CaseForge Platform API

Ends the current user session and invalidates the session cookie. After logout, the client must re-authenticate to make further API calls. No request body is required.

Changes a user's password before login. This is typically used for password reset flows or first-time login scenarios where the user must set a new password.

Admin Util — Change Password

Retrieves the full details of an existing work item including all field values, current workflow state, assigned owner, audit history, and related entities.

Work Item View

{
  "alertIdentifier": "WI-20250227-0042",
  "alertName": "Suspicious Wire Transfer — $250,000",
  "alertTypeIdentifier": "SAR",
  "alertDate": "2025-02-27 14:32:07",
  "state": "Open",
  "statusIdentifier": "UNDER_REVIEW",
  "score": "87",
  "priorityIdentifier": "high",
  "ownerIdentifier": "analyst_jsmith",
  "buIdentifier": "compliance_us",
  "customFields": [
    {"identifier": "Transaction_Amount", "value": "250000"},
    {"identifier": "Originator_Country", "value": "US"}
  ],
  "reasons": [
    {"identifier": "velocity_check", "name": "Velocity threshold exceeded"}
  ],
  "lastUpdateDate": "2025-02-27 15:10:44",
  "lastUpdateUserIdentifier": "analyst_jsmith"
}

Updates one or more fields on an existing work item. Only the fields provided in the request body are modified — omitted fields retain their current values. Fields restricted by the current workflow step cannot be updated.

Work Item Edit

Searches work items using a flexible filter object. Supports filtering by type, status, owner, date range, custom field values, and full-text search on the work item content. Results are paginated.

Work Item View

Changes the workflow step (status) of a work item. The target step must be a valid next step from the current position in the workflow. The response includes the list of permitted actions, any unresolved mandatory tasks, and available next steps.

Work Item Edit Change Workflow Step

Ingests a work item from an external source system using a pre-defined field mapping. The API maps incoming JSON fields to the corresponding platform fields, validates data types, and creates the work item with all associated entities in a single atomic operation.

Execute Web Services Easy Ingest

Saves a field mapping definition for a work item type. Mappings define how incoming data fields from external systems are mapped to platform fields. Each mapping has a unique name and can be saved as draft (for testing) or production (for live use).

Execute Web Services

{
  "name": "external-sar-v2",
  "description": "Maps SAR data from upstream detection engine",
  "fileType": "JSON",
  "dateFormat": "yyyy-MM-dd HH:mm:ss",
  "draft": false,
  "root": {
    "path": "alert",
    "fields": [
      {"identifier": "alertId", "path": "alertId"},
      {"identifier": "score", "path": "riskScore"}
    ],
    "children": [
      {
        "workItemTypeIdentifier": "Party",
        "path": "parties[*]",
        "relationTypeIdentifier": "alert-to-party",
        "fields": [
          {"identifier": "First_Name", "path": "fname"},
          {"identifier": "Last_Name", "path": "lname"}
        ]
      }
    ]
  }
}

Adds the specified users to a group. The response separates successfully added users from unrecognized user identifiers. Supports batch operations up to 200 users per request.

Assign Users to Groups

Removes the specified users from a group. The response separates successfully removed users from unrecognized identifiers.

Assign Users to Groups

Returns a list of all policy types configured in the system. Each policy type contains rules, a workflow lifecycle, and associated work item types.

Policy Manager — View Draft Tab, View Active Tab Policy Manager — Run Time

Retrieves the full configuration of a policy rule including conditions, actions, associated work item types, audit events, version history, and current activation state.

Policy Manager — View Rule, Edit Rule Policy Manager — Run Time

Creates a new rule within the specified policy type. The rule is created in Draft state and must be activated via the workflow step update endpoint. Alert type and audit events are applicable only for Dynamic Workflow policy types.

Policy Manager — Edit Rule Policy Manager — Run Time

Initiates a simulation run for the specified policy type. Simulations evaluate draft rules against historical data without affecting live operations. Returns a simulation identifier for tracking progress and retrieving results.

Policy Manager — Edit Rule Policy Manager — Design Time, Run Time, Advanced

Creates a new data source connection. Connections define how CaseForge communicates with analytics engines, external databases, and upstream detection systems. Supports Standard, Virtual (multi-tenant routing), and Tenant connection types.

Add Connection

Adds one or more custom fields (up to 20 per request) to a specified work item type. Custom fields extend the schema of work items with business-specific data points. Virtual fields can reference external entities.

Returns all configured graph database query definitions including their parameters, associated work item type mappings, and active status.

Graph Analytics Graph Analytics — View

Executes the specified query against the configured graph database instance. Parameters are passed as an array of name-value pairs. The response contains the graph traversal results mapped to platform entity types.

Graph Analytics Execute Query

Creates a new SAR from an existing work item. The work item must be of a SAR-type with all mandatory FinCEN fields populated. Supports direct association with an investigation work item for full traceability.

Request Body

{
  "status": true,
  "sarIdentifier": "SAR-2025-00847",
  "workItemIdentifier": "WI-20250227-0042",
  "sarStatus": "draft",
  "jurisdiction": "fincen",
  "deadline": "2025-03-29T23:59:59Z",
  "message": "SAR created. Filing deadline in 30 days."
}

Returns a paginated list of SARs, sorted by creation date (newest first). Filter by status, jurisdiction, or upcoming deadline to build urgency queues.

Query Parameters

Advances or reverts the SAR to a new status. Transitions are validated against the configured workflow — invalid transitions return 422 Unprocessable Entity.

Request Body

Returns a paginated audit event log, newest first. Scope by entity, actor, action type, or date range.

Query Parameters

{
  "page": 1, "pageSize": 25, "total": 4821,
  "events": [
    {
      "eventId": "evt_9xK3LmN2vR7t",
      "timestamp": "2025-02-27T14:31:05Z",
      "actor": "analyst.jsmith",
      "actorIp": "203.0.113.45",
      "action": "status_changed",
      "entityType": "work_item",
      "entityId": "WI-20250227-0042",
      "changes": { "status": { "from": "open", "to": "pending_sar" } },
      "hash": "sha256:a3f9b2c1..."
    }
  ]
}

Generates a signed, tamper-evident audit export for regulatory submissions, external audits, or legal discovery. Exports are queued asynchronously — an audit.export_ready webhook fires when complete.

Request Body

{
  "exportId": "exp_4Nq7TxLm2kRv",
  "status": "queued",
  "estimatedReadyAt": "2025-02-27T15:05:00Z",
  "message": "Export queued. Webhook notification sent when ready."
}

Registers a new HTTPS endpoint to receive CaseForge events. A ping event is delivered immediately to verify reachability. Endpoints must respond with HTTP 200 within 10 seconds.

Request Body

Returns all webhook registrations on the tenant, including active status, last delivery outcome, and subscribed event list.