APZWatch
Sign inCreate workspace

REST API · V1

API reference

Authenticate with Bearer keys (azw_live_… / azw_test_…). Optional Idempotency-Key header on screen calls (8–255 chars; same key + same body replays the original result; different body → 409). Base path /api/v1. Machine-readable contract: /openapi.json.

Case disposition requests replay the original result for 24 hours. After that, the key is not executed again and returns 409 idempotency_expired.

Endpoints

  • GET /health — liveness
  • GET /health/ready — DB + list freshness
  • GET /me — organisation, plan, key scopes, environment
  • GET /usage — period meters vs quotas
  • GET /lists — current auditable list snapshots
  • POST /screens/person — live sanctions / terror designation matching · passport / national ID when present on lists
  • POST /screens/entity — organisation / legal-name + registration number
  • POST /screens/wallet — designated wallets when present on list snapshots
  • POST /screens/address — listed addresses from OFAC + ZA FIC TFS snapshots
  • POST /screens/compromised — local development only accepts documented HIBP test fixtures; production remains unavailable until a provider is approved. Fixture checks are not stored or billed.
  • GET /screens/{resultId} — retrieve evidence
  • POST /ai/adverse-media — live GDELT discovery (search: true) with citations + optional OpenAI summary, or summarise excerpts you supply (advisory; not a deterministic screening corpus)
  • GET /cases · GET|PATCH /cases/{id} · GET /cases/{id}/export — case workflow + evidence pack
  • GET /audit/export — audit log download
  • GET /graph/{profileId} — relationship neighbors (shared addresses / graph-lite)
  • GET|POST /monitor — continuous watches (person / entity / wallet); rescreened when lists refresh · monitor:manage
  • POST|DELETE /monitor/{watchId} — force rescreen or disable
  • GET|POST /webhooks — signed event delivery (monitor.alert on status worsening)

Example request

curl -s https://apzwatch.apzportal.apzor.com/api/v1/screens/person \
  -H "Authorization: Bearer azw_live_…" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: person-kyc-001" \
  -d '{
    "fullName": "Jane Example",
    "givenName": "Jane",
    "familyName": "Example",
    "dateOfBirth": "1980-01-15",
    "nationality": "ZA",
    "countryOfResidence": "ZA",
    "email": "jane@example.com",
    "passportNumber": "A12345678",
    "nationalId": "8001015009087"
  }'

# Every screen response includes auditable listVersions
# (listName, listCode, effectiveDate, publishedAt, fetchedAt,
#  recordCount, contentHash, sourceUrl).
# Wallet hits include sourceAttribution for the exact matching list version.
# Wallet coverageGaps include wallet_transaction_history and wallet_indirect_exposure.
# Live hit categories today: sanctions | terror | wallet_designation
# Hits include matchBand (strong|likely|possible|unlikely), matchReasons, entityProfileId.
# Exact name alone is never strong — needs DOB/country/ID/wallet corroboration.
# (durable adverse_media is expanding; compromised checks require an approved licensed provider)
API reference · APZWatch