ISO 8601 UTC)
Current lifecycle status of the case. One of: OPEN, NOT_OPENED, AUTO_CLOSED
Current processing status of the case. One of: new, unsuspicious, relieved, unsubstantiated, opening, machine-review, operator-review, accepted, escalated, sar-filing, sar-filed, reopening, reopened
ID of the user the case is assigned to
Type of check that created this case (AMLChecks or CustomerChecks)
Source tags applied to this case
Category assigned to the tenant
Decision taken on this case
Case status at the time of decision. One of: OPEN, NOT_OPENED, AUTO_CLOSED
Transaction status resulting from the decision. One of: proceeded, blocked, unblocked, none
Processing status resulting from the decision. One of: new, unsuspicious, relieved, unsubstantiated
Type of decision taken. One of: complete, incomplete, immediate
Latest transaction status update
Updated transaction status. One of: proceeded, blocked, unblocked, none
Updated processing status. One of: new, unsuspicious, relieved, unsubstantiated
Decision type that triggered the update. One of: complete, incomplete, immediate
Operator answer associated with the status update
AML-specific case statistics
Transaction flow. One of: inbound, outbound
Total funds with currency, currency first (e.g. "EUR 1234.56")
Identifier provided by the tenant. Not unique — multiple POSTs with the same value create separate cases. Use caseId to identify a specific case.
Transaction status from AML perspective. One of: proceeded, blocked, unblocked, none
Investigation workflow status. One of: opening, unsuspicious, machine-review, relieved, new, initial-review, waiting-for-operator, operator-review, request-for-information, accepted, escalated, sar-filing, sar-filed, reopening, reopened
Transaction result code. One of: FRAUD_SUSPICION, CARD_STOLEN, CARD_LOST, INSUFFICIENT_FUNDS, SUSPICIOUS_MERCHANT_SETUP, INVALID_CVV, INVALID_AVS, USAGE_RESTRICTED, BLOCKED_CASH, IDENTITY_ISSUE, PIN_LIMIT_EXCEEDED, PICKUP_CARD_FRAUD, BLOCKED_ORIGINAL_CREDIT
Per-hit screening detail, one entry per screening hit on the case.
A single screening hit with enriched match detail (matched list record, score, list source, and SAN/SCO classification).
Reference to the matched list entry / record in the source list.
JSON path in the submitted transaction/customer payload where the matched value was found — tells you which field the hit is on (for example the counterparty, account-holder, or usage field). Look up the value in the payload you submitted.
Data provider the matched list entry originates from.
Match score for this hit on a 0-100 scale (higher means a closer match).
Screening areas the matched entity is listed under (e.g. SANCTIONS, PEP, ADVERSE_MEDIA, OTHER_WATCHLIST).
Names of the source lists the matched entity appears on.
Distinguishes SAN from SCO for sanctions hits: true when the match is a Sanctions Control & Ownership (SCO) record, false for a direct sanctions-list (SAN) record.
Name of the matched list entity (the watchlist record's primary name). Personal data.
Alternative names recorded for the matched entity (AKA / also-known-as and native-script names). The name that actually triggered the match may be an alias rather than the primary name. Personal data.
Countries associated with the matched entity (nationality, residence, or registration geography), as recorded by the data provider.
Dates of birth recorded for the matched entity. Sensitive personal data — see Data protection.
Identity documents / identifiers recorded for the matched entity (national ID, passport, company registration number, etc.). Sensitive personal data — see Data protection.
An identity document or identifier recorded for a matched screening entity.
Kind of identifier (for example national ID, passport, or company registration number).
The identifier value. Sensitive personal data.
Additional context on the identifier, such as the specific document type when type is generic (for example SIREN, NIT, or passport).
Narrative notes recorded on the matched entity by the data provider — the list classification notes plus the provider's free-text profile narrative (for example adverse-media summaries or sanctions-listing details). May be lengthy. Personal data.
Source references for the matched entity (data-provider source links).
A source reference for a matched screening entity.
The kind of source reference.
Link to the source record, when the reference is a URL.
Source citation text, when the reference is textual rather than a plain link.
Results of rule execution grouped by outcome
Rules that resulted in an OPEN decision
Name of the decision
Case status resulting from this rule
Transaction status resulting from this rule
Processing status resulting from this rule
Individual rule instance results
Unique identifier of the rule instance
Human-readable name of the rule instance
Whether this rule instance is blocking
Numeric score or value produced by the rule instance
Categories this rule instance belongs to
Rule-specific result details. Free-form; fields vary by rule (the parent decisionName identifies the rule). Aggregation rules additionally include relatedCaseIds — the case IDs of the other transactions that contributed to the rule firing; each can be re-read via GET /v1/transaction-checks/{caseId}. Rules that provide relatedCaseIds include Volume Risk, Frequency of Changes, Dormant Account Activation, Account-Based Frequency, Suspicious Average Ticket Size, Account-Based Volume Increase/Decrease, Counter Party Volume, and Unusual Counter Party Based Frequency. See the "Retrieve case results via the API" knowledge base article for the authoritative per-rule field reference.
Rule-specific configuration. Free-form; fields vary by rule (the parent decisionName identifies the rule).
Rules that did not result in an OPEN decision
Name of the decision
Case status resulting from this rule
Transaction status resulting from this rule
Processing status resulting from this rule
Individual rule instance results
Unique identifier of the rule instance
Human-readable name of the rule instance
Whether this rule instance is blocking
Numeric score or value produced by the rule instance
Categories this rule instance belongs to
Rule-specific result details. Free-form; fields vary by rule (the parent decisionName identifies the rule). Aggregation rules additionally include relatedCaseIds — the case IDs of the other transactions that contributed to the rule firing; each can be re-read via GET /v1/transaction-checks/{caseId}. Rules that provide relatedCaseIds include Volume Risk, Frequency of Changes, Dormant Account Activation, Account-Based Frequency, Suspicious Average Ticket Size, Account-Based Volume Increase/Decrease, Counter Party Volume, and Unusual Counter Party Based Frequency. See the "Retrieve case results via the API" knowledge base article for the authoritative per-rule field reference.
Rule-specific configuration. Free-form; fields vary by rule (the parent decisionName identifies the rule).
Rules that resulted in an AUTO_CLOSED decision
Name of the decision
Case status resulting from this rule
Transaction status resulting from this rule
Processing status resulting from this rule
Individual rule instance results
Unique identifier of the rule instance
Human-readable name of the rule instance
Whether this rule instance is blocking
Numeric score or value produced by the rule instance
Categories this rule instance belongs to
Rule-specific result details. Free-form; fields vary by rule (the parent decisionName identifies the rule). Aggregation rules additionally include relatedCaseIds — the case IDs of the other transactions that contributed to the rule firing; each can be re-read via GET /v1/transaction-checks/{caseId}. Rules that provide relatedCaseIds include Volume Risk, Frequency of Changes, Dormant Account Activation, Account-Based Frequency, Suspicious Average Ticket Size, Account-Based Volume Increase/Decrease, Counter Party Volume, and Unusual Counter Party Based Frequency. See the "Retrieve case results via the API" knowledge base article for the authoritative per-rule field reference.
Rule-specific configuration. Free-form; fields vary by rule (the parent decisionName identifies the rule).
Counterparty information for the transaction
Country of the counterparty bank (ISO 3166 alpha-2)
Case notes associated with this transaction case
A single case note
Unique identifier of the note
ID of the user who created the note
Tenant identifier
Associated case identifier
Content of the note
Timestamp when the note was created
Type of the note
Subtype of the note
ID of the item related to the subtype
Details of the user who created the case note
User identifier
Email address of the user
Full name of the user
URL or reference to the user's profile picture
List of attachments associated with this note
An attachment uploaded with a case note
Unique identifier of the attachment
Name of the attached file
Size of the file in bytes
Missing or invalid API key. Why: the api-key header was absent or not valid for this tenant. Recover: send a valid tenant API key in the api-key header.
{
"errors": [
"Missing or invalid API key"
]
}List of error messages
No transaction case exists for the given caseId. Why: the ID is unknown or belongs to a customer case. Recover: verify the caseId from the original submission response and that you are calling the transaction endpoint.
{
"errors": [
"Transaction case not found"
]
}List of error messages
Rate limit exceeded. Why: requests exceeded the per-second limit agreed for your tenant (shared with POST/PATCH /v1/transaction-checks). Recover: pause and retry with exponential backoff — for example 1s, 2s, 4s with jitter — and keep overall throughput under the limit.
{
"errors": [
"Rate limit exceeded"
]
}List of error messages
The case was found but could not be assembled for the response. Why: a transient internal error. Recover: retry with backoff; if it persists, contact Hawk.
{
"errors": [
"Failed to detokenize transaction case"
]
}List of error messages