Reviews & Case Management

Reviews attach analyst work to a stored risk assessment. They require an admin or analyst role and a plan with the reviews feature.

Create a review#

POST /reviews

{
  "assessmentId": "e7d3c2b1-a0f9-4e8d-b7c6-5a4f3e2d1c0b",
  "analystNote": "Checking device history after a velocity spike."
}

The response returns the review ID, linked assessment, open status, authenticated analyst identity, note, and timestamps. Clients do not send analystId or analystEmail.

Status lifecycle#

open → in_review → escalated ─┐
                              ├→ confirmed_fraud
                              ├→ false_positive
                              ├→ closed
                              └→ resolved

open, in_review, and escalated are active. The other statuses are terminal and set closedAt.

Update a status with PATCH /reviews/status:

{
  "reviewId": "r1a2b3c4-d5e6-7890-abcd-ef1234567890",
  "status": "confirmed_fraud"
}

Find reviews#

• GET /reviews?page=1&limit=20&status=open returns paginated data and meta; limit defaults to 20 and is capped at 100.
• GET /reviews/:id returns one review plus assessment score, action, risk level, reason codes, and creation time.

Resolve the operational loop#

1. Inspect the assessment and linked evidence.
2. Record notes and move the review through its status.
3. Set a terminal status when the verdict is known.
4. Submit the matching outcome through Submit Feedback.

Use Graph Explorer for connected evidence and Risk Scores for decision semantics.