Purple Risk & Compliance API Documentation
Machine-readable OpenAPI 3.0 specification: https://marketplace.moveworks.com/api/purple-suite/risk-compliance/openapi.json
The consolidated all-apps document at https://marketplace.moveworks.com/api/purple-suite/openapi.json can be narrowed to this app with ?apps=risk-compliance, or combined with other apps comma-separated (e.g. ?apps=risk-compliance,itsm).
Overview
BFSI risk & compliance source system: KYC/CDD profiles & remediation, fraud alerts & investigation cases, AML watchlist, and policy/SOP knowledge. Customer-linked records share the retail-banking `customer_id` (CUST-####). Records carry a `country` (IN | AU | US); narrow any list with the `country` filter.
---
**Acting as a user (`X-PS-Impersonate-User`).** Every endpoint accepts an optional `X-PS-Impersonate-User` request header whose value is the email of the instance user to act as. The effective user resolves in this order: the header if present, else the instance's configured default MCP user, else none. User-scoped paths additionally accept the literal `me` in place of an email, and Graph-style apps also serve `/me/…` twins of their `/users/{email}/…` paths that resolve the same way. This header is honored by all operations but is intentionally omitted from each operation's parameter list so it is not surfaced as a per-tool argument by MCP clients; see the `ImpersonateUser` entry under `components.parameters`.
Endpoints
GET /api/purple-suite/risk-compliance/customers/{id}/risk-summary
Get customer risk summary
One-call risk briefing on a single customer: their KYC profile, open remediation cases, fraud alerts, fraud cases and AML watchlist hits. Prefer this over several separate list calls when the question is whether one named customer is risky. The id is the shared retail-banking customer id (CUST-####).
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Responses
200- Aggregated risk summary
application/jsoncustomer_idstringkyc_profileobjectKycProfileidstringcustomer_idstringcountrystringstatusstringrisk_levelstringlast_reviewed_atstringnext_review_duestringpep_flagbooleandocumentsarrayarray of:
doc_typestringstatusstringexpires_atstring
outstanding_itemsarrayarray of:
string
createdAtstringupdatedAtstring
open_remediationarrayarray of:
RemediationCaseidstringcustomer_idstringkyc_profile_idstringcountrystringreasonstringstatusstringassigned_tostringdue_datestringactionsarrayarray of:
actionstringownerstringduestringdonebooleancreated_atstring
status_historyarrayarray of:
statusstringnotestringrecorded_atstring
createdAtstringupdatedAtstring
fraud_alertsarrayarray of:
FraudAlertidstringcustomer_idstringcountrystringindicatorstringseveritystringstatusstringscoreintegerflagged_activitystringcase_idstringdetected_atstringcreatedAtstringupdatedAtstring
fraud_casesarrayarray of:
FraudCaseidstringcustomer_idstringcountrystringalert_idsarrayarray of:
string
statusstringdispositionstringrisk_indicatorsarrayarray of:
string
assigned_investigatorstringcase_notesarrayarray of:
notestringrecorded_atstring
status_historyarrayarray of:
statusstringnotestringrecorded_atstring
createdAtstringupdatedAtstring
watchlist_hitsarrayarray of:
WatchlistEntryidstringcustomer_idstringcountrystringnamestringlist_typestringmatch_strengthintegercreatedAtstringupdatedAtstring
GET /api/purple-suite/risk-compliance/kyc_profiles
List KYC profiles
KYC/CDD profiles are the per-customer compliance record in Purple Risk & Compliance: verification status (verified | pending | expired | in_remediation), risk level, PEP flag, document checklist, outstanding items and next review date. They key off the retail-banking customer_id (CUST-####); the customer's own profile lives in Purple Retail Banking. Narrow results server-side with this endpoint's named filter params (country, customer_id, status, …) or with OData $filter, $orderby, $select, $search, $top, $skip and $count (MCP clients send those as _filter, _orderby, …) instead of paging through everything.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
limit | query | integer | no | Max items per page (default 50) |
cursor | query | string | no | Pass the previous response's nextCursor to fetch the next page |
$filter | query | string | no | OData filter expression. Comparison operators: eq, ne, gt, ge, lt, le. Logical: and, or, not, with parentheses for grouping. String functions: contains(field,'x'), startswith(field,'x'), endswith(field,'x'). Membership: field in ('a','b'). Case-insensitive matching via tolower(field) / toupper(field). Nested fields use a slash, e.g. pto_balance/vacation_days. String literals use single quotes; dates are ISO-8601. Examples: "status eq 'active'"; "salary gt 50000 and department eq 'Engineering'"; "contains(tolower(name),'acme')"; "closeDate gt 2026-01-01". |
$select | query | string | no | Comma-separated list of fields to return, e.g. "id,firstName,email". Nested fields via slash ("pto_balance/vacation_days"). The id field is always included. |
$orderby | query | string | no | Sort clause(s), comma-separated, each "field [asc|desc]" (asc is the default). Example: "createdAt desc, lastName asc". Null values sort last. |
$search | query | string | no | Free-text, case-insensitive substring match across the resource's searchable fields. |
$top | query | integer | no | Maximum number of items to return (page size). |
$skip | query | integer | no | Number of matching items to skip before returning results (offset paging). Combine with $top. |
$count | query | boolean | no | When true, include @odata.count (total matches after $filter/$search, before paging) in the response. |
country | query | string | no | Filter to a single country (IN | AU | US) |
customer_id | query | string | no | Filter by customer id |
status | query | string | no | Filter by KYC status |
risk_level | query | string | no | Filter by risk level |
Responses
200- Paginated list
application/jsondataarrayarray of:
KycProfileidstringcustomer_idstringcountrystringstatusstringrisk_levelstringlast_reviewed_atstringnext_review_duestringpep_flagbooleandocumentsarrayarray of:
doc_typestringstatusstringexpires_atstring
outstanding_itemsarrayarray of:
string
createdAtstringupdatedAtstring
nextCursorstringtotalinteger
POST /api/purple-suite/risk-compliance/kyc_profiles
Create KYC profile
Open a KYC/CDD profile for a customer who does not have one, with initial status, risk level and document checklist.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes |
Request body
application/json — required
KycProfile
idstringcustomer_idstringcountrystringstatusstringrisk_levelstringlast_reviewed_atstringnext_review_duestringpep_flagbooleandocumentsarrayarray of:
doc_typestringstatusstringexpires_atstring
outstanding_itemsarrayarray of:
string
createdAtstringupdatedAtstring
Responses
201- Created
application/jsonKycProfileidstringcustomer_idstringcountrystringstatusstringrisk_levelstringlast_reviewed_atstringnext_review_duestringpep_flagbooleandocumentsarrayarray of:
doc_typestringstatusstringexpires_atstring
outstanding_itemsarrayarray of:
string
createdAtstringupdatedAtstring
GET /api/purple-suite/risk-compliance/kyc_profiles/{id}
Get KYC profile
Fetch one KYC profile by id with its status, risk level, PEP flag, documents, outstanding items and next review date — the check before onboarding, uplifting or remediating a customer.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Responses
200- Found
application/jsonKycProfileidstringcustomer_idstringcountrystringstatusstringrisk_levelstringlast_reviewed_atstringnext_review_duestringpep_flagbooleandocumentsarrayarray of:
doc_typestringstatusstringexpires_atstring
outstanding_itemsarrayarray of:
string
createdAtstringupdatedAtstring
404- Not found
DELETE /api/purple-suite/risk-compliance/kyc_profiles/{id}
Delete KYC profile
Permanently delete a KYC profile. Destructive and irreversible, and it erases regulated CDD evidence — only correct for records created in error.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Responses
200- Deleted
application/jsonsuccessbooleanidstring
404- Not found
PATCH /api/purple-suite/risk-compliance/kyc_profiles/{id}
Update KYC profile
Partially update a KYC profile — record a verified document, change risk level or PEP flag, or reschedule the next review. To drive the remediation workflow itself, use the remediation-case tools.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Request body
Fields to update (partial)
application/json
KycProfile
idstringcustomer_idstringcountrystringstatusstringrisk_levelstringlast_reviewed_atstringnext_review_duestringpep_flagbooleandocumentsarrayarray of:
doc_typestringstatusstringexpires_atstring
outstanding_itemsarrayarray of:
string
createdAtstringupdatedAtstring
Responses
200- Updated
application/jsonKycProfileidstringcustomer_idstringcountrystringstatusstringrisk_levelstringlast_reviewed_atstringnext_review_duestringpep_flagbooleandocumentsarrayarray of:
doc_typestringstatusstringexpires_atstring
outstanding_itemsarrayarray of:
string
createdAtstringupdatedAtstring
404- Not found
GET /api/purple-suite/risk-compliance/remediation_cases
List KYC remediation cases
Remediation cases are the compliance workflow to fix a customer's KYC gap — expired document, NRI re-KYC, sanctions hit or address mismatch — with status open | in_progress | pending_customer | completed | closed, owner, due date and follow-up actions. Compliance remediation, not IT tickets and not fraud investigations. Narrow results server-side with this endpoint's named filter params (country, customer_id, status, …) or with OData $filter, $orderby, $select, $search, $top, $skip and $count (MCP clients send those as _filter, _orderby, …) instead of paging through everything.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
limit | query | integer | no | Max items per page (default 50) |
cursor | query | string | no | Pass the previous response's nextCursor to fetch the next page |
$filter | query | string | no | OData filter expression. Comparison operators: eq, ne, gt, ge, lt, le. Logical: and, or, not, with parentheses for grouping. String functions: contains(field,'x'), startswith(field,'x'), endswith(field,'x'). Membership: field in ('a','b'). Case-insensitive matching via tolower(field) / toupper(field). Nested fields use a slash, e.g. pto_balance/vacation_days. String literals use single quotes; dates are ISO-8601. Examples: "status eq 'active'"; "salary gt 50000 and department eq 'Engineering'"; "contains(tolower(name),'acme')"; "closeDate gt 2026-01-01". |
$select | query | string | no | Comma-separated list of fields to return, e.g. "id,firstName,email". Nested fields via slash ("pto_balance/vacation_days"). The id field is always included. |
$orderby | query | string | no | Sort clause(s), comma-separated, each "field [asc|desc]" (asc is the default). Example: "createdAt desc, lastName asc". Null values sort last. |
$search | query | string | no | Free-text, case-insensitive substring match across the resource's searchable fields. |
$top | query | integer | no | Maximum number of items to return (page size). |
$skip | query | integer | no | Number of matching items to skip before returning results (offset paging). Combine with $top. |
$count | query | boolean | no | When true, include @odata.count (total matches after $filter/$search, before paging) in the response. |
country | query | string | no | Filter to a single country (IN | AU | US) |
customer_id | query | string | no | Filter by customer id |
status | query | string | no | Filter by status |
reason | query | string | no | Filter by reason |
Responses
200- Paginated list
application/jsondataarrayarray of:
RemediationCaseidstringcustomer_idstringkyc_profile_idstringcountrystringreasonstringstatusstringassigned_tostringdue_datestringactionsarrayarray of:
actionstringownerstringduestringdonebooleancreated_atstring
status_historyarrayarray of:
statusstringnotestringrecorded_atstring
createdAtstringupdatedAtstring
nextCursorstringtotalinteger
POST /api/purple-suite/risk-compliance/remediation_cases
Open remediation case
Open a KYC remediation case against a customer for a specific reason (e.g. expired_doc, re_kyc_nri). Check for an existing open case first — duplicates chase the customer twice.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes |
Request body
application/json — required
RemediationCase
idstringcustomer_idstringkyc_profile_idstringcountrystringreasonstringstatusstringassigned_tostringdue_datestringactionsarrayarray of:
actionstringownerstringduestringdonebooleancreated_atstring
status_historyarrayarray of:
statusstringnotestringrecorded_atstring
createdAtstringupdatedAtstring
Responses
201- Created
application/jsonRemediationCaseidstringcustomer_idstringkyc_profile_idstringcountrystringreasonstringstatusstringassigned_tostringdue_datestringactionsarrayarray of:
actionstringownerstringduestringdonebooleancreated_atstring
status_historyarrayarray of:
statusstringnotestringrecorded_atstring
createdAtstringupdatedAtstring
GET /api/purple-suite/risk-compliance/remediation_cases/{id}
Get remediation case
Fetch one remediation case by id with its reason, status, owner, due date and the follow-up actions already logged.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Responses
200- Found
application/jsonRemediationCaseidstringcustomer_idstringkyc_profile_idstringcountrystringreasonstringstatusstringassigned_tostringdue_datestringactionsarrayarray of:
actionstringownerstringduestringdonebooleancreated_atstring
status_historyarrayarray of:
statusstringnotestringrecorded_atstring
createdAtstringupdatedAtstring
404- Not found
DELETE /api/purple-suite/risk-compliance/remediation_cases/{id}
Delete remediation case
Permanently delete a remediation case. Destructive and irreversible, and it loses the regulated remediation trail — transition it to completed or closed instead.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Responses
200- Deleted
application/jsonsuccessbooleanidstring
404- Not found
PATCH /api/purple-suite/risk-compliance/remediation_cases/{id}
Update remediation case
Partially update remediation case details such as owner, due date or notes. Use the transition tool for status changes and the actions tool to log an outreach step — both enforce their own rules.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Request body
Fields to update (partial)
application/json
RemediationCase
idstringcustomer_idstringkyc_profile_idstringcountrystringreasonstringstatusstringassigned_tostringdue_datestringactionsarrayarray of:
actionstringownerstringduestringdonebooleancreated_atstring
status_historyarrayarray of:
statusstringnotestringrecorded_atstring
createdAtstringupdatedAtstring
Responses
200- Updated
application/jsonRemediationCaseidstringcustomer_idstringkyc_profile_idstringcountrystringreasonstringstatusstringassigned_tostringdue_datestringactionsarrayarray of:
actionstringownerstringduestringdonebooleancreated_atstring
status_historyarrayarray of:
statusstringnotestringrecorded_atstring
createdAtstringupdatedAtstring
404- Not found
POST /api/purple-suite/risk-compliance/remediation_cases/{id}/transition
Transition a remediation case
Move a KYC remediation case through open → in_progress → pending_customer → completed | closed, recording the reason. Use this rather than patching status: completed and closed are terminal and cannot be transitioned again.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Request body
application/json — required
statusstring requiredreasonstring
Responses
200- Updated
application/jsonRemediationCaseidstringcustomer_idstringkyc_profile_idstringcountrystringreasonstringstatusstringassigned_tostringdue_datestringactionsarrayarray of:
actionstringownerstringduestringdonebooleancreated_atstring
status_historyarrayarray of:
statusstringnotestringrecorded_atstring
createdAtstringupdatedAtstring
400- Invalid status
404- Not found
422- Invalid state transition
POST /api/purple-suite/risk-compliance/remediation_cases/{id}/actions
Log remediation follow-up action
Append an outreach or follow-up step to a KYC remediation case (e.g. 'Send re-KYC SMS with document upload link'), with an owner and due date. Records what will be done next; it does not change the case status.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Request body
application/json — required
actionstring requiredownerstringduestring
Responses
200- Updated
application/jsonRemediationCaseidstringcustomer_idstringkyc_profile_idstringcountrystringreasonstringstatusstringassigned_tostringdue_datestringactionsarrayarray of:
actionstringownerstringduestringdonebooleancreated_atstring
status_historyarrayarray of:
statusstringnotestringrecorded_atstring
createdAtstringupdatedAtstring
400- Invalid body
404- Not found
GET /api/purple-suite/risk-compliance/fraud_alerts
List fraud alerts
Fraud alerts are machine-generated signals on customer activity (velocity, geo_anomaly, unauthorized_upi, sim_swap, mule_pattern) with severity, score and status new | triaged | dismissed | escalated. They are the raw detections; a confirmed investigation is a fraud case. Narrow results server-side with this endpoint's named filter params (country, customer_id, status, …) or with OData $filter, $orderby, $select, $search, $top, $skip and $count (MCP clients send those as _filter, _orderby, …) instead of paging through everything.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
limit | query | integer | no | Max items per page (default 50) |
cursor | query | string | no | Pass the previous response's nextCursor to fetch the next page |
$filter | query | string | no | OData filter expression. Comparison operators: eq, ne, gt, ge, lt, le. Logical: and, or, not, with parentheses for grouping. String functions: contains(field,'x'), startswith(field,'x'), endswith(field,'x'). Membership: field in ('a','b'). Case-insensitive matching via tolower(field) / toupper(field). Nested fields use a slash, e.g. pto_balance/vacation_days. String literals use single quotes; dates are ISO-8601. Examples: "status eq 'active'"; "salary gt 50000 and department eq 'Engineering'"; "contains(tolower(name),'acme')"; "closeDate gt 2026-01-01". |
$select | query | string | no | Comma-separated list of fields to return, e.g. "id,firstName,email". Nested fields via slash ("pto_balance/vacation_days"). The id field is always included. |
$orderby | query | string | no | Sort clause(s), comma-separated, each "field [asc|desc]" (asc is the default). Example: "createdAt desc, lastName asc". Null values sort last. |
$search | query | string | no | Free-text, case-insensitive substring match across the resource's searchable fields. |
$top | query | integer | no | Maximum number of items to return (page size). |
$skip | query | integer | no | Number of matching items to skip before returning results (offset paging). Combine with $top. |
$count | query | boolean | no | When true, include @odata.count (total matches after $filter/$search, before paging) in the response. |
country | query | string | no | Filter to a single country (IN | AU | US) |
customer_id | query | string | no | Filter by customer id |
indicator | query | string | no | Filter by indicator |
severity | query | string | no | Filter by severity |
status | query | string | no | Filter by status |
Responses
200- Paginated list
application/jsondataarrayarray of:
FraudAlertidstringcustomer_idstringcountrystringindicatorstringseveritystringstatusstringscoreintegerflagged_activitystringcase_idstringdetected_atstringcreatedAtstringupdatedAtstring
nextCursorstringtotalinteger
POST /api/purple-suite/risk-compliance/fraud_alerts
Create fraud alert
Raise a fraud alert on a customer's activity with an indicator, severity and a description of the flagged behaviour. Detection normally writes these; a human escalation is usually a fraud case instead.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes |
Request body
application/json — required
FraudAlert
idstringcustomer_idstringcountrystringindicatorstringseveritystringstatusstringscoreintegerflagged_activitystringcase_idstringdetected_atstringcreatedAtstringupdatedAtstring
Responses
201- Created
application/jsonFraudAlertidstringcustomer_idstringcountrystringindicatorstringseveritystringstatusstringscoreintegerflagged_activitystringcase_idstringdetected_atstringcreatedAtstringupdatedAtstring
GET /api/purple-suite/risk-compliance/fraud_alerts/{id}
Get fraud alert
Fetch one fraud alert by id with its indicator, severity, score, flagged activity and triage status.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Responses
200- Found
application/jsonFraudAlertidstringcustomer_idstringcountrystringindicatorstringseveritystringstatusstringscoreintegerflagged_activitystringcase_idstringdetected_atstringcreatedAtstringupdatedAtstring
404- Not found
DELETE /api/purple-suite/risk-compliance/fraud_alerts/{id}
Delete fraud alert
Permanently delete a fraud alert. Destructive and irreversible — dismiss it via triage instead, so the decision not to act is recorded.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Responses
200- Deleted
application/jsonsuccessbooleanidstring
404- Not found
PATCH /api/purple-suite/risk-compliance/fraud_alerts/{id}
Update fraud alert
Partially update fraud alert metadata such as notes or score. Use the triage tool to set triaged/dismissed/escalated — it enforces one-time triage and links the resulting case.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Request body
Fields to update (partial)
application/json
FraudAlert
idstringcustomer_idstringcountrystringindicatorstringseveritystringstatusstringscoreintegerflagged_activitystringcase_idstringdetected_atstringcreatedAtstringupdatedAtstring
Responses
200- Updated
application/jsonFraudAlertidstringcustomer_idstringcountrystringindicatorstringseveritystringstatusstringscoreintegerflagged_activitystringcase_idstringdetected_atstringcreatedAtstringupdatedAtstring
404- Not found
POST /api/purple-suite/risk-compliance/fraud_alerts/{id}/triage
Triage a fraud alert
Decide what happens to a fraud alert: triaged (reviewed, no further action), dismissed (false positive) or escalated — passing case_id links it to the fraud case that will investigate. One-way: an alert that has already been triaged, dismissed or escalated is rejected with 422.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Request body
application/json — required
statusstring requiredcase_idstring
Responses
200- Updated
application/jsonFraudAlertidstringcustomer_idstringcountrystringindicatorstringseveritystringstatusstringscoreintegerflagged_activitystringcase_idstringdetected_atstringcreatedAtstringupdatedAtstring
400- Invalid status
404- Not found
422- Alert already triaged/dismissed/escalated
GET /api/purple-suite/risk-compliance/fraud_cases
List fraud cases
Fraud cases are the human investigations opened off one or more fraud alerts, with an assigned investigator, risk indicators, status open | investigating | closed and a disposition (confirmed_fraud | false_positive | pending). Cases are the investigation; alerts are the raw signals. Narrow results server-side with this endpoint's named filter params (country, customer_id, status, …) or with OData $filter, $orderby, $select, $search, $top, $skip and $count (MCP clients send those as _filter, _orderby, …) instead of paging through everything.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
limit | query | integer | no | Max items per page (default 50) |
cursor | query | string | no | Pass the previous response's nextCursor to fetch the next page |
$filter | query | string | no | OData filter expression. Comparison operators: eq, ne, gt, ge, lt, le. Logical: and, or, not, with parentheses for grouping. String functions: contains(field,'x'), startswith(field,'x'), endswith(field,'x'). Membership: field in ('a','b'). Case-insensitive matching via tolower(field) / toupper(field). Nested fields use a slash, e.g. pto_balance/vacation_days. String literals use single quotes; dates are ISO-8601. Examples: "status eq 'active'"; "salary gt 50000 and department eq 'Engineering'"; "contains(tolower(name),'acme')"; "closeDate gt 2026-01-01". |
$select | query | string | no | Comma-separated list of fields to return, e.g. "id,firstName,email". Nested fields via slash ("pto_balance/vacation_days"). The id field is always included. |
$orderby | query | string | no | Sort clause(s), comma-separated, each "field [asc|desc]" (asc is the default). Example: "createdAt desc, lastName asc". Null values sort last. |
$search | query | string | no | Free-text, case-insensitive substring match across the resource's searchable fields. |
$top | query | integer | no | Maximum number of items to return (page size). |
$skip | query | integer | no | Number of matching items to skip before returning results (offset paging). Combine with $top. |
$count | query | boolean | no | When true, include @odata.count (total matches after $filter/$search, before paging) in the response. |
country | query | string | no | Filter to a single country (IN | AU | US) |
customer_id | query | string | no | Filter by customer id |
status | query | string | no | Filter by status |
disposition | query | string | no | Filter by disposition |
Responses
200- Paginated list
application/jsondataarrayarray of:
FraudCaseidstringcustomer_idstringcountrystringalert_idsarrayarray of:
string
statusstringdispositionstringrisk_indicatorsarrayarray of:
string
assigned_investigatorstringcase_notesarrayarray of:
notestringrecorded_atstring
status_historyarrayarray of:
statusstringnotestringrecorded_atstring
createdAtstringupdatedAtstring
nextCursorstringtotalinteger
POST /api/purple-suite/risk-compliance/fraud_cases
Open fraud case
Open a fraud investigation case for a customer. If it stems from an alert, escalating that alert via the triage tool links the two — prefer that route.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes |
Request body
application/json — required
FraudCase
idstringcustomer_idstringcountrystringalert_idsarrayarray of:
string
statusstringdispositionstringrisk_indicatorsarrayarray of:
string
assigned_investigatorstringcase_notesarrayarray of:
notestringrecorded_atstring
status_historyarrayarray of:
statusstringnotestringrecorded_atstring
createdAtstringupdatedAtstring
Responses
201- Created
application/jsonFraudCaseidstringcustomer_idstringcountrystringalert_idsarrayarray of:
string
statusstringdispositionstringrisk_indicatorsarrayarray of:
string
assigned_investigatorstringcase_notesarrayarray of:
notestringrecorded_atstring
status_historyarrayarray of:
statusstringnotestringrecorded_atstring
createdAtstringupdatedAtstring
GET /api/purple-suite/risk-compliance/fraud_cases/{id}
Get fraud case
Fetch one fraud case by id with its status, disposition, assigned investigator, risk indicators and notes.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Responses
200- Found
application/jsonFraudCaseidstringcustomer_idstringcountrystringalert_idsarrayarray of:
string
statusstringdispositionstringrisk_indicatorsarrayarray of:
string
assigned_investigatorstringcase_notesarrayarray of:
notestringrecorded_atstring
status_historyarrayarray of:
statusstringnotestringrecorded_atstring
createdAtstringupdatedAtstring
404- Not found
DELETE /api/purple-suite/risk-compliance/fraud_cases/{id}
Delete fraud case
Permanently delete a fraud investigation case. Destructive and irreversible, and it destroys the investigation record — close it with a disposition instead.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Responses
200- Deleted
application/jsonsuccessbooleanidstring
404- Not found
PATCH /api/purple-suite/risk-compliance/fraud_cases/{id}
Update fraud case
Partially update fraud case details such as investigator, risk indicators or notes. Use the transition tool to change status or close with a disposition — closure is enforced there and is irreversible.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Request body
Fields to update (partial)
application/json
FraudCase
idstringcustomer_idstringcountrystringalert_idsarrayarray of:
string
statusstringdispositionstringrisk_indicatorsarrayarray of:
string
assigned_investigatorstringcase_notesarrayarray of:
notestringrecorded_atstring
status_historyarrayarray of:
statusstringnotestringrecorded_atstring
createdAtstringupdatedAtstring
Responses
200- Updated
application/jsonFraudCaseidstringcustomer_idstringcountrystringalert_idsarrayarray of:
string
statusstringdispositionstringrisk_indicatorsarrayarray of:
string
assigned_investigatorstringcase_notesarrayarray of:
notestringrecorded_atstring
status_historyarrayarray of:
statusstringnotestringrecorded_atstring
createdAtstringupdatedAtstring
404- Not found
POST /api/purple-suite/risk-compliance/fraud_cases/{id}/transition
Transition a fraud case
Move a fraud investigation through open → investigating → closed, with an optional note. Closing requires a disposition (confirmed_fraud | false_positive | pending) and is irreversible — a closed case cannot be reopened, so use it only when the investigation is genuinely finished.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Request body
application/json — required
statusstring requireddispositionstringnotestring
Responses
200- Updated
application/jsonFraudCaseidstringcustomer_idstringcountrystringalert_idsarrayarray of:
string
statusstringdispositionstringrisk_indicatorsarrayarray of:
string
assigned_investigatorstringcase_notesarrayarray of:
notestringrecorded_atstring
status_historyarrayarray of:
statusstringnotestringrecorded_atstring
createdAtstringupdatedAtstring
400- Invalid status
404- Not found
422- Invalid transition / disposition required to close
GET /api/purple-suite/risk-compliance/watchlist
List AML watchlist entries
AML screening hits: sanctions, PEP and internal blocklist entries with the matched name, country, list type and match strength, optionally linked to a customer_id. These are screening matches to adjudicate, not blocked cards or frozen accounts. Narrow results server-side with this endpoint's named filter params (country, customer_id, status, …) or with OData $filter, $orderby, $select, $search, $top, $skip and $count (MCP clients send those as _filter, _orderby, …) instead of paging through everything.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
limit | query | integer | no | Max items per page (default 50) |
cursor | query | string | no | Pass the previous response's nextCursor to fetch the next page |
$filter | query | string | no | OData filter expression. Comparison operators: eq, ne, gt, ge, lt, le. Logical: and, or, not, with parentheses for grouping. String functions: contains(field,'x'), startswith(field,'x'), endswith(field,'x'). Membership: field in ('a','b'). Case-insensitive matching via tolower(field) / toupper(field). Nested fields use a slash, e.g. pto_balance/vacation_days. String literals use single quotes; dates are ISO-8601. Examples: "status eq 'active'"; "salary gt 50000 and department eq 'Engineering'"; "contains(tolower(name),'acme')"; "closeDate gt 2026-01-01". |
$select | query | string | no | Comma-separated list of fields to return, e.g. "id,firstName,email". Nested fields via slash ("pto_balance/vacation_days"). The id field is always included. |
$orderby | query | string | no | Sort clause(s), comma-separated, each "field [asc|desc]" (asc is the default). Example: "createdAt desc, lastName asc". Null values sort last. |
$search | query | string | no | Free-text, case-insensitive substring match across the resource's searchable fields. |
$top | query | integer | no | Maximum number of items to return (page size). |
$skip | query | integer | no | Number of matching items to skip before returning results (offset paging). Combine with $top. |
$count | query | boolean | no | When true, include @odata.count (total matches after $filter/$search, before paging) in the response. |
country | query | string | no | Filter to a single country (IN | AU | US) |
customer_id | query | string | no | Filter by customer id |
list_type | query | string | no | Filter by list type |
Responses
200- Paginated list
application/jsondataarrayarray of:
WatchlistEntryidstringcustomer_idstringcountrystringnamestringlist_typestringmatch_strengthintegercreatedAtstringupdatedAtstring
nextCursorstringtotalinteger
POST /api/purple-suite/risk-compliance/watchlist
Create watchlist entry
Record an AML watchlist hit (sanctions, PEP or internal blocklist) with the matched name and match strength, optionally tied to a customer.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes |
Request body
application/json — required
WatchlistEntry
idstringcustomer_idstringcountrystringnamestringlist_typestringmatch_strengthintegercreatedAtstringupdatedAtstring
Responses
201- Created
application/jsonWatchlistEntryidstringcustomer_idstringcountrystringnamestringlist_typestringmatch_strengthintegercreatedAtstringupdatedAtstring
GET /api/purple-suite/risk-compliance/watchlist/{id}
Get watchlist entry
Fetch one watchlist entry by id with its list type, matched name, country and match strength — the evidence behind a sanctions or PEP flag.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Responses
200- Found
application/jsonWatchlistEntryidstringcustomer_idstringcountrystringnamestringlist_typestringmatch_strengthintegercreatedAtstringupdatedAtstring
404- Not found
DELETE /api/purple-suite/risk-compliance/watchlist/{id}
Delete watchlist entry
Permanently delete a watchlist entry, e.g. after a false-positive adjudication. Destructive and irreversible, and it removes regulated screening evidence.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Responses
200- Deleted
application/jsonsuccessbooleanidstring
404- Not found
PATCH /api/purple-suite/risk-compliance/watchlist/{id}
Update watchlist entry
Partially update a watchlist entry — revise the match strength, or attach it to the customer it actually matches after adjudication.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Request body
Fields to update (partial)
application/json
WatchlistEntry
idstringcustomer_idstringcountrystringnamestringlist_typestringmatch_strengthintegercreatedAtstringupdatedAtstring
Responses
200- Updated
application/jsonWatchlistEntryidstringcustomer_idstringcountrystringnamestringlist_typestringmatch_strengthintegercreatedAtstringupdatedAtstring
404- Not found
GET /api/purple-suite/risk-compliance/policies
List compliance policies and SOPs
The compliance knowledge base: policies, procedures, SOPs and customer scripts by category (KYC, payments, lending, branch, fraud) with the owning regulator and effective dates. Use these for 'what does the rule say / what do I tell the customer' questions; IT knowledge articles live in Purple ITSM. Narrow results server-side with this endpoint's named filter params (country, customer_id, status, …) or with OData $filter, $orderby, $select, $search, $top, $skip and $count (MCP clients send those as _filter, _orderby, …) instead of paging through everything.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
limit | query | integer | no | Max items per page (default 50) |
cursor | query | string | no | Pass the previous response's nextCursor to fetch the next page |
$filter | query | string | no | OData filter expression. Comparison operators: eq, ne, gt, ge, lt, le. Logical: and, or, not, with parentheses for grouping. String functions: contains(field,'x'), startswith(field,'x'), endswith(field,'x'). Membership: field in ('a','b'). Case-insensitive matching via tolower(field) / toupper(field). Nested fields use a slash, e.g. pto_balance/vacation_days. String literals use single quotes; dates are ISO-8601. Examples: "status eq 'active'"; "salary gt 50000 and department eq 'Engineering'"; "contains(tolower(name),'acme')"; "closeDate gt 2026-01-01". |
$select | query | string | no | Comma-separated list of fields to return, e.g. "id,firstName,email". Nested fields via slash ("pto_balance/vacation_days"). The id field is always included. |
$orderby | query | string | no | Sort clause(s), comma-separated, each "field [asc|desc]" (asc is the default). Example: "createdAt desc, lastName asc". Null values sort last. |
$search | query | string | no | Free-text, case-insensitive substring match across the resource's searchable fields. |
$top | query | integer | no | Maximum number of items to return (page size). |
$skip | query | integer | no | Number of matching items to skip before returning results (offset paging). Combine with $top. |
$count | query | boolean | no | When true, include @odata.count (total matches after $filter/$search, before paging) in the response. |
country | query | string | no | Filter to a single country (IN | AU | US) |
policy_type | query | string | no | Filter by policy type |
category | query | string | no | Filter by category |
Responses
200- Paginated list
application/jsondataarrayarray of:
Policyidstringcountrystringtitlestringpolicy_typestringcategorystringbodystringcustomer_scriptstring — Verbatim text the frontline staff can read to the customerregulatorstringeffective_datestringcreatedAtstringupdatedAtstring
nextCursorstringtotalinteger
POST /api/purple-suite/risk-compliance/policies
Create compliance policy
Publish a new compliance policy, procedure, SOP or customer script with its category, regulator and effective date.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes |
Request body
application/json — required
Policy
idstringcountrystringtitlestringpolicy_typestringcategorystringbodystringcustomer_scriptstring — Verbatim text the frontline staff can read to the customerregulatorstringeffective_datestringcreatedAtstringupdatedAtstring
Responses
201- Created
application/jsonPolicyidstringcountrystringtitlestringpolicy_typestringcategorystringbodystringcustomer_scriptstring — Verbatim text the frontline staff can read to the customerregulatorstringeffective_datestringcreatedAtstringupdatedAtstring
GET /api/purple-suite/risk-compliance/policies/{id}
Get compliance policy
Fetch one policy, SOP or customer script by id with its full text, category, regulator and effective dates — the citation for a compliance answer.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Responses
200- Found
application/jsonPolicyidstringcountrystringtitlestringpolicy_typestringcategorystringbodystringcustomer_scriptstring — Verbatim text the frontline staff can read to the customerregulatorstringeffective_datestringcreatedAtstringupdatedAtstring
404- Not found
DELETE /api/purple-suite/risk-compliance/policies/{id}
Delete compliance policy
Permanently delete a policy or SOP from the compliance knowledge base. Destructive and irreversible — supersede it with an updated version instead.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Responses
200- Deleted
application/jsonsuccessbooleanidstring
404- Not found
PATCH /api/purple-suite/risk-compliance/policies/{id}
Update compliance policy
Update a policy or SOP — revise its text, effective dates or owning regulator when the rule changes.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
X-Instance-ID | header | string | yes | |
id | path | string | yes |
Request body
Fields to update (partial)
application/json
Policy
idstringcountrystringtitlestringpolicy_typestringcategorystringbodystringcustomer_scriptstring — Verbatim text the frontline staff can read to the customerregulatorstringeffective_datestringcreatedAtstringupdatedAtstring
Responses
200- Updated
application/jsonPolicyidstringcountrystringtitlestringpolicy_typestringcategorystringbodystringcustomer_scriptstring — Verbatim text the frontline staff can read to the customerregulatorstringeffective_datestringcreatedAtstringupdatedAtstring
404- Not found