Retain authenticated validator or actual transmission/FinCEN response bytes from the dedicated bridge
/bsa-filings/{id}/receiptsOnly actual svc_bsa_bridge with compliance:filings:bridge, no API key, and a valid current purpose-specific Ed25519 signature may admit new validator/transmission/response evidence. Signed payload binds environment, exact prepared batch, receipt/document hash, correlation and times. Exact already-admitted retry survives signing-key retirement; changed evidence refuses. Parsing acknowledgment alone establishes neither authenticity nor production acceptance. An external validation receipt cannot substitute for a native packet's retained service-generated schema and business-rule proof.
Path parameters
idstringRequiredHeaders
Idempotency-KeystringOptionalSend on every write that creates or changes money or state; a replay with the same key returns the original result with 200.
Body parameters
documentstring · byteRequiredreceiptobjectRequired2 child attributes
payloadobjectRequiredBridgePayload attests actual validator or transmission-system evidence. It is not a FinCEN protocol. The bridge must supply the real retained document bytes; a SHA entered by bank staff alone never establishes validation or acceptance.
11 child attributes
batch_sha256stringRequiredcorrelation_idstringOptionaldocument_sha256stringRequiredenvironmentstringRequiredissued_atstring · date-timeRequiredkey_idstringRequiredkindstringRequiredValidation, transmission, acknowledgment, rejection
observed_atstring · date-timeRequiredpacket_idstringRequiredreceipt_idstringRequiredExample achr_2tVh8nqLxq4GbDe0K1F6S9zRcWm
versionstringRequiredsignaturestringRequiredReturns
200 OK
acknowledgmentobject or nullOptionalAcknowledgment is one complete FinCEN XML 2.0 batch response. Parsing establishes its structure and exact activity membership, not the response's authenticity or that it belongs to a particular submitted file. The filing service must bind the original response bytes to an authenticated transmission receipt before use.
4 child attributes
activitiesarray of objectsRequired3 child attributes
bsa_idstringRequiredsequenceintegerRequiredwarningsarray of objectsRequired6 child attributes
codestringOptionalcontextstringOptionalelementstringOptionallevelstringOptionalsequenceintegerRequiredtextstringOptionalbatch_sequenceintegerRequiredsha256stringRequiredsubmission_sequenceintegerRequiredcancellationobject or nullOptional4 child attributes
actorstringRequiredcancelled_atstring · date-timeRequiredcontent_sha256stringRequiredreasonstringRequiredcontent_sha256stringRequiredcontinuesobject or nullOptionalContinuingReference names the exact accepted SAR activity a continuing report follows. It is plaintext packet content so admission guards can bind it.
2 child attributes
activity_sequenceintegerRequiredpacket_idstringRequireddecisionobject or nullOptional5 child attributes
actorstringRequiredcontent_sha256stringRequireddecided_atstring · date-timeRequireddecisionstringRequirednotestringRequireddisposalobject or nullOptionalPacketDisposal marks a packet whose encrypted documents were destroyed.
3 child attributes
disposed_atstring · date-timeRequireddocumentsarray of stringsRequiredversionintegerRequiredidstringRequiredmanifestobjectRequired3 child attributes
activitiesarray of objectsRequired5 child attributes
attachmentstringOptionalSARX only: the named single CSV support document
filing_datestringRequiredprior_bsa_idstringOptionalreport_kindstringRequiredsequenceintegerRequiredformstringRequiredsha256stringRequirednativeobject or nullOptionalNativeProvenance distinguishes an actual source-generated, locally validated form from imported XML and independently authenticated bridge reports.
6 child attributes
guide_sha256stringRequiredinput_sha256stringRequiredrules_idstringRequiredsource_sha256stringRequiredvalidation_sha256stringRequiredversionstringRequirednative_validationobject or nullOptionalNativeValidation retains the complete deterministic engine reports without pretending the bank's local validator signed as an independent bridge. Maps marshal canonically across PostgreSQL JSONB key-order normalization.
11 child attributes
batch_sha256stringRequiredbusinessobjectRequiredformstringRequiredguide_sha256stringRequiredinput_sha256stringRequiredrules_idstringRequiredschemaobjectRequiredschema_bundle_sha256stringRequiredsource_sha256stringRequiredvalidated_atstring · date-timeRequiredversionstringRequiredprepared_atstring · date-timeRequiredprepared_bystringRequiredprior_packet_idstringOptionalreasonstringRequiredreleased_atstring · date-time or nullOptionalresponseobject or nullOptional3 child attributes
receiptobjectRequired2 child attributes
payloadobjectRequiredBridgePayload attests actual validator or transmission-system evidence. It is not a FinCEN protocol. The bridge must supply the real retained document bytes; a SHA entered by bank staff alone never establishes validation or acceptance.
11 child attributes
batch_sha256stringRequiredcorrelation_idstringOptionaldocument_sha256stringRequiredenvironmentstringRequiredissued_atstring · date-timeRequiredkey_idstringRequiredkindstringRequiredValidation, transmission, acknowledgment, rejection
observed_atstring · date-timeRequiredpacket_idstringRequiredreceipt_idstringRequiredExample achr_2tVh8nqLxq4GbDe0K1F6S9zRcWm
versionstringRequiredsignaturestringRequiredrecorded_atstring · date-timeRequiredverified_public_keystringRequiredsource_document_sha256stringRequiredsourcesarray of objectsRequired3 child attributes
activity_sequenceintegerRequiredalert_idstringRequiredExample alrt_2tVh8nqLxq4GbDe0K1F6S9zRcWm
sha256stringRequiredstatusstringRequiredsupport_documentobject or nullOptionalSupportDocument is the one CSV attachment a SARX activity names, whether the batch was generated natively or imported with those exact bytes. The SAR XML User Guide 1.6 (section 4.5 and Attachment E) permits one MS Excel-compatible CSV of at most one megabyte per SAR, recorded by its full name in OriginalAttachmentFileName; batch filers place each CSV in the attachment zip file named <activity SeqNum>_<OriginalAttachmentFileName>. The exact bytes are a separate encrypted payload released only with the approved batch naming them.
5 child attributes
activity_sequenceintegerRequiredbytesintegerRequiredfile_namestringRequiredsha256stringRequiredsubmission_file_namestringRequiredtransmissionobject or nullOptional3 child attributes
receiptobjectRequired2 child attributes
payloadobjectRequiredBridgePayload attests actual validator or transmission-system evidence. It is not a FinCEN protocol. The bridge must supply the real retained document bytes; a SHA entered by bank staff alone never establishes validation or acceptance.
11 child attributes
batch_sha256stringRequiredcorrelation_idstringOptionaldocument_sha256stringRequiredenvironmentstringRequiredissued_atstring · date-timeRequiredkey_idstringRequiredkindstringRequiredValidation, transmission, acknowledgment, rejection
observed_atstring · date-timeRequiredpacket_idstringRequiredreceipt_idstringRequiredExample achr_2tVh8nqLxq4GbDe0K1F6S9zRcWm
versionstringRequiredsignaturestringRequiredrecorded_atstring · date-timeRequiredverified_public_keystringRequiredvalidationobject or nullOptionalValidationReport is the bridge's complete schema + filing-rule result for an immutable configured ruleset. Findings are retained even on failure. The actual validator implementation must run the full schemas and business rules; manifest inspection is not sufficient to issue a successful report.
8 child attributes
batch_sha256stringRequiredbusiness_rules_idstringRequiredbusiness_rules_validbooleanRequiredfindingsarray of stringsRequiredformstringRequiredschema_bundle_sha256stringRequiredschema_validbooleanRequiredvalidator_versionstringRequiredvalidation_profileobjectRequired4 child attributes
business_rules_idstringRequiredenvironmentstringRequiredTest or production, retained with every packet
formstringRequiredschema_bundle_sha256stringRequiredErrors
Every error is a problem document with a stable code. See Errors.
400401403404409412413422424429500503