Independently decide the exact validated filing
/bsa-filings/{id}/decisionsConfidential filing API: dedicated compliance:filings staff scope, actual verified staff identity and no API keys. Writes, approval and export require step-up within five minutes; independent approval binds exact immutable content and successful full schema/business-rule validation. XML/source and actual response bytes are encrypted and excluded from ordinary bank records/audit exports. Preparing, downloading or reporting transmission does not establish FinCEN acceptance; exact complete authenticated acknowledgment and matching transmission correlation are required. Test-environment acknowledgments remain explicitly test-only. Bounded profile: complete CTR/SAR batch XML for the configured native rules ID (CTR v1/v2/v3, SAR v1/v2); joint SARs remain unsupported. Manifest inspection is not complete XSD validation.
Path parameters
idstringRequiredHeaders
Idempotency-KeystringOptionalSend on every write that creates or changes money or state; a replay with the same key returns the original result with 200.
Body parameters
content_sha256stringRequireddecisionstringRequirednotestringRequiredReturns
200 OK
acknowledgmentobject or nullOptionalAcknowledgment is one complete FinCEN XML 2.0 batch response. Parsing establishes its structure and exact activity membership, not the response's authenticity or that it belongs to a particular submitted file. The filing service must bind the original response bytes to an authenticated transmission receipt before use.
4 child attributes
activitiesarray of objectsRequired3 child attributes
bsa_idstringRequiredsequenceintegerRequiredwarningsarray of objectsRequired6 child attributes
codestringOptionalcontextstringOptionalelementstringOptionallevelstringOptionalsequenceintegerRequiredtextstringOptionalbatch_sequenceintegerRequiredsha256stringRequiredsubmission_sequenceintegerRequiredcancellationobject or nullOptional4 child attributes
actorstringRequiredcancelled_atstring · date-timeRequiredcontent_sha256stringRequiredreasonstringRequiredcontent_sha256stringRequiredcontinuesobject or nullOptionalContinuingReference names the exact accepted SAR activity a continuing report follows. It is plaintext packet content so admission guards can bind it.
2 child attributes
activity_sequenceintegerRequiredpacket_idstringRequireddecisionobject or nullOptional5 child attributes
actorstringRequiredcontent_sha256stringRequireddecided_atstring · date-timeRequireddecisionstringRequirednotestringRequireddisposalobject or nullOptionalPacketDisposal marks a packet whose encrypted documents were destroyed.
3 child attributes
disposed_atstring · date-timeRequireddocumentsarray of stringsRequiredversionintegerRequiredidstringRequiredmanifestobjectRequired3 child attributes
activitiesarray of objectsRequired5 child attributes
attachmentstringOptionalSARX only: the named single CSV support document
filing_datestringRequiredprior_bsa_idstringOptionalreport_kindstringRequiredsequenceintegerRequiredformstringRequiredsha256stringRequirednativeobject or nullOptionalNativeProvenance distinguishes an actual source-generated, locally validated form from imported XML and independently authenticated bridge reports.
6 child attributes
guide_sha256stringRequiredinput_sha256stringRequiredrules_idstringRequiredsource_sha256stringRequiredvalidation_sha256stringRequiredversionstringRequirednative_validationobject or nullOptionalNativeValidation retains the complete deterministic engine reports without pretending the bank's local validator signed as an independent bridge. Maps marshal canonically across PostgreSQL JSONB key-order normalization.
11 child attributes
batch_sha256stringRequiredbusinessobjectRequiredformstringRequiredguide_sha256stringRequiredinput_sha256stringRequiredrules_idstringRequiredschemaobjectRequiredschema_bundle_sha256stringRequiredsource_sha256stringRequiredvalidated_atstring · date-timeRequiredversionstringRequiredprepared_atstring · date-timeRequiredprepared_bystringRequiredprior_packet_idstringOptionalreasonstringRequiredreleased_atstring · date-time or nullOptionalresponseobject or nullOptional3 child attributes
receiptobjectRequired2 child attributes
payloadobjectRequiredBridgePayload attests actual validator or transmission-system evidence. It is not a FinCEN protocol. The bridge must supply the real retained document bytes; a SHA entered by bank staff alone never establishes validation or acceptance.
11 child attributes
batch_sha256stringRequiredcorrelation_idstringOptionaldocument_sha256stringRequiredenvironmentstringRequiredissued_atstring · date-timeRequiredkey_idstringRequiredkindstringRequiredValidation, transmission, acknowledgment, rejection
observed_atstring · date-timeRequiredpacket_idstringRequiredreceipt_idstringRequiredExample achr_2tVh8nqLxq4GbDe0K1F6S9zRcWm
versionstringRequiredsignaturestringRequiredrecorded_atstring · date-timeRequiredverified_public_keystringRequiredsource_document_sha256stringRequiredsourcesarray of objectsRequired3 child attributes
activity_sequenceintegerRequiredalert_idstringRequiredExample alrt_2tVh8nqLxq4GbDe0K1F6S9zRcWm
sha256stringRequiredstatusstringRequiredsupport_documentobject or nullOptionalSupportDocument is the one CSV attachment a SARX activity names, whether the batch was generated natively or imported with those exact bytes. The SAR XML User Guide 1.6 (section 4.5 and Attachment E) permits one MS Excel-compatible CSV of at most one megabyte per SAR, recorded by its full name in OriginalAttachmentFileName; batch filers place each CSV in the attachment zip file named <activity SeqNum>_<OriginalAttachmentFileName>. The exact bytes are a separate encrypted payload released only with the approved batch naming them.
5 child attributes
activity_sequenceintegerRequiredbytesintegerRequiredfile_namestringRequiredsha256stringRequiredsubmission_file_namestringRequiredtransmissionobject or nullOptional3 child attributes
receiptobjectRequired2 child attributes
payloadobjectRequiredBridgePayload attests actual validator or transmission-system evidence. It is not a FinCEN protocol. The bridge must supply the real retained document bytes; a SHA entered by bank staff alone never establishes validation or acceptance.
11 child attributes
batch_sha256stringRequiredcorrelation_idstringOptionaldocument_sha256stringRequiredenvironmentstringRequiredissued_atstring · date-timeRequiredkey_idstringRequiredkindstringRequiredValidation, transmission, acknowledgment, rejection
observed_atstring · date-timeRequiredpacket_idstringRequiredreceipt_idstringRequiredExample achr_2tVh8nqLxq4GbDe0K1F6S9zRcWm
versionstringRequiredsignaturestringRequiredrecorded_atstring · date-timeRequiredverified_public_keystringRequiredvalidationobject or nullOptionalValidationReport is the bridge's complete schema + filing-rule result for an immutable configured ruleset. Findings are retained even on failure. The actual validator implementation must run the full schemas and business rules; manifest inspection is not sufficient to issue a successful report.
8 child attributes
batch_sha256stringRequiredbusiness_rules_idstringRequiredbusiness_rules_validbooleanRequiredfindingsarray of stringsRequiredformstringRequiredschema_bundle_sha256stringRequiredschema_validbooleanRequiredvalidator_versionstringRequiredvalidation_profileobjectRequired4 child attributes
business_rules_idstringRequiredenvironmentstringRequiredTest or production, retained with every packet
formstringRequiredschema_bundle_sha256stringRequiredErrors
Every error is a problem document with a stable code. See Errors.
400401403404409412413422424429500503