Remllo
Book demo
For Your BusinessOverviewCore ConceptsIntegration OptionsAPI ReferenceOperationsSecurityGo-Live
WatchTower/API Reference

API Reference

Public-safe REST endpoints for integrating Remllo WatchTower into your application. Use the API to ingest transactions, manage organization settings, review alerts and cases, run CSV imports, configure notification routing, and export reports.

Auth Model

WatchTower uses secure session authentication for console workflows and organization API keys for server-side ingestion.

Core Entry Point

Most external integrations start with POST /api/v1/transactions.

Operational Workflows

CSV import, alert review, case notes, attachments, exports, and notification delivery routes are documented here.

Examples use placeholder credentials and sample data only. Keep live API keys server-side, never paste secrets into client code, and request partner-specific contracts through the Remllo team when a private adapter is required.

Developer Reference

Remllo WatchTower API

Customer-facing reference for the Remllo WatchTower API. Use this API to authenticate users, ingest transactions, retrieve risk decisions, manage alerts and cases, configure notification routing, run CSV import workflows, and export investigation data. Public examples use placeholders only; do not send secrets in URLs, tickets, or client-side code.

Resource

Authentication

Session login, onboarding, invitations, MFA, and password lifecycle.

POST
/api/v1/auth/register

Create an organization and initial admin

Creates a new organization, provisions the first admin account, and returns a one-time ingestion API key for connecting external transaction sources.

Request Body

application/json
objectRequired
organizationNamestringRequired
firstNamestringRequired
lastNamestringRequired
emailstringRequired
passwordstringRequired
1curl -X POST "https://api.remllo.com/api/v1/auth/register" \
2  -H "Content-Type: application/json" \
3 \
4  -d '{
5  "organizationName": "Example Bank",
6  "firstName": "Emmanuel",
7  "lastName": "Fadare",
8  "email": "admin@example-bank.com",
9  "password": "UseARealStrongPassword123!"
10}'
Example Response
201 Organization and admin user created successfully.
{
  "message": "Organization created successfully",
  "apiKey": "wt_example_4cce9d2f4e...",
  "organization": {
    "id": "e24e3f3f-3d5f-4f64-a7b9-5252826ed67d",
    "name": "Example Bank"
  },
  "user": {
    "id": "0c1f57e8-71e2-4e24-9e91-14d57f95cf70",
    "email": "admin@example-bank.com",
    "firstName": "Emmanuel",
    "lastName": "Fadare"
  }
}
POST
/api/v1/auth/login

Create an authenticated session

Requires an authenticated WatchTower console session. Session is issued as an HttpOnly cookie after login. If MFA is enabled, this endpoint returns a challenge token instead of a completed session.

Request Body

application/json
objectRequired
emailstringRequired
passwordstringRequired
1curl -X POST "https://api.remllo.com/api/v1/auth/login" \
2  -H "Content-Type: application/json" \
3 \
4  -d '{
5  "email": "admin@example-bank.com",
6  "password": "your_password"
7}'
Example Response
200 Authenticated or MFA challenge issued.
{
  "message": "Login successful",
  "requiresMfa": false,
  "user": {
    "id": "20f2e7e1-0af9-4f4c-bdd3-8d1a84e7e2e4",
    "email": "admin@example-bank.com",
    "firstName": "Demo",
    "lastName": "Admin"
  },
  "organization": {
    "id": "org_acme_demo",
    "name": "Example Bank",
    "role": "ADMIN"
  }
}
POST
/api/v1/auth/mfa/verify-login

Complete an MFA challenge

Verifies a TOTP code or backup code after password authentication and completes the session login.

Request Body

application/json
objectRequired
challengeTokenstringRequired
codestringRequired
1curl -X POST "https://api.remllo.com/api/v1/auth/mfa/verify-login" \
2  -H "Content-Type: application/json" \
3 \
4  -d '{
5  "challengeToken": "mfa_challenge_7f3a4c...",
6  "code": "123456"
7}'
Example Response
200 MFA validated and session completed.
{
  "message": "...",
  "user": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "email": "..."
  },
  "organization": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "name": "...",
    "role": "..."
  }
}
GET
/api/v1/auth/invitations/{token}

Resolve an invitation token

Returns invitation details so the invited user can review the organization and complete password setup.

Parameters

tokenstringRequired
1curl -X GET "https://api.remllo.com/api/v1/auth/invitations/%7Btoken%7D" \
2  -H "Content-Type: application/json"
Example Response
200 Invitation details returned.
{
  "email": "...",
  "firstName": "...",
  "lastName": "...",
  "role": "...",
  "invitationPending": true,
  "organization": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "name": "..."
  }
}
POST
/api/v1/auth/invitations/accept

Accept an organization invitation

Sets the invited user password, clears the invitation token, signs the user in, and joins the target organization.

Request Body

application/json
objectRequired
tokenstringRequired
passwordstringRequired
firstNamestring
lastNamestring
1curl -X POST "https://api.remllo.com/api/v1/auth/invitations/accept" \
2  -H "Content-Type: application/json" \
3 \
4  -d '{
5  "token": "...",
6  "password": "...",
7  "firstName": "...",
8  "lastName": "..."
9}'
Example Response
200 Invitation accepted.
{
  "message": "...",
  "user": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "email": "...",
    "firstName": "...",
    "lastName": "..."
  },
  "organization": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "name": "...",
    "role": "..."
  }
}
POST
/api/v1/auth/password-reset/request

Request a password reset link

Creates a one-time password reset token and returns a reset link for manual delivery or future email delivery.

Request Body

application/json
objectRequired
emailstringRequired
1curl -X POST "https://api.remllo.com/api/v1/auth/password-reset/request" \
2  -H "Content-Type: application/json" \
3 \
4  -d '{
5  "email": "ops@example.com"
6}'
Example Response
200 Password reset request accepted.
{
  "success": true,
  "resetUrl": "..."
}
GET
/api/v1/auth/password-reset/{token}

Validate a password reset token

Checks whether a reset token is still valid and returns the associated email address.

Parameters

tokenstringRequired
1curl -X GET "https://api.remllo.com/api/v1/auth/password-reset/%7Btoken%7D" \
2  -H "Content-Type: application/json"
Example Response
200 Token is valid.
{
  "email": "..."
}
POST
/api/v1/auth/password-reset/complete

Complete a password reset

Sets a new password using a valid reset token.

Request Body

application/json
objectRequired
tokenstringRequired
passwordstringRequired
1curl -X POST "https://api.remllo.com/api/v1/auth/password-reset/complete" \
2  -H "Content-Type: application/json" \
3 \
4  -d '{
5  "token": "...",
6  "password": "..."
7}'
Example Response
200 Password updated.
{
  "message": "..."
}
POST
/api/v1/auth/change-password

Change the current user password

Requires an authenticated WatchTower console session. Session is issued as an HttpOnly cookie after login.

Authentication
sessionCookie

Request Body

application/json
objectRequired
currentPasswordstringRequired
newPasswordstringRequired
1curl -X POST "https://api.remllo.com/api/v1/auth/change-password" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "currentPassword": "...",
7  "newPassword": "..."
8}'
Example Response
200 Password changed.
{
  "message": "..."
}
GET
/api/v1/auth/me

Get the current authenticated session

Returns the signed-in user and active organization membership.

Authentication
sessionCookie
1curl -X GET "https://api.remllo.com/api/v1/auth/me" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Current session information.
{
  "user": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "email": "...",
    "firstName": "...",
    "lastName": "...",
    "mfaEnabled": true
  },
  "organization": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "name": "...",
    "role": "...",
    "slaConfig": {
      "critical": {
        "triageMinutes": 0,
        "investigationMinutes": 0,
        "escalationMinutes": 0
      },
      "high": {
        "triageMinutes": 0,
        "investigationMinutes": 0,
        "escalationMinutes": 0
      },
      "medium": {
        "triageMinutes": 0,
        "investigationMinutes": 0,
        "escalationMinutes": 0
      },
      "low": {
        "triageMinutes": 0,
        "investigationMinutes": 0,
        "escalationMinutes": 0
      }
    }
  }
}
POST
/api/v1/auth/mfa/setup

Start MFA enrollment

Generates a TOTP secret, otpauth URL, and backup codes for the current user. Final activation requires `POST /mfa/verify-setup`.

Authentication
sessionCookie
1curl -X POST "https://api.remllo.com/api/v1/auth/mfa/setup" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 MFA enrollment material generated.
{
  "secret": "...",
  "otpauthUrl": "...",
  "backupCodes": [
    "..."
  ]
}
POST
/api/v1/auth/mfa/verify-setup

Complete MFA enrollment

Validates the initial TOTP code and enables MFA on the account.

Authentication
sessionCookie

Request Body

application/json
objectRequired
codestringRequired
1curl -X POST "https://api.remllo.com/api/v1/auth/mfa/verify-setup" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "code": "..."
7}'
Example Response
200 MFA enabled.
{
  "message": "...",
  "mfaEnabled": true
}
POST
/api/v1/auth/mfa/disable

Disable MFA

Disables MFA using the current password and a valid TOTP or backup code.

Authentication
sessionCookie

Request Body

application/json
objectRequired
passwordstringRequired
codestringRequired
1curl -X POST "https://api.remllo.com/api/v1/auth/mfa/disable" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "password": "...",
7  "code": "..."
8}'
Example Response
200 MFA disabled.
{
  "message": "...",
  "mfaEnabled": true
}
Resource

Organizations

Organization profile, webhook settings, case policy, thresholds, SLA, members, audit logs, and API key lifecycle.

GET
/api/v1/orgs/me

Get the active organization profile

Returns organization configuration, SLA, thresholds, membership roster, and API key status for the signed-in organization.

Authentication
sessionCookie
1curl -X GET "https://api.remllo.com/api/v1/orgs/me" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Organization details.
{
  "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
  "name": "...",
  "hasApiKey": true,
  "webhookUrl": "...",
  "allowedMemberEmailDomains": [
    "..."
  ],
  "highValueTransactionThreshold": 0,
  "riskThresholdLow": 0,
  "riskThresholdMedium": 0,
  "riskThresholdHigh": 0,
  "slaConfig": {
    "critical": {
      "triageMinutes": 0,
      "investigationMinutes": 0,
      "escalationMinutes": 0
    },
    "high": {
      "triageMinutes": 0,
      "investigationMinutes": 0,
      "escalationMinutes": 0
    },
    "medium": {
      "triageMinutes": 0,
      "investigationMinutes": 0,
      "escalationMinutes": 0
    },
    "low": {
      "triageMinutes": 0,
      "investigationMinutes": 0,
      "escalationMinutes": 0
    }
  },
  "createdAt": "2026-03-20T10:15:00.000Z",
  "memberships": [
    {
      "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
      "role": "ADMIN",
      "userId": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
      "organizationId": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
      "createdAt": "2026-03-20T10:15:00.000Z",
      "updatedAt": "2026-03-20T10:15:00.000Z",
      "user": {
        "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
        "email": "...",
        "firstName": "...",
        "lastName": "...",
        "invitationPending": true
      }
    }
  ]
}
PATCH
/api/v1/orgs/webhook

Update the organization webhook URL

Sets or clears the outbound webhook destination used for WatchTower notifications and events.

Authentication
sessionCookie
ADMINRISK_LEAD

Request Body

application/json
objectRequired
webhookUrlstringRequired
1curl -X PATCH "https://api.remllo.com/api/v1/orgs/webhook" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "webhookUrl": "..."
7}'
Example Response
200 Webhook updated.
{
  "message": "...",
  "webhookUrl": "..."
}
PATCH
/api/v1/orgs/thresholds

Update risk thresholds

Updates organization-level high-value and risk bucket thresholds used by the rule engine and dashboards.

Authentication
sessionCookie
ADMINRISK_LEAD

Request Body

application/json
objectRequired
highValueTransactionThresholdnumber
riskThresholdLownumberRequired
riskThresholdMediumnumberRequired
riskThresholdHighnumberRequired
1curl -X PATCH "https://api.remllo.com/api/v1/orgs/thresholds" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "highValueTransactionThreshold": 0,
7  "riskThresholdLow": 0,
8  "riskThresholdMedium": 0,
9  "riskThresholdHigh": 0
10}'
Example Response
200 Thresholds updated.
{
  "message": "...",
  "data": {}
}
PATCH
/api/v1/orgs/sla

Update organization SLA policy

Updates SLA targets for each priority band. Admin-only.

Authentication
sessionCookie
ADMIN

Request Body

application/json
objectRequired
criticalobjectRequired
triageMinutesintegerRequired
investigationMinutesintegerRequired
escalationMinutesintegerRequired
highobjectRequired
triageMinutesintegerRequired
investigationMinutesintegerRequired
escalationMinutesintegerRequired
mediumobjectRequired
triageMinutesintegerRequired
investigationMinutesintegerRequired
escalationMinutesintegerRequired
lowobjectRequired
triageMinutesintegerRequired
investigationMinutesintegerRequired
escalationMinutesintegerRequired
1curl -X PATCH "https://api.remllo.com/api/v1/orgs/sla" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "critical": {
7    "triageMinutes": 15,
8    "investigationMinutes": 60,
9    "escalationMinutes": 30
10  },
11  "high": {
12    "triageMinutes": 30,
13    "investigationMinutes": 240,
14    "escalationMinutes": 120
15  },
16  "medium": {
17    "triageMinutes": 120,
18    "investigationMinutes": 1440,
19    "escalationMinutes": 480
20  },
21  "low": {
22    "triageMinutes": 240,
23    "investigationMinutes": 2880,
24    "escalationMinutes": 1440
25  }
26}'
Example Response
200 SLA updated.
{
  "message": "...",
  "slaConfig": {
    "critical": {
      "triageMinutes": 0,
      "investigationMinutes": 0,
      "escalationMinutes": 0
    },
    "high": {
      "triageMinutes": 0,
      "investigationMinutes": 0,
      "escalationMinutes": 0
    },
    "medium": {
      "triageMinutes": 0,
      "investigationMinutes": 0,
      "escalationMinutes": 0
    },
    "low": {
      "triageMinutes": 0,
      "investigationMinutes": 0,
      "escalationMinutes": 0
    }
  }
}
POST
/api/v1/orgs/members

Invite an organization member

Creates or links a user to the organization, generates an invite link if the user has not set a password yet, and assigns a role. For organizations with an email-domain policy, invited users must match the workspace domain unless a platform-admin support exception applies.

Authentication
sessionCookie
ADMIN

Request Body

application/json
objectRequired
firstNamestring
lastNamestring
emailstringRequired
rolestringRequired
ADMINRISK_LEADANALYSTVIEWER
1curl -X POST "https://api.remllo.com/api/v1/orgs/members" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "firstName": "...",
7  "lastName": "...",
8  "email": "ops@example.com",
9  "role": "ADMIN"
10}'
Example Response
200 Member invited or linked.
{
  "message": "...",
  "membership": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "role": "ADMIN",
    "userId": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "organizationId": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "createdAt": "2026-03-20T10:15:00.000Z",
    "updatedAt": "2026-03-20T10:15:00.000Z",
    "user": {
      "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
      "email": "...",
      "firstName": "...",
      "lastName": "...",
      "invitationPending": true
    }
  },
  "inviteUrl": "..."
}
PATCH
/api/v1/orgs/members/{membershipId}

Update a member role

Changes the role for an existing organization membership. Admin-only.

Authentication
sessionCookie
ADMIN

Parameters

membershipIdstringRequired

Request Body

application/json
objectRequired
rolestringRequired
ADMINRISK_LEADANALYSTVIEWER
1curl -X PATCH "https://api.remllo.com/api/v1/orgs/members/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "role": "ADMIN"
7}'
Example Response
200 Member role updated.
{
  "message": "...",
  "membership": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "role": "ADMIN",
    "userId": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "organizationId": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "createdAt": "2026-03-20T10:15:00.000Z",
    "updatedAt": "2026-03-20T10:15:00.000Z",
    "user": {
      "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
      "email": "...",
      "firstName": "...",
      "lastName": "...",
      "invitationPending": true
    }
  }
}
DELETE
/api/v1/orgs/members/{membershipId}

Remove an organization member

Removes organization access for a member while preserving historical records and audit references.

Authentication
sessionCookie
ADMIN

Parameters

membershipIdstringRequired
1curl -X DELETE "https://api.remllo.com/api/v1/orgs/members/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Member removed.
{
  "message": "..."
}
GET
/api/v1/orgs/audit-logs

List organization audit logs

Returns recent audit events for organization configuration, member management, and monitoring actions.

Authentication
sessionCookie
1curl -X GET "https://api.remllo.com/api/v1/orgs/audit-logs" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Audit logs returned.
{
  "data": [
    {}
  ]
}
POST
/api/v1/orgs/api-key/generate

Generate an ingestion API key

Creates the first organization ingestion API key and returns the raw value once.

Authentication
sessionCookie
ADMIN
1curl -X POST "https://api.remllo.com/api/v1/orgs/api-key/generate" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 API key generated.
{
  "apiKey": "...",
  "message": "..."
}
POST
/api/v1/orgs/api-key/rotate

Rotate the ingestion API key

Replaces the current organization API key and returns the new raw value once.

Authentication
sessionCookie
ADMIN
1curl -X POST "https://api.remllo.com/api/v1/orgs/api-key/rotate" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 API key rotated.
{
  "apiKey": "...",
  "message": "..."
}
DELETE
/api/v1/orgs/api-key

Revoke the ingestion API key

Deletes the current organization ingestion API key.

Authentication
sessionCookie
ADMIN
1curl -X DELETE "https://api.remllo.com/api/v1/orgs/api-key" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 API key revoked.
{
  "message": "..."
}
PATCH
/api/v1/orgs/allowed-ips

Set API key IP allowlist

Defines the IP addresses allowed to use the organization API key for transaction ingestion.

Authentication
sessionCookie
ADMIN

Request Body

application/json
objectRequired
allowedIpsarrayRequired
itemsstring
1curl -X PATCH "https://api.remllo.com/api/v1/orgs/allowed-ips" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "allowedIps": [
7    "..."
8  ]
9}'
Example Response
200 Allowed IP list updated.
{
  "message": "...",
  "allowedIps": [
    "..."
  ]
}
POST
/api/v1/orgs/webhook/rotate-secret

Rotate organization webhook secret

Rotates the signing secret used for outbound organization webhooks. Store the new secret securely; it is returned once.

Authentication
sessionCookie
ADMIN
1curl -X POST "https://api.remllo.com/api/v1/orgs/webhook/rotate-secret" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Webhook secret rotated.
{
  "success": true,
  "webhookSecret": "..."
}
PATCH
/api/v1/orgs/case-creation-policy

Update case creation policy

Configures when WatchTower should automatically create cases from alerts.

Authentication
sessionCookie
ADMINRISK_LEAD

Request Body

application/json
objectRequired
autoCreateCasesboolean
minimumSeverityinteger
1curl -X PATCH "https://api.remllo.com/api/v1/orgs/case-creation-policy" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "autoCreateCases": true,
7  "minimumSeverity": 0
8}'
Example Response
200 Case policy updated.
{
  "success": true,
  "data": {}
}
POST
/api/v1/orgs/members/{membershipId}/resend-invite

Resend member invite

Sends a new invitation email to a pending organization member.

Authentication
sessionCookie
ADMIN

Parameters

membershipIdstringRequired
1curl -X POST "https://api.remllo.com/api/v1/orgs/members/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/resend-invite" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Invite resent.
{
  "success": true,
  "inviteUrl": "..."
}
Resource

Transactions

Transaction ingestion and transaction monitoring retrieval APIs.

GET
/api/v1/transactions/adapters

List available ingestion adapters

Returns the supported source-specific transaction adapters and example payload contracts used to normalize institution payloads into the WatchTower canonical transaction model.

Authentication
sessionCookie
1curl -X GET "https://api.remllo.com/api/v1/transactions/adapters" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Adapter catalog returned.
{
  "success": true,
  "data": [
    {
      "key": "...",
      "aliases": [
        "..."
      ],
      "summary": "...",
      "description": "...",
      "supportedCategories": [
        "..."
      ],
      "examplePayload": {}
    }
  ]
}
POST
/api/v1/transactions

Ingest a transaction for real-time monitoring

Requires an organization ingestion API key in the `x-api-key` header and an `idempotency-key` header. Evaluates the transaction against the active monitoring controls and returns the risk decision immediately.

Authentication
apiKey

Parameters

x-api-keystringRequired
idempotency-keystringRequired

Request Body

application/json
objectRequired
idstringRequired
amountnumberRequired
currencystringRequired

ISO 4217 currency code. WatchTower normalizes accepted values to uppercase.

channelstringRequired
USSDPOSWEBMOBILETRANSFERATMCARDbank_transfercardussdmobile_money
transactionTypestring
DEBITCREDIT
transactionCategorystring
TRANSFERBILL_PAYMENTAIRTIMEMERCHANT_PAYMENTWALLET_TRANSFERCARD_PAYMENTCASH_INCASH_OUTOTHER
timestampstringRequired
paymentReferencestring
sessionIdstring
senderobjectRequired
namestringRequired
accountNumberstringRequired
bankCodestring
bankNamestring
phoneNumberstring
walletIdstring
bvnstring
ninstring
partyTypestring
BANK_ACCOUNTWALLETMERCHANTBILLERMOBILE_NUMBEROTHER
receiverobjectRequired
namestringRequired
accountNumberstringRequired
bankCodestring
bankNamestring
merchantIdstring
terminalIdstring
partyTypestring
BANK_ACCOUNTWALLETMERCHANTBILLERMOBILE_NUMBEROTHER
deviceobject
deviceIdstring
ipAddressstring
deviceTypestring
mobilewebpos
operatingSystemstring
networkProviderstring
locationstring
userAgentstring
behaviorobject
transactionsLast1Minnumber
transactionsLast5Minnumber
velocityScorenumber
newDeviceDetectedboolean
newIpDetectedboolean
accountAgeDaysnumber
monetaryContextobject

Optional cross-border monetary evidence. Legacy amount and currency remain required and must match source.

sourceobjectRequired
amountstringRequired

Positive plain decimal string using the currency minor-unit precision.

currencystringRequired

ISO 4217 currency code. WatchTower normalizes accepted values to uppercase.

destinationobject
amountstringRequired

Positive plain decimal string using the currency minor-unit precision.

currencystringRequired

ISO 4217 currency code. WatchTower normalizes accepted values to uppercase.

settlementobject
amountstringRequired

Positive plain decimal string using the currency minor-unit precision.

currencystringRequired

ISO 4217 currency code. WatchTower normalizes accepted values to uppercase.

feesarray
itemsobject
amountstringRequired

Non-negative plain decimal fee amount.

currencystringRequired

ISO 4217 currency code. WatchTower normalizes accepted values to uppercase.

typestring
TRANSFERFXNETWORKSERVICETAXOTHER
chargedTostring
SENDERRECEIVERSHAREDOTHER
fxobject
baseCurrencystringRequired

ISO 4217 currency code. WatchTower normalizes accepted values to uppercase.

quoteCurrencystringRequired

ISO 4217 currency code. WatchTower normalizes accepted values to uppercase.

ratestringRequired

Positive plain decimal exchange rate.

sourcestringRequired
PARTNER_EXECUTEDPARTNER_QUOTEDREFERENCEOTHER
quotedAtstring
referenceIdstring
cryptoobject

Optional chain-aware crypto transfer evidence. This is separate from party `walletId`, which is an internal customer or ledger identifier. At least one sender or beneficiary wallet address is required. Mainnet addresses are checked for direct exact matches in enabled official sanctions sources when the Crypto wallet screening add-on and international sanctions screening are both enabled.

blockchainstringRequired
BITCOINETHEREUMTRONSOLANABNB_SMART_CHAINPOLYGONARBITRUMOPTIMISMBASEAVALANCHE_C
networkstring
MAINNETTESTNET
assetSymbolstringRequired
assetAmountstringRequired

Positive plain decimal amount in the crypto asset.

fiatEquivalentobject
amountstringRequired
currencystringRequired

ISO 4217 currency code. WatchTower normalizes accepted values to uppercase.

rateSourcestring
quotedAtstring
tokenContractAddressstring
senderWalletAddressstring
beneficiaryWalletAddressstring
transactionHashstring
directionstringRequired
DEPOSITWITHDRAWALINTERNAL
senderWalletCustodystring
HOSTEDUNHOSTEDUNKNOWN
beneficiaryWalletCustodystring
HOSTEDUNHOSTEDUNKNOWN
originatorVaspIdstring
beneficiaryVaspIdstring
destinationTagstring
metadataobject
originCountrystring
destinationCountrystring
paymentRailstring
paymentPurposeCodestring
directionstring
INBOUNDOUTBOUNDINTERNALUNKNOWN
lifecycleStatusstring
INITIATEDAUTHORIZEDPENDINGCOMPLETEDFAILEDCANCELLEDREVERSEDREFUNDEDDISPUTEDCHARGEBACK
partnerEventIdstring
eventSequenceinteger
originalTransactionIdstring
senderIdstring
receiverIdstring
1curl -X POST "https://api.remllo.com/api/v1/transactions" \
2  -H "x-api-key: wt_your_org_key" \
3  -H "idempotency-key: 8d80a7b3-2e52-4d74-9f7f-f59f14b97f86" \
4  -H "Content-Type: application/json" \
5 \
6  -d '{
7  "id": "9c265af8-7dd8-43d4-a3b8-972d71e1fbf8",
8  "amount": 500000,
9  "currency": "NGN",
10  "channel": "WEB",
11  "transactionType": "DEBIT",
12  "timestamp": "2026-03-19T10:05:21.000Z",
13  "paymentReference": "WT-20260319-0001",
14  "sender": {
15    "name": "David Musa",
16    "accountNumber": "0123456789",
17    "bankCode": "058",
18    "bankName": "GTBank"
19  },
20  "receiver": {
21    "name": "Ibrahim Usman",
22    "accountNumber": "9876543210",
23    "bankCode": "044",
24    "bankName": "Access Bank"
25  },
26  "device": {
27    "deviceId": "web-4f2a",
28    "ipAddress": "102.89.3.10",
29    "deviceType": "web"
30  },
31  "behavior": {
32    "transactionsLast5Min": 9,
33    "velocityScore": 92,
34    "newDeviceDetected": true,
35    "accountAgeDays": 27
36  }
37}'
Example Response
200 Transaction evaluated.
{
  "transactionId": "123e4567-e89b-12d3-a456-426614174000",
  "decision": "CHALLENGE",
  "challengeType": "LIVENESS_CHECK",
  "remlloIdentityToken": "123e4567-e89b-12d3-a456-426614174000",
  "riskScore": 85,
  "triggeredRules": [
    {
      "ruleId": "RULE-1",
      "description": "High risk transaction based on velocity",
      "severity": 85
    }
  ],
  "evaluatedAt": "2026-03-19T10:05:22.000Z"
}
GET
/api/v1/transactions

List organization transactions

Returns paginated transactions for the active organization with attached alert assignment context where available.

Authentication
sessionCookie

Parameters

pageinteger
pageSizeinteger
1curl -X GET "https://api.remllo.com/api/v1/transactions" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Paginated transactions.
{
  "data": [
    {}
  ],
  "page": 0,
  "pageSize": 0,
  "total": 0
}
POST
/api/v1/transactions/adapters/{adapterKey}

Ingest a transaction through an adapter

Accepts a source-specific transaction payload and maps it into the WatchTower canonical transaction model before evaluation. Adapter details are published only when safe for customer use.

Authentication
apiKey

Parameters

adapterKeystringRequired
x-api-keystringRequired
idempotency-keystring

Request Body

application/json
objectRequired
1curl -X POST "https://api.remllo.com/api/v1/transactions/adapters/%7BadapterKey%7D" \
2  -H "x-api-key: wt_your_org_key" \
3  -H "idempotency-key: 8d80a7b3-2e52-4d74-9f7f-f59f14b97f86" \
4  -H "Content-Type: application/json" \
5
Example Response
200 Adapter transaction evaluated.
{
  "adapterKey": "...",
  "externalTransactionId": "...",
  "transactionId": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
  "decision": "...",
  "riskScore": 0
}
GET
/api/v1/transactions/stats

Get transaction monitoring stats

Returns 30-day aggregate monitoring metrics for the active organization.

Authentication
sessionCookie
1curl -X GET "https://api.remllo.com/api/v1/transactions/stats" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Transaction stats.
{
  "totalTransactions": 0,
  "fraudPrevented": 0,
  "flagRate": "..."
}
GET
/api/v1/transactions/{id}/narrative

Get or generate an alert narrative

Returns a stored narrative for a flagged transaction or generates one on demand when possible.

Authentication
sessionCookie

Parameters

idstringRequired
1curl -X GET "https://api.remllo.com/api/v1/transactions/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/narrative" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Narrative returned.
{
  "success": true,
  "narrative": "..."
}
GET
/api/v1/transactions/{id}/related-activity

Get related transaction activity

Returns nearby or related activity tied to the transaction customer, counterparty, device, or account context.

Authentication
sessionCookie

Parameters

idstringRequired
1curl -X GET "https://api.remllo.com/api/v1/transactions/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/related-activity" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Related activity returned.
{
  "success": true,
  "data": [
    {}
  ]
}
POST
/api/v1/transactions/challenge-events

Report challenge progress or cancellation

Requires an organization ingestion API key in the `x-api-key` header and an `idempotency-key` header. Records that an external verification has started or was cancelled. Cancellation is finalized using the organization fail-closed policy and produces the normal audit, analyst-case, and signed callback records.

Authentication
apiKey

Parameters

x-api-keystringRequired
idempotency-keystringRequired

Request Body

application/json
objectRequired
challengeIdstringRequired
challengeSecretstringRequired

The challenge.resolutionSecret returned during transaction evaluation.

statusstringRequired
IN_PROGRESSCANCELLED
providerstringRequired
verificationReferencestringRequired

Stable provider verification/session reference. It must match the final result.

failureClassificationstring

Required only when status is CANCELLED.

CUSTOMER_ABANDONEDAUTHORIZATION_DENIED
occurredAtstringRequired
1curl -X POST "https://api.remllo.com/api/v1/transactions/challenge-events" \
2  -H "x-api-key: wt_your_org_key" \
3  -H "idempotency-key: 8d80a7b3-2e52-4d74-9f7f-f59f14b97f86" \
4  -H "Content-Type: application/json" \
5 \
6  -d '{
7  "challengeId": "CHL-2026-7F3A92",
8  "challengeSecret": "tok_123e4567e89b12d3a456426614174000",
9  "status": "IN_PROGRESS",
10  "provider": "CUSTOMER_PROVIDER",
11  "verificationReference": "verify_82931",
12  "occurredAt": "2026-07-26T14:20:00.000Z"
13}'
Example Response
200 Challenge lifecycle updated successfully.
{
  "success": true,
  "challengeId": "...",
  "status": "IN_PROGRESS",
  "decision": "REVIEW",
  "transactionId": "...",
  "monitoringEventId": "...",
  "idempotent": true
}
POST
/api/v1/transactions/resolve-challenge

Resolve a suspended transaction challenge

Requires an organization ingestion API key in the `x-api-key` header and an `idempotency-key` header. Reports an evidence-backed external step-up result. WatchTower verifies tenant ownership and the challenge secret, re-evaluates current controls, applies the organization's approval and fail-closed policies, records the resulting decision, and queues the signed outcome callback. A passed verification can remain at REVIEW when analyst approval is required.

Authentication
apiKey

Parameters

x-api-keystringRequired
idempotency-keystringRequired

Request Body

application/json
objectRequired
challengeIdstringRequired
challengeSecretstringRequired

The challenge.resolutionSecret returned during evaluation.

statusstringRequired
PASSEDFAILEDINCONCLUSIVE
providerstringRequired
verificationReferencestringRequired
completedChecksarrayRequired
itemsstring
failureClassificationstring
evidenceReferencesarray
itemsobject
typestring
referencestring
summarystring
completedAtstringRequired
1curl -X POST "https://api.remllo.com/api/v1/transactions/resolve-challenge" \
2  -H "x-api-key: wt_your_org_key" \
3  -H "idempotency-key: 8d80a7b3-2e52-4d74-9f7f-f59f14b97f86" \
4  -H "Content-Type: application/json" \
5 \
6  -d '{
7  "challengeId": "CHL-2026-7F3A92",
8  "challengeSecret": "tok_123e4567e89b12d3a456426614174000",
9  "status": "PASSED",
10  "provider": "CUSTOMER_PROVIDER",
11  "verificationReference": "verify_82931",
12  "completedChecks": [
13    "LIVENESS"
14  ],
15  "completedAt": "2026-07-26T14:25:00.000Z"
16}'
Example Response
200 Challenge resolved successfully.
{
  "success": true,
  "challengeId": "...",
  "status": "...",
  "decision": "ALLOW",
  "postVerificationDecision": "ALLOW",
  "analystApprovalStatus": "NOT_REQUIRED",
  "transactionId": "...",
  "monitoringEventId": "...",
  "idempotent": true
}
Resource

CSV Imports

Upload, inspect, validate, process, retry, and audit CSV transaction imports.

GET
/api/v1/transactions/imports/mapping-profiles

List CSV mapping profiles

Returns saved CSV mapping profiles for the active organization.

Authentication
sessionCookie
ADMINRISK_LEADANALYST
1curl -X GET "https://api.remllo.com/api/v1/transactions/imports/mapping-profiles" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Mapping profiles returned.
{
  "success": true,
  "data": [
    {
      "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
      "name": "...",
      "sourceKey": "...",
      "headerSignature": "...",
      "delimiter": "...",
      "mappings": {},
      "sampleHeaders": [
        "..."
      ],
      "lastUsedAt": "2026-03-20T10:15:00.000Z"
    }
  ]
}
POST
/api/v1/transactions/imports/mapping-profiles

Create CSV mapping profile

Saves a reusable mapping from source CSV headers into the WatchTower transaction model.

Authentication
sessionCookie
ADMINRISK_LEADANALYST

Request Body

application/json
objectRequired
namestringRequired
headerSignaturestringRequired
delimiterstringRequired
sourceKeystring
sampleHeadersarray
itemsstring
mappingsobjectRequired
1curl -X POST "https://api.remllo.com/api/v1/transactions/imports/mapping-profiles" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "name": "...",
7  "headerSignature": "...",
8  "delimiter": ",",
9  "sourceKey": "...",
10  "sampleHeaders": [
11    "..."
12  ],
13  "mappings": {}
14}'
Example Response
201 Mapping profile created.
{
  "success": true,
  "data": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "name": "...",
    "sourceKey": "...",
    "headerSignature": "...",
    "delimiter": "...",
    "mappings": {},
    "sampleHeaders": [
      "..."
    ],
    "lastUsedAt": "2026-03-20T10:15:00.000Z"
  }
}
PATCH
/api/v1/transactions/imports/mapping-profiles/{id}

Update CSV mapping profile

Updates a saved CSV mapping profile.

Authentication
sessionCookie
ADMINRISK_LEADANALYST

Parameters

idstringRequired

Request Body

application/json
objectRequired
namestring
sourceKeystring
mappingsobject
1curl -X PATCH "https://api.remllo.com/api/v1/transactions/imports/mapping-profiles/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "name": "...",
7  "sourceKey": "...",
8  "mappings": {}
9}'
Example Response
200 Mapping profile updated.
{
  "success": true,
  "data": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "name": "...",
    "sourceKey": "...",
    "headerSignature": "...",
    "delimiter": "...",
    "mappings": {},
    "sampleHeaders": [
      "..."
    ],
    "lastUsedAt": "2026-03-20T10:15:00.000Z"
  }
}
DELETE
/api/v1/transactions/imports/mapping-profiles/{id}

Delete CSV mapping profile

Deletes a saved CSV mapping profile for the active organization.

Authentication
sessionCookie
ADMINRISK_LEAD

Parameters

idstringRequired
1curl -X DELETE "https://api.remllo.com/api/v1/transactions/imports/mapping-profiles/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Mapping profile deleted.
{
  "success": true
}
POST
/api/v1/transactions/imports/inspect

Inspect CSV upload

Uploads a CSV file for header detection, sample parsing, validation preview, and mapping-profile suggestions. The upload token returned by this endpoint is used to validate or create an import run.

Authentication
sessionCookie
ADMINRISK_LEADANALYST

Request Body

multipart/form-data
objectRequired
filestringRequired

CSV file to inspect.

sourceLabelstring

Optional source label for mapping suggestions.

delimiterstring
1curl -X POST "https://api.remllo.com/api/v1/transactions/imports/inspect" \
2  -H "Cookie: sessionToken=your_session_cookie" \
3  -F "file=@/path/to/file.csv" \
4  -F "sourceLabel=..." \
5  -F "delimiter=,"
Example Response
200 CSV inspected.
{
  "success": true,
  "uploadToken": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
  "headers": [
    "..."
  ],
  "sampleRows": [
    {}
  ],
  "suggestedMappingProfile": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "name": "...",
    "sourceKey": "...",
    "headerSignature": "...",
    "delimiter": "...",
    "mappings": {},
    "sampleHeaders": [
      "..."
    ],
    "lastUsedAt": "2026-03-20T10:15:00.000Z"
  }
}
POST
/api/v1/transactions/imports/validate

Validate CSV import

Validates a cached CSV upload and mapping without creating transactions.

Authentication
sessionCookie
ADMINRISK_LEADANALYST

Request Body

application/json
objectRequired
uploadTokenstringRequired
sourceLabelstring
mappingsobject
guardrailsobject
duplicateHandlingstring
SKIP_DUPLICATESBLOCK_IMPORT
maxInvalidRowsinteger
1curl -X POST "https://api.remllo.com/api/v1/transactions/imports/validate" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "uploadToken": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
7  "sourceLabel": "...",
8  "mappings": {},
9  "guardrails": {
10    "duplicateHandling": "SKIP_DUPLICATES",
11    "maxInvalidRows": 0
12  }
13}'
Example Response
200 Validation completed.
{
  "success": true,
  "data": {}
}
POST
/api/v1/transactions/imports/runs

Create CSV import run

Creates a CSV import run from a cached upload token. Imported rows are processed through the same monitoring pipeline as API-ingested transactions.

Authentication
sessionCookie
ADMINRISK_LEADANALYST

Request Body

application/json
objectRequired
uploadTokenstringRequired
sourceLabelstring
mappingProfileIdstring
mappingsobject
saveMappingProfileboolean
mappingProfileNamestring
1curl -X POST "https://api.remllo.com/api/v1/transactions/imports/runs" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "uploadToken": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
7  "sourceLabel": "...",
8  "mappingProfileId": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
9  "mappings": {},
10  "saveMappingProfile": true,
11  "mappingProfileName": "..."
12}'
Example Response
201 Import run created.
{
  "success": true,
  "data": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "sourceLabel": "...",
    "status": "PENDING",
    "totalRows": 0,
    "processedRows": 0,
    "validRows": 0,
    "invalidRows": 0,
    "duplicateRows": 0,
    "createdAt": "2026-03-20T10:15:00.000Z",
    "completedAt": "2026-03-20T10:15:00.000Z"
  }
}
GET
/api/v1/transactions/imports

List CSV import runs

Returns recent CSV import runs for the active organization.

Authentication
sessionCookie
ADMINRISK_LEADANALYST
1curl -X GET "https://api.remllo.com/api/v1/transactions/imports" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Import runs returned.
{
  "success": true,
  "data": [
    {
      "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
      "sourceLabel": "...",
      "status": "PENDING",
      "totalRows": 0,
      "processedRows": 0,
      "validRows": 0,
      "invalidRows": 0,
      "duplicateRows": 0,
      "createdAt": "2026-03-20T10:15:00.000Z",
      "completedAt": "2026-03-20T10:15:00.000Z"
    }
  ]
}
GET
/api/v1/transactions/imports/{id}

Get CSV import run

Returns CSV import run details, validation summary, and processing status.

Authentication
sessionCookie
ADMINRISK_LEADANALYST

Parameters

idstringRequired
1curl -X GET "https://api.remllo.com/api/v1/transactions/imports/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Import run returned.
{
  "success": true,
  "data": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "sourceLabel": "...",
    "status": "PENDING",
    "totalRows": 0,
    "processedRows": 0,
    "validRows": 0,
    "invalidRows": 0,
    "duplicateRows": 0,
    "createdAt": "2026-03-20T10:15:00.000Z",
    "completedAt": "2026-03-20T10:15:00.000Z"
  }
}
DELETE
/api/v1/transactions/imports/{id}

Delete CSV import run

Deletes an import run record where allowed by its current state.

Authentication
sessionCookie
ADMINRISK_LEAD

Parameters

idstringRequired
1curl -X DELETE "https://api.remllo.com/api/v1/transactions/imports/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Import run deleted.
{
  "success": true
}
POST
/api/v1/transactions/imports/{id}/cancel

Cancel CSV import run

Cancels a pending or processing CSV import run where cancellation is still safe.

Authentication
sessionCookie
ADMINRISK_LEAD

Parameters

idstringRequired
1curl -X POST "https://api.remllo.com/api/v1/transactions/imports/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/cancel" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Import run updated.
{
  "success": true,
  "data": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "sourceLabel": "...",
    "status": "PENDING",
    "totalRows": 0,
    "processedRows": 0,
    "validRows": 0,
    "invalidRows": 0,
    "duplicateRows": 0,
    "createdAt": "2026-03-20T10:15:00.000Z",
    "completedAt": "2026-03-20T10:15:00.000Z"
  }
}
POST
/api/v1/transactions/imports/{id}/retry

Retry CSV import run

Retries a failed or canceled CSV import run after correcting the issue.

Authentication
sessionCookie
ADMINRISK_LEAD

Parameters

idstringRequired
1curl -X POST "https://api.remllo.com/api/v1/transactions/imports/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/retry" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Import run updated.
{
  "success": true,
  "data": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "sourceLabel": "...",
    "status": "PENDING",
    "totalRows": 0,
    "processedRows": 0,
    "validRows": 0,
    "invalidRows": 0,
    "duplicateRows": 0,
    "createdAt": "2026-03-20T10:15:00.000Z",
    "completedAt": "2026-03-20T10:15:00.000Z"
  }
}
POST
/api/v1/transactions/imports/{id}/purge-payload

Purge CSV import payload

Deletes the stored raw CSV payload for an import run while retaining audit metadata.

Authentication
sessionCookie
ADMINRISK_LEAD

Parameters

idstringRequired
1curl -X POST "https://api.remllo.com/api/v1/transactions/imports/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/purge-payload" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Import run updated.
{
  "success": true,
  "data": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "sourceLabel": "...",
    "status": "PENDING",
    "totalRows": 0,
    "processedRows": 0,
    "validRows": 0,
    "invalidRows": 0,
    "duplicateRows": 0,
    "createdAt": "2026-03-20T10:15:00.000Z",
    "completedAt": "2026-03-20T10:15:00.000Z"
  }
}
Resource

Rules

Monitoring control catalog and custom rule lifecycle.

GET
/api/v1/rules/catalog

List built-in monitoring controls

Returns the built-in WatchTower rule catalog grouped by governance tier.

Authentication
sessionCookie
1curl -X GET "https://api.remllo.com/api/v1/rules/catalog" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Rule catalog returned.
{
  "success": true,
  "data": {}
}
GET
/api/v1/rules

List custom organization rules

Returns all organization-specific custom rules across draft, active, and inactive states.

Authentication
sessionCookie
1curl -X GET "https://api.remllo.com/api/v1/rules" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Rules returned.
{
  "success": true,
  "count": 0,
  "data": [
    {
      "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
      "name": "...",
      "description": "...",
      "severity": 0,
      "status": "DRAFT",
      "conditions": [
        {
          "field": "...",
          "operator": "gt",
          "value": "..."
        }
      ],
      "velocityCheck": {
        "field": "...",
        "windowSeconds": 0,
        "maxCount": 0
      },
      "createdAt": "2026-03-20T10:15:00.000Z"
    }
  ]
}
POST
/api/v1/rules

Create a draft rule

Creates a custom monitoring rule in draft state. Rules can later be activated through the rule status endpoint.

Authentication
sessionCookie
ADMINRISK_LEAD

Request Body

application/json
objectRequired
namestringRequired
descriptionstringRequired
severitynumberRequired
conditionsarrayRequired
itemsobject
fieldstring
operatorstring
gtgteltlteeqneqinnot_incontains
valueany
velocityCheckobject
fieldstring
windowSecondsnumber
maxCountnumber
1curl -X POST "https://api.remllo.com/api/v1/rules" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "name": "...",
7  "description": "...",
8  "severity": 0,
9  "conditions": [
10    {
11      "field": "...",
12      "operator": "gt",
13      "value": "..."
14    }
15  ],
16  "velocityCheck": {
17    "field": "...",
18    "windowSeconds": 0,
19    "maxCount": 0
20  }
21}'
Example Response
201 Draft rule created.
{
  "success": true,
  "data": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "name": "...",
    "description": "...",
    "severity": 0,
    "status": "DRAFT",
    "conditions": [
      {
        "field": "...",
        "operator": "gt",
        "value": "..."
      }
    ],
    "velocityCheck": {
      "field": "...",
      "windowSeconds": 0,
      "maxCount": 0
    },
    "createdAt": "2026-03-20T10:15:00.000Z"
  },
  "message": "..."
}
PATCH
/api/v1/rules/{id}/status

Change a rule lifecycle status

Moves a custom rule between draft, active, and inactive and hot-reloads the evaluation cache.

Authentication
sessionCookie
ADMINRISK_LEAD

Parameters

idstringRequired

Request Body

application/json
objectRequired
statusstringRequired
DRAFTACTIVEINACTIVE
1curl -X PATCH "https://api.remllo.com/api/v1/rules/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/status" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "status": "DRAFT"
7}'
Example Response
200 Rule status updated.
{
  "success": true,
  "data": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "name": "...",
    "description": "...",
    "severity": 0,
    "status": "DRAFT",
    "conditions": [
      {
        "field": "...",
        "operator": "gt",
        "value": "..."
      }
    ],
    "velocityCheck": {
      "field": "...",
      "windowSeconds": 0,
      "maxCount": 0
    },
    "createdAt": "2026-03-20T10:15:00.000Z"
  },
  "message": "..."
}
DELETE
/api/v1/rules/{id}

Delete a custom rule

Removes a custom rule permanently and hot-reloads the rule cache.

Authentication
sessionCookie
ADMIN

Parameters

idstringRequired
1curl -X DELETE "https://api.remllo.com/api/v1/rules/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Rule deleted.
{
  "success": true,
  "message": "..."
}
PATCH
/api/v1/rules/catalog/{id}/override

Override catalog control

Enables or disables an organization-specific override for a built-in monitoring control.

Authentication
sessionCookie
ADMIN

Parameters

idstringRequired

Request Body

application/json
objectRequired
enabledboolean
severityinteger
1curl -X PATCH "https://api.remllo.com/api/v1/rules/catalog/%7Bid%7D/override" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "enabled": true,
7  "severity": 0
8}'
Example Response
200 Control override updated.
{
  "success": true,
  "data": {}
}
Resource

Alerts

Alert inbox, status changes, and live alert streaming.

GET
/api/v1/alerts

List alerts

Returns the alert inbox for the active organization with transaction enrichment, assignees, and control attribution.

Authentication
sessionCookie

Parameters

statusstring
1curl -X GET "https://api.remllo.com/api/v1/alerts" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Alerts returned.
[
  {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "status": "OPEN",
    "narrative": "...",
    "assignedToId": "...",
    "assignedTo": {
      "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
      "firstName": "...",
      "lastName": "...",
      "email": "..."
    },
    "caseId": "...",
    "primaryControl": "...",
    "ruleFamily": "...",
    "triggeredControls": [
      "..."
    ],
    "controlCount": 0,
    "createdAt": "2026-03-20T10:15:00.000Z"
  }
]
PATCH
/api/v1/alerts/{id}

Update an alert status or assignee

Resolves, escalates, marks false positive, or reassigns an alert. Linked case workflow is synchronized when a case exists.

Authentication
sessionCookie
ADMINRISK_LEADANALYST

Parameters

idstringRequired

Request Body

application/json
objectRequired
statusstringRequired
OPENRESOLVEDESCALATEDFALSE_POSITIVE
notesstring
assignedToIdstring
outcomeReasonstring
outcomeContextstring
1curl -X PATCH "https://api.remllo.com/api/v1/alerts/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "status": "OPEN",
7  "notes": "...",
8  "assignedToId": "...",
9  "outcomeReason": "...",
10  "outcomeContext": "..."
11}'
Example Response
200 Alert updated.
{
  "success": true,
  "data": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "status": "OPEN",
    "narrative": "...",
    "assignedToId": "...",
    "assignedTo": {
      "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
      "firstName": "...",
      "lastName": "...",
      "email": "..."
    },
    "caseId": "...",
    "primaryControl": "...",
    "ruleFamily": "...",
    "triggeredControls": [
      "..."
    ],
    "controlCount": 0,
    "createdAt": "2026-03-20T10:15:00.000Z"
  }
}
GET
/api/v1/alerts/streaming

Open the alert SSE stream

Returns a server-sent events stream of alert updates for the active organization.

Authentication
sessionCookie
1curl -X GET "https://api.remllo.com/api/v1/alerts/streaming" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 SSE stream. Events are emitted as `data: { ... }` lines with heartbeat comments every 15 seconds.
"..."
POST
/api/v1/alerts/{id}/open-case

Open a case from an alert

Creates or links an investigation case from a specific alert.

Authentication
sessionCookie
ADMINRISK_LEADANALYST

Parameters

idstringRequired
1curl -X POST "https://api.remllo.com/api/v1/alerts/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/open-case" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
201 Case opened.
{
  "success": true,
  "data": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "caseReference": "CASE-10DB14A3",
    "title": "...",
    "description": "...",
    "primaryCustomer": "...",
    "riskScore": 0,
    "linkedAlerts": 0,
    "totalFlaggedValue": 0,
    "primaryControl": "...",
    "triggeredControls": [
      "..."
    ],
    "controlCount": 0,
    "status": "OPEN",
    "priority": "Critical",
    "assignee": {
      "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
      "firstName": "...",
      "lastName": "...",
      "email": "..."
    },
    "createdAt": "2026-03-20T10:15:00.000Z",
    "updatedAt": "2026-03-20T10:15:00.000Z"
  }
}
Resource

Cases

Case management, notes, attachments, and exports.

GET
/api/v1/cases

List cases

Returns the current case board/list with normalized case data for the active organization.

Authentication
sessionCookie
1curl -X GET "https://api.remllo.com/api/v1/cases" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Cases returned.
{
  "data": [
    {
      "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
      "caseReference": "CASE-10DB14A3",
      "title": "...",
      "description": "...",
      "primaryCustomer": "...",
      "riskScore": 0,
      "linkedAlerts": 0,
      "totalFlaggedValue": 0,
      "primaryControl": "...",
      "triggeredControls": [
        "..."
      ],
      "controlCount": 0,
      "status": "OPEN",
      "priority": "Critical",
      "assignee": {
        "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
        "firstName": "...",
        "lastName": "...",
        "email": "..."
      },
      "createdAt": "2026-03-20T10:15:00.000Z",
      "updatedAt": "2026-03-20T10:15:00.000Z"
    }
  ]
}
GET
/api/v1/cases/{id}

Get case detail

Returns an investigation case with alert, transaction, notes, events, and attachment context.

Authentication
sessionCookie

Parameters

idstringRequired
1curl -X GET "https://api.remllo.com/api/v1/cases/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Case detail returned.
{
  "data": {}
}
PATCH
/api/v1/cases/{id}

Update a case

Changes case status, assignment, priority, and disposition data. Status transitions are role-aware.

Authentication
sessionCookie
ADMINRISK_LEADANALYST

Parameters

idstringRequired

Request Body

application/json
objectRequired
statusstring
OPENINVESTIGATINGESCALATEDREOPENEDRESOLVEDFALSE_POSITIVE
prioritystring
CriticalHighMediumLow
assignedToIdstring
notesstring
outcomeReasonstring
outcomeContextstring
reopenReasonstring
1curl -X PATCH "https://api.remllo.com/api/v1/cases/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "status": "OPEN",
7  "priority": "Critical",
8  "assignedToId": "...",
9  "notes": "...",
10  "outcomeReason": "...",
11  "outcomeContext": "...",
12  "reopenReason": "..."
13}'
Example Response
200 Case updated.
{
  "success": true,
  "data": {}
}
POST
/api/v1/cases/{id}/notes

Add a case note

Adds a note or threaded reply to a case and optionally mentions other users.

Authentication
sessionCookie
ADMINRISK_LEADANALYST

Parameters

idstringRequired

Request Body

application/json
objectRequired
bodystringRequired
parentIdstring
mentionedUserIdsarray
itemsstring
1curl -X POST "https://api.remllo.com/api/v1/cases/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/notes" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "body": "...",
7  "parentId": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
8  "mentionedUserIds": [
9    "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27"
10  ]
11}'
Example Response
201 Case note created.
{
  "success": true,
  "data": {}
}
POST
/api/v1/cases/{id}/attachments

Add a case attachment

Adds metadata for an uploaded case attachment or evidence file.

Authentication
sessionCookie
ADMINRISK_LEADANALYST

Parameters

idstringRequired

Request Body

application/json
objectRequired
fileNamestringRequired
fileUrlstringRequired
contentTypestringRequired
notesstring
1curl -X POST "https://api.remllo.com/api/v1/cases/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/attachments" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "fileName": "...",
7  "fileUrl": "...",
8  "contentType": "...",
9  "notes": "..."
10}'
Example Response
201 Attachment recorded.
{
  "success": true,
  "data": {}
}
GET
/api/v1/cases/{id}/export

Export a case

Exports a case as JSON, CSV, or PDF depending on the requested format.

Authentication
sessionCookie

Parameters

idstringRequired
formatstring
jsoncsvpdf
1curl -X GET "https://api.remllo.com/api/v1/cases/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/export" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Export returned.
"..."
GET
/api/v1/cases/{id}/export/goaml

Export case in goAML format

Exports a case package formatted for goAML-style regulatory workflows where supported.

Authentication
sessionCookie
ADMINRISK_LEAD

Parameters

idstringRequired
1curl -X GET "https://api.remllo.com/api/v1/cases/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/export/goaml" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Export file returned.
{
  "success": true
}
GET
/api/v1/cases/{id}/attachments/{attachmentId}/download

Download case attachment

Downloads a case attachment if the current user has access to the case.

Authentication
sessionCookie

Parameters

idstringRequired
attachmentIdstringRequired
1curl -X GET "https://api.remllo.com/api/v1/cases/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/attachments/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/download" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Attachment file returned.
{
  "success": true
}
POST
/api/v1/cases/{id}/read-state

Update case read state

Marks case collaboration activity as seen by the current user.

Authentication
sessionCookie

Parameters

idstringRequired

Request Body

application/json
objectRequired
notesSeenAtstring
evidenceSeenAtstring
1curl -X POST "https://api.remllo.com/api/v1/cases/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/read-state" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "notesSeenAt": "2026-03-20T10:15:00.000Z",
7  "evidenceSeenAt": "2026-03-20T10:15:00.000Z"
8}'
Example Response
200 Read state updated.
{
  "success": true
}
GET
/api/v1/cases/{id}/export/goaml/validate

Validate goAML export readiness

Checks the case for missing regulatory data before XML generation.

Authentication
sessionCookie
ADMINRISK_LEADANALYST

Parameters

idstringRequired
1curl -X GET "https://api.remllo.com/api/v1/cases/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/export/goaml/validate" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Readiness result returned.
{}
PUT
/api/v1/cases/{id}/export/goaml/enrichment

Save missing goAML party data

Stores filing-specific enrichment without changing the underlying transaction evidence.

Authentication
sessionCookie
ADMINRISK_LEADANALYST

Parameters

idstringRequired

Request Body

application/json
objectRequired
1curl -X PUT "https://api.remllo.com/api/v1/cases/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/export/goaml/enrichment" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4
Example Response
200 Enrichment saved and readiness refreshed.
{
  "success": true
}
PUT
/api/v1/cases/{id}/export/goaml/context

Save goAML filing context

Stores reporting context used to prepare the case XML export.

Authentication
sessionCookie
ADMINRISK_LEADANALYST

Parameters

idstringRequired

Request Body

application/json
objectRequired
1curl -X PUT "https://api.remllo.com/api/v1/cases/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/export/goaml/context" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4
Example Response
200 Filing context saved and readiness refreshed.
{
  "success": true
}
Resource

Reports

Operational reporting and export endpoints.

GET
/api/v1/reports/overview

Get reporting overview

Returns the main operational reporting payload for dashboards, reports, control trends, analyst workload, and SLA views.

Authentication
sessionCookie

Parameters

daysinteger
startDatestring
endDatestring
directionstring
ruleFamilystring
channelstring
1curl -X GET "https://api.remllo.com/api/v1/reports/overview" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Report payload returned.
{
  "summary": {},
  "charts": {},
  "trendSeries": {
    "daily": [
      {
        "period": "...",
        "transactions": 0,
        "flagged": 0,
        "flaggedValue": 0
      }
    ],
    "weekly": [
      {
        "period": "...",
        "transactions": 0,
        "flagged": 0,
        "flaggedValue": 0
      }
    ]
  }
}
GET
/api/v1/reports/overview/export.csv

Export reporting overview as CSV

Exports the overview report sections as CSV for offline analysis.

Authentication
sessionCookie

Parameters

daysinteger
startDatestring
endDatestring
1curl -X GET "https://api.remllo.com/api/v1/reports/overview/export.csv" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 CSV export returned.
"..."
Resource

Notifications

Notification preferences, organization delivery channels, delivery audit, inbox items, and live updates.

GET
/api/v1/notifications/preferences

List current user notification preferences

Returns the current user email delivery preferences for supported WatchTower notification events. Unset preferences default to enabled.

Authentication
sessionCookie
1curl -X GET "https://api.remllo.com/api/v1/notifications/preferences" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Notification preferences returned.
{
  "success": true,
  "data": {
    "channelType": "EMAIL",
    "availableEventTypes": [
      "ALERT_CREATED",
      "CASE_ASSIGNED",
      "CASE_MENTIONED"
    ],
    "preferences": [
      {
        "eventType": "ALERT_CREATED",
        "channelType": "EMAIL",
        "enabled": true,
        "source": "default",
        "updatedAt": null
      },
      {
        "eventType": "CASE_STATUS_CHANGED",
        "channelType": "EMAIL",
        "enabled": false,
        "source": "user",
        "updatedAt": "2026-05-13T12:00:00.000Z"
      }
    ]
  }
}
PUT
/api/v1/notifications/preferences

Update current user notification preferences

Updates the current user email opt-in or opt-out settings for one or more WatchTower notification events.

Authentication
sessionCookie

Request Body

application/json
objectRequired
preferencesarrayRequired
itemsobject
eventTypestringRequired
ALERT_CREATEDALERT_ESCALATEDCASE_CREATEDCASE_ASSIGNEDCASE_STATUS_CHANGEDCASE_MENTIONEDINTEGRATION_FAILED
enabledbooleanRequired
1curl -X PUT "https://api.remllo.com/api/v1/notifications/preferences" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "preferences": [
7    {
8      "eventType": "CASE_STATUS_CHANGED",
9      "enabled": false
10    }
11  ]
12}'
Example Response
200 Notification preferences updated.
{
  "success": true,
  "data": {
    "availableEventTypes": [
      "ALERT_CREATED"
    ],
    "channelType": "EMAIL",
    "preferences": [
      {
        "eventType": "ALERT_CREATED",
        "channelType": "EMAIL",
        "enabled": true,
        "source": "default",
        "updatedAt": "2026-03-20T10:15:00.000Z"
      }
    ]
  }
}
GET
/api/v1/notifications

List notifications

Returns the recent notification inbox for the current user.

Authentication
sessionCookie
1curl -X GET "https://api.remllo.com/api/v1/notifications" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Notifications returned.
{
  "success": true,
  "unreadCount": 0,
  "data": [
    {
      "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
      "type": "...",
      "title": "...",
      "message": "...",
      "isRead": true,
      "recipientUserId": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
      "actorUser": {
        "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
        "firstName": "...",
        "lastName": "...",
        "email": "..."
      },
      "createdAt": "2026-03-20T10:15:00.000Z"
    }
  ]
}
PATCH
/api/v1/notifications/{id}/read

Mark a notification as read

Marks a single notification as read for the current user.

Authentication
sessionCookie

Parameters

idstringRequired
1curl -X PATCH "https://api.remllo.com/api/v1/notifications/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/read" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Notification updated.
{
  "success": true,
  "data": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "type": "...",
    "title": "...",
    "message": "...",
    "isRead": true,
    "recipientUserId": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "actorUser": {
      "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
      "firstName": "...",
      "lastName": "...",
      "email": "..."
    },
    "createdAt": "2026-03-20T10:15:00.000Z"
  }
}
POST
/api/v1/notifications/read-all

Mark all notifications as read

Marks all current-user notifications as read in the active organization.

Authentication
sessionCookie
1curl -X POST "https://api.remllo.com/api/v1/notifications/read-all" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Notifications updated.
{
  "success": true
}
GET
/api/v1/notifications/streaming

Open the workspace SSE stream

Returns a server-sent events stream of workspace changes and notifications relevant to the current user.

Authentication
sessionCookie
1curl -X GET "https://api.remllo.com/api/v1/notifications/streaming" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 SSE stream.
"..."
GET
/api/v1/notifications/settings

List notification routing settings

Returns organization-level notification channels, subscriptions, and routing settings.

Authentication
sessionCookie
ADMINRISK_LEAD
1curl -X GET "https://api.remllo.com/api/v1/notifications/settings" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Notification settings returned.
{
  "success": true,
  "data": {}
}
GET
/api/v1/notifications/deliveries

List notification deliveries

Returns delivery attempts for notification channels so teams can audit sent, skipped, and failed notifications.

Authentication
sessionCookie
ADMINRISK_LEAD

Parameters

statusstring
PENDINGSENTFAILEDSKIPPED
channelIdstring
eventTypestring
limitinteger
1curl -X GET "https://api.remllo.com/api/v1/notifications/deliveries" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Deliveries returned.
{
  "success": true,
  "data": [
    {
      "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
      "eventType": "...",
      "channelType": "...",
      "status": "PENDING",
      "attemptCount": 0,
      "lastAttemptAt": "2026-03-20T10:15:00.000Z",
      "createdAt": "2026-03-20T10:15:00.000Z"
    }
  ]
}
POST
/api/v1/notifications/channels

Create notification channel

Creates an organization-level notification channel such as email, Slack, Teams, or webhook routing.

Authentication
sessionCookie
ADMINRISK_LEAD

Request Body

application/json
objectRequired
typestringRequired
EMAILSLACKTEAMSWEBHOOK
namestringRequired
statusstring
ACTIVEPAUSEDDISABLED
routingEnabledboolean
minimumSeverityinteger
allowedEventTypesarray
itemsstring
configobject
subscriptionsarray
itemsobject
eventTypestring
rolestring
userIdstring
enabledboolean
minimumSeverityinteger
1curl -X POST "https://api.remllo.com/api/v1/notifications/channels" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "type": "EMAIL",
7  "name": "...",
8  "status": "ACTIVE",
9  "routingEnabled": true,
10  "minimumSeverity": 0,
11  "allowedEventTypes": [
12    "..."
13  ],
14  "config": {},
15  "subscriptions": [
16    {
17      "eventType": "...",
18      "role": "...",
19      "userId": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
20      "enabled": true,
21      "minimumSeverity": 0
22    }
23  ]
24}'
Example Response
201 Channel created.
{
  "success": true,
  "data": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "type": "EMAIL",
    "name": "...",
    "status": "ACTIVE",
    "routingEnabled": true,
    "minimumSeverity": 0,
    "allowedEventTypes": [
      "..."
    ],
    "createdAt": "2026-03-20T10:15:00.000Z",
    "updatedAt": "2026-03-20T10:15:00.000Z"
  }
}
PATCH
/api/v1/notifications/channels/{id}

Update notification channel

Updates channel status, routing, severity, allowed event types, or provider configuration.

Authentication
sessionCookie
ADMINRISK_LEAD

Parameters

idstringRequired

Request Body

application/json
objectRequired
typestring
EMAILSLACKTEAMSWEBHOOK
namestring
statusstring
ACTIVEPAUSEDDISABLED
routingEnabledboolean
minimumSeverityinteger
allowedEventTypesarray
itemsstring
configobject
1curl -X PATCH "https://api.remllo.com/api/v1/notifications/channels/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "type": "EMAIL",
7  "name": "...",
8  "status": "ACTIVE",
9  "routingEnabled": true,
10  "minimumSeverity": 0,
11  "allowedEventTypes": [
12    "..."
13  ],
14  "config": {}
15}'
Example Response
200 Channel updated.
{
  "success": true,
  "data": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "type": "EMAIL",
    "name": "...",
    "status": "ACTIVE",
    "routingEnabled": true,
    "minimumSeverity": 0,
    "allowedEventTypes": [
      "..."
    ],
    "createdAt": "2026-03-20T10:15:00.000Z",
    "updatedAt": "2026-03-20T10:15:00.000Z"
  }
}
DELETE
/api/v1/notifications/channels/{id}

Delete notification channel

Deletes an organization-level notification channel.

Authentication
sessionCookie
ADMINRISK_LEAD

Parameters

idstringRequired
1curl -X DELETE "https://api.remllo.com/api/v1/notifications/channels/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Channel deleted.
{
  "success": true
}
PUT
/api/v1/notifications/channels/{id}/subscriptions

Replace channel subscriptions

Replaces the event subscriptions for an organization-level notification channel.

Authentication
sessionCookie
ADMINRISK_LEAD

Parameters

idstringRequired

Request Body

application/json
objectRequired
subscriptionsarrayRequired
itemsobject
eventTypestring
rolestring
userIdstring
enabledboolean
minimumSeverityinteger
1curl -X PUT "https://api.remllo.com/api/v1/notifications/channels/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/subscriptions" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "subscriptions": [
7    {
8      "eventType": "...",
9      "role": "...",
10      "userId": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
11      "enabled": true,
12      "minimumSeverity": 0
13    }
14  ]
15}'
Example Response
200 Subscriptions updated.
{
  "success": true,
  "data": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "type": "EMAIL",
    "name": "...",
    "status": "ACTIVE",
    "routingEnabled": true,
    "minimumSeverity": 0,
    "allowedEventTypes": [
      "..."
    ],
    "createdAt": "2026-03-20T10:15:00.000Z",
    "updatedAt": "2026-03-20T10:15:00.000Z"
  }
}
Resource

AI

AI-assisted rule drafting and narrative generation.

POST
/api/v1/ai/rules/build

Generate a draft rule from natural language

Uses the AI rule builder to translate a natural-language monitoring scenario into a structured draft rule definition.

Request Body

application/json
objectRequired
promptstringRequired
1curl -X POST "https://api.remllo.com/api/v1/ai/rules/build" \
2  -H "Content-Type: application/json" \
3 \
4  -d '{
5  "prompt": "Flag outbound transfers above 250000 NGN when a sender makes more than 5 transfers in 10 minutes."
6}'
Example Response
200 AI-generated rule returned.
{
  "success": true,
  "rule": {
    "id": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
    "name": "...",
    "description": "...",
    "severity": 0,
    "status": "DRAFT",
    "conditions": [
      {
        "field": "...",
        "operator": "gt",
        "value": "..."
      }
    ],
    "velocityCheck": {
      "field": "...",
      "windowSeconds": 0,
      "maxCount": 0
    },
    "createdAt": "2026-03-20T10:15:00.000Z"
  },
  "message": "..."
}
POST
/api/v1/ai/narrative

Generate a narrative for a flagged transaction

Uses the AI narrative generator to produce an investigation or compliance narrative from flagged transaction data.

Request Body

application/json
objectRequired
transactionIdstringRequired
amountnumberRequired
currencystringRequired
senderIdstringRequired
receiverIdstringRequired
channelstringRequired
riskScorenumberRequired
decisionstringRequired
ALLOWREVIEWBLOCK
triggeredRulesarrayRequired
itemsobject
ruleIdstring
descriptionstring
severitynumber
behavioralSignalsarray
itemsobject
keystring
explanationstring
riskPointsnumber
anomalyReasonsarray
itemsstring
locationstring
ipAddressstring
isSimulationboolean
1curl -X POST "https://api.remllo.com/api/v1/ai/narrative" \
2  -H "Content-Type: application/json" \
3 \
4  -d '{
5  "transactionId": "6ef1b19e-245a-42f7-bbf2-c91f0cbdde27",
6  "amount": 0,
7  "currency": "...",
8  "senderId": "...",
9  "receiverId": "...",
10  "channel": "...",
11  "riskScore": 0,
12  "decision": "ALLOW",
13  "triggeredRules": [
14    {
15      "ruleId": "...",
16      "description": "...",
17      "severity": 0
18    }
19  ],
20  "behavioralSignals": [
21    {
22      "key": "...",
23      "explanation": "...",
24      "riskPoints": 0
25    }
26  ],
27  "anomalyReasons": [
28    "..."
29  ],
30  "location": "...",
31  "ipAddress": "...",
32  "isSimulation": true
33}'
Example Response
200 Narrative returned.
{
  "success": true,
  "narrative": "..."
}
Resource

Regulatory Filings

Generated goAML filing records, downloads, and submission status tracking.

GET
/api/v1/regulatory-filings

List regulatory filings

Returns generated filing records for the active organization.

Authentication
sessionCookie
ADMINRISK_LEADANALYST
1curl -X GET "https://api.remllo.com/api/v1/regulatory-filings" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 Filing records returned.
{}
GET
/api/v1/regulatory-filings/{id}/download

Download a filing XML version

Returns the preserved XML for a generated filing record.

Authentication
sessionCookie
ADMINRISK_LEADANALYST

Parameters

idstringRequired
1curl -X GET "https://api.remllo.com/api/v1/regulatory-filings/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/download" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie"
Example Response
200 XML file returned.
{
  "success": true
}
PATCH
/api/v1/regulatory-filings/{id}/status

Update filing submission status

Records the external submission or regulator-portal result for a generated filing.

Authentication
sessionCookie
ADMINRISK_LEAD

Parameters

idstringRequired

Request Body

application/json
objectRequired
statusstringRequired
GENERATEDSUBMITTEDACCEPTEDREJECTED
statusNotestring
1curl -X PATCH "https://api.remllo.com/api/v1/regulatory-filings/6ef1b19e-245a-42f7-bbf2-c91f0cbdde27/status" \
2  -H "Content-Type: application/json" \
3  -H "Cookie: sessionToken=your_session_cookie" \
4 \
5  -d '{
6  "status": "GENERATED",
7  "statusNote": "..."
8}'
Example Response
200 Filing status updated.
{
  "success": true
}
Outbound events

Signed callbacks

WatchTower sends these events to the callback URL configured for your integration. Verify the signature before processing the payload and acknowledge accepted events with a 2xx response.

POSTtransaction.review_outcome

Final analyst review outcome (WatchTower calls you)

Sent after an analyst resolves a `REVIEW` payment in the console. WatchTower POSTs this to the callback URL registered for your integration so your payment flow can release or stop the held payment automatically. Signed with HMAC-SHA256 and retried with backoff until you return 2xx.

Example payload
{
  "event_type": "transaction.review_outcome",
  "description": "Transaction review outcome updated",
  "transactionReference": "INV-2026-0921",
  "customerId": "biz_44120",
  "status": "approved",
  "decision": "ALLOW",
  "callback_reference": "whd_1721817600_ab12cd3",
  "sent_at": "2026-07-24T14:05:00.000Z"
}
POSTtransaction.challenge.resolved

Challenge resolution confirmation (WatchTower calls you)

Sent when a `CHALLENGE` verification is resolved. If analyst approval is configured, a passed verification first reports REVIEW while the payment remains held, then a separate callback reports the analyst-approved ALLOW or BLOCK. Each callback has its own idempotency reference and is signed and retried like all callbacks.

Example payload
{
  "event_type": "transaction.challenge.resolved",
  "challengeId": "CHL-2026-7F3A92",
  "transactionId": "INV-2026-0921",
  "challengeStatus": "PASSED",
  "decision": "REVIEW",
  "postVerificationDecision": "ALLOW",
  "analystApprovalRequired": true,
  "analystApprovalStatus": "PENDING",
  "outcomeSource": "CUSTOMER_ATTESTED",
  "completedChecks": [
    "LIVENESS"
  ],
  "failureClassification": null,
  "callback_reference": "whd_challenge_778ffae5819991d47bf4dd12",
  "sent_at": "2026-07-24T12:03:00.000Z"
}