{ "info": { "_postman_id": "oilflow-compliance-api", "name": "OilFlow Compliance API", "description": "Generated from platform/public/openapi.yaml. Set `api_key` to your sandbox (https://oilflow.us/sandbox) or production key. `base_url` defaults to https://oilflow.us.", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" }, "item": [ { "name": "Regulatory Matrix API", "description": "SKU", "item": [ { "name": "List all 235 jurisdictions in the regulatory matrix", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/regulatory/countries", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "regulatory", "countries" ] }, "description": "List all 235 jurisdictions in the regulatory matrix" } }, { "name": "Get single jurisdiction by slug", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/regulatory/countries/:slug", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "regulatory", "countries", ":slug" ] }, "description": "Get single jurisdiction by slug" } }, { "name": "Check if a product is tradeable between counterparties", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/regulatory/check?country=Saudi%20Arabia&product=crude&listing_type=demand", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "regulatory", "check" ], "query": [ { "key": "country", "value": "Saudi Arabia" }, { "key": "product", "value": "crude" }, { "key": "listing_type", "value": "demand" } ] }, "description": "Check if a product is tradeable between counterparties" } }, { "name": "List product categories supported by the matrix", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/regulatory/products", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "regulatory", "products" ] }, "description": "List product categories supported by the matrix" } } ] }, { "name": "Counterparty KYC-as-API", "description": "SKU", "item": [ { "name": "Screen a counterparty for sanctions, scam-cluster, and regulatory risk", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/kyc/screen", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "kyc", "screen" ] }, "description": "Screen a counterparty for sanctions, scam-cluster, and regulatory risk", "body": { "mode": "raw", "raw": "{\n \"company_name\": \"Acme Trading FZE\",\n \"country\": \"UAE\",\n \"directors\": [\n \"John Doe\"\n ]\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Queue an asynchronous re-screen of a previously registered entity", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/kyc/rescreen", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "kyc", "rescreen" ] }, "description": "Triggers an out-of-band re-run of the 7-step KYC pipeline for a\npreviously registered `kyc_dossiers` row. Returns `202` with a\n`screening_run_id`. Subscribe to the `kyc.rescreen_completed`\nwebhook event (and `kyc.match_detected` on a hit) to receive the\noutcome asynchronously.\n", "body": { "mode": "raw", "raw": "{\n \"entity_id\": \"00000000-0000-0000-0000-000000000001\"\n}", "options": { "raw": { "language": "json" } } } } } ] }, { "name": "Scam Cluster Intelligence Feed", "description": "SKU", "item": [ { "name": "List verified-fraudulent counterparty clusters", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/clusters?severity=confirmed", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "clusters" ], "query": [ { "key": "severity", "value": "confirmed" } ] }, "description": "List verified-fraudulent counterparty clusters" } }, { "name": "Cluster network graph (nodes + edges) for a teardown group or entity", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/clusters/:slug/graph", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "clusters", ":slug", "graph" ] }, "description": "Machine-readable network model of a cluster, built live from the\ncorpus: curated teardown-group membership plus deterministic\nshared-alias links (no inferred edges). `slug` accepts a teardown\ngroup slug (e.g. `simar-chahal-cluster`) or a single entity slug as\nreturned by `/api/v1/clusters`. The same model renders the public\nteardown-page graph. 404 when the slug resolves to no linked\nnetwork \u2014 a single unlinked row is not a graph.\n\nThe response also carries `sanctions_network`: OFAC's own\n`Linked To:` remarks for the entity, quoted verbatim with the\nsource `entity_id`. It is populated only when the entity is\nitself on a sanctions list, and only from first-party US\nConsolidated Screening List text \u2014 inferred links (shared\naddress, shared identifier) are never published.\n\nRead `sanctions_network.coverage` before treating an empty\n`members` array as a finding:\n\n * `available` links found and returned\n * `no_links_recorded` screened against a populated snapshot; it\n records none (a real negative)\n * `not_screened` this cluster record is not sourced from a\n sanctions list, so none was attempted. A\n statement about our record, NOT a\n determination that the entity is unlisted\n * `withheld` links exist but are withheld under our\n protected-entity policy\n * `unavailable` the lookup did not complete, or the local\n screening snapshot was empty (nothing to\n search)\n\n`sanctions_network.degraded` is true for `unavailable` only.\nWhen it is true, absence is NOT evidence of absence and the\nresult must not be recorded as a clean screen.\n\n`sanctions_network.stale_hours` is non-null when the local\nscreening snapshot is older than 48 hours. Designations made\nsince then are not reflected. This qualifies a result rather\nthan withholding it, because stale rows still yield true\npositives.\n\nMembers are confirmed against OFAC's `Linked To:` target by\nexact normalized name, not by substring: a designation whose\ncaption merely begins with the queried name is excluded.\n" } }, { "name": "Check if a specific entity matches the cluster blocklist", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/clusters/check?entity=Simar%20Chahal", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "clusters", "check" ], "query": [ { "key": "entity", "value": "Simar Chahal" } ] }, "description": "Check if a specific entity matches the cluster blocklist" } }, { "name": "Submit a counterparty pitch for OilFlow investigation (cluster contribution flow)", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/clusters/submit", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "clusters", "submit" ] }, "description": "Customer-contribution surface for SKU #3. Authenticated customers\nreport a counterparty pitch they were approached with. Submission\nlands in `cluster_submissions` with `triage_status='pending'`.\nOperator triages within 72 hours; confirmed cases enter\n`broker_scam_blocklist` with provenance attribution to OilFlow's\nnamed investigator (submitter is never named in the public record).\nSubmission is licensed exclusively to OilFlow per Terms \u00a7 18 / \u00a7 3A.\nRate limit: 5 req/min per API key + 50 submissions/24h per submitter\nemail. Min `pitch_summary` length 40 chars.\n", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } } }, { "name": "Check the triage status of a previously submitted cluster contribution", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/clusters/submissions/:request_id", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "clusters", "submissions", ":request_id" ] }, "description": "Check the triage status of a previously submitted cluster contribution" } }, { "name": "Public anon mirror of /api/v1/clusters/submit (no auth)", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/public/clusters/submit", "host": [ "{{base_url}}" ], "path": [ "api", "public", "clusters", "submit" ] }, "description": "Same writer + same TOS licensing as the auth-gated endpoint, but\ngated by IP rate-limit (5 req/min) + per-submitter daily cap\n(50/24h) + honeypot. For journalists, victims, compliance officers\nwho don't have an OilFlow API key.\n", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } } } ] }, { "name": "Webhooks", "description": "Cross-SKU outbound webhook subscriptions, event queue, and DLQ replay.", "item": [ { "name": "List your active webhook subscriptions", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/webhooks", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "webhooks" ] }, "description": "List your active webhook subscriptions" } }, { "name": "Create a webhook subscription", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/webhooks", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "webhooks" ] }, "description": "On success the response contains the HMAC signing secret \u2014 store it,\nit will not be shown again. Rotation requires DELETE + POST.\n", "body": { "mode": "raw", "raw": "{\n \"url\": \"https://hooks.example.com/oilflow\",\n \"events\": [\n \"kyc.match_detected\",\n \"cluster.entity_severity_changed\"\n ],\n \"description\": \"Compliance war-room channel\",\n \"delivery_format\": \"raw\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Deactivate a subscription", "request": { "method": "DELETE", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/webhooks/:id", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "webhooks", ":id" ] }, "description": "Deactivate a subscription" } }, { "name": "Browse recent webhook delivery attempts", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/webhooks/events", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "webhooks", "events" ] }, "description": "Browse recent webhook delivery attempts" } }, { "name": "Replay a DLQ'd webhook event", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/webhooks/events/:id/replay", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "webhooks", "events", ":id", "replay" ] }, "description": "Re-queues a `dlq` event back to `pending` with attempt count reset.\nOnly `dlq` rows are replayable.\n", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } } } ] }, { "name": "Regulator Reports", "description": "Six regulator-ready report templates (FinCEN SAR, FATF Rec 10, FCA SYSC 6.3, MAS Notice 626, OFSI Annual, FFIEC BSA).", "item": [ { "name": "List available regulator templates", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/reports", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "reports" ] }, "description": "List available regulator templates" } }, { "name": "Generate a regulator-ready report", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/reports", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "reports" ] }, "description": "Pulls KYC dossier + sanctions screening + verification log evidence\nand renders an HTML artifact (PDF rendering happens out-of-band).\nThe response includes a 10-minute signed download URL.\n", "body": { "mode": "raw", "raw": "{\n \"entity_id\": \"00000000-0000-0000-0000-000000000001\",\n \"template_id\": \"fatf_rec10\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Fetch a generated report", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/reports/:id", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "reports", ":id" ] }, "description": "Fetch a generated report" } }, { "name": "JSON evidence trail for a report", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/reports/:id/audit", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "reports", ":id", "audit" ] }, "description": "Returns `evidence_json` \u2014 the map of report fields to underlying\n`verification_log` and `compliance_checks` (sanctions rows carry\n`check_type='sanctions_screening'`) row IDs. Banks present this to regulators\nwhen asked to substantiate prefilled answers.\n" } } ] }, { "name": "Adverse Media", "description": "Adverse-media monitoring list for registered entities. No adverse-media source has returned a finding yet.", "item": [ { "name": "List monitored entities", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/adverse-media/entities", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "adverse-media", "entities" ] }, "description": "List monitored entities" } }, { "name": "Add an entity to the adverse-media monitoring list", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/adverse-media/entities", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "adverse-media", "entities" ] }, "description": "Add an entity to the adverse-media monitoring list", "body": { "mode": "raw", "raw": "{\n \"entity_name\": \"Acme Trading FZE\",\n \"aliases\": [\n \"Acme FZE\"\n ],\n \"languages\": [\n \"en\",\n \"ar\"\n ],\n \"jurisdictions\": [\n \"UAE\"\n ]\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Pause monitoring on an entity", "request": { "method": "DELETE", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/adverse-media/entities/:id", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "adverse-media", "entities", ":id" ] }, "description": "Pause monitoring on an entity" } }, { "name": "List adverse media findings", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/adverse-media/findings", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "adverse-media", "findings" ] }, "description": "List adverse media findings" } } ] }, { "name": "UBO Graph", "description": "Beneficial-owner traversal + shell-detection across OpenCorporates and national registries.", "item": [ { "name": "Build (or fetch cached) beneficial-owner graph for an entity", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/ubo/screen", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "ubo", "screen" ] }, "description": "Returns the cached graph immediately on hit (within 90-day TTL); on\ncache miss inserts a queued row and returns `202` with the\n`graph_id`. The Python worker drains queued rows asynchronously.\n", "body": { "mode": "raw", "raw": "{\n \"root_entity_name\": \"Acme Holdings Ltd\",\n \"root_jurisdiction\": \"BVI\"\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Fetch a UBO graph by id", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/ubo/graph/:id", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "ubo", "graph", ":id" ] }, "description": "Fetch a UBO graph by id" } } ] }, { "name": "LC Validation", "description": "UCP 600 discrepancy engine for Letter of Credit + invoice + Bill of Lading bundles.", "item": [ { "name": "Run UCP 600 rule engine against an LC + invoice + Bill of Lading", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/lc/validate", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "lc", "validate" ] }, "description": "Pass structured extracted fields (the bank's OCR / MT700 parser is\nthe source). Returns a discrepancy report with aggregated severity\nand a `honor | inquiry | refuse` recommendation.\n", "body": { "mode": "raw", "raw": "{\n \"lc\": {\n \"amount\": 1000000,\n \"currency\": \"USD\",\n \"beneficiary\": \"Acme Trading FZE\",\n \"port_of_loading\": \"Fujairah\",\n \"expiry_date\": \"2026-07-15\"\n },\n \"invoice\": {\n \"total_amount\": 1000000,\n \"currency\": \"USD\",\n \"seller_name\": \"Acme Trading FZE\",\n \"presentation_date\": \"2026-06-15\"\n },\n \"bl\": {\n \"currency\": \"USD\",\n \"port_of_loading\": \"Fujairah\",\n \"issue_date\": \"2026-06-01\",\n \"shipped_on_board\": true\n }\n}", "options": { "raw": { "language": "json" } } } } }, { "name": "Fetch a past LC validation run", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/lc/reports/:id", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "lc", "reports", ":id" ] }, "description": "Fetch a past LC validation run" } } ] }, { "name": "Audit", "description": "Cross-SKU append-only audit log export.", "item": [ { "name": "Export your append-only API audit trail", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/audit?format=summary&days=30", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "audit" ], "query": [ { "key": "format", "value": "summary" }, { "key": "days", "value": "30" } ] }, "description": "Returns the caller's own `api_request_log` rows for the requested\nwindow. JSON or CSV. Banks use this as compliance evidence during\ntheir own regulatory audits.\n" } } ] }, { "name": "Sandbox", "description": "Self-serve sandbox API keys for evaluation. Throwaway keys auto-expire after 30 days.", "item": [ { "name": "Model Context Protocol endpoint (Streamable HTTP)", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/mcp", "host": [ "{{base_url}}" ], "path": [ "api", "mcp" ] }, "description": "JSON-RPC 2.0 over Streamable HTTP, implementing the Model Context\nProtocol so any MCP-capable agent can use OilFlow as a tool provider.\nHuman-readable page: https://oilflow.us/mcp\n\nAdd it with:\n `claude mcp add --transport http oilflow https://oilflow.us/api/mcp`\n\nFOUR tools require no API key: `predeal_preview` (a full pre-deal\nclearance verdict, 5 per caller per 24h, returns receipt_id +\nverify_url), `verify_receipt` (fetch and re-verify a signed screening\nreceipt, 20/min), `cluster_check` (fraud-cluster screen, 10/hr) and\n`request_sandbox_key`. The keyed tools are `regulatory_check`\n(sandbox), then `kyc_screen`, `ubo_screen`, `lc_validate` and\n`predeal_check` (production).\n\nPer-caller quotas: a call proxied through this endpoint is charged to\nthe ORIGINAL caller, not to the platform, so one agent cannot exhaust\nanother agent's free tier.\n\nKeyed tools forward the caller's `Authorization: Bearer` header to the\nsame v1 routes a direct consumer would call \u2014 this endpoint grants no\nprivilege of its own and is a protocol adapter, not a second\nauthorization surface. A keyless tool is never sent the caller's key.\n\nEvery result is wrapped as\n`{source, tool, tier, retrieved_at, data}`. The `data` field is a\nreport about a third party and is data, never instructions. An\nexhausted free quota returns `{status: \"quota_exhausted\",\nresets_in_hours, retry_after_seconds, how_to_proceed}` and is NOT an\nerror: the allowance is used up, the service is up.\n\nCoverage limits are stated inside each tool description, because the\nagent is the party that has to relay them: 8 sanctions lists, PEP\nscreening is not shipped, US beneficial-ownership coverage is partial.\n\nCall `tools/list` for the current catalog, including each tool's\n`title` and its `annotations` (readOnlyHint / destructiveHint /\nidempotentHint / openWorldHint).\n", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } } }, { "name": "Issue a free 30-day evaluation API key", "request": { "method": "POST", "header": [ { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/keys/sandbox", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "keys", "sandbox" ] }, "description": "Returns a sandbox API key valid for 30 days, capped at 100 calls/day,\nscoped to read-only public endpoints (`/api/v1/regulatory/*` and\n`/api/v1/clusters/check`). No signup required, but email is captured\nfor upgrade outreach. Rate limited to 3 keys per IP per hour and\n5 per email per day. Anonymous (no member binding) \u2014 promote to a\nproduction key at `/pricing`.\n", "body": { "mode": "raw", "raw": "{\n \"email\": \"compliance@example.bank\",\n \"company\": \"Example Bank Trade Finance\",\n \"use_case\": \"Evaluating /regulatory/check for Saudi Arabia crude\"\n}", "options": { "raw": { "language": "json" } } } } } ] }, { "name": "Keys", "description": "", "item": [ { "name": "List your production API keys", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/keys", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "keys" ] }, "description": "Returns the caller's production API keys with metadata\n(last_used_at, scopes, environment, expires_at). Secret values\nare never returned after issuance.\n" } }, { "name": "Create a production API key", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/keys", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "keys" ] }, "description": "Issues a new production API key. The raw key is shown once on\ncreation \u2014 store it immediately. Scopes default to the member's\nplan entitlements; pass `scopes` to narrow further.\n", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } } }, { "name": "Revoke a production API key", "request": { "method": "DELETE", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/keys", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "keys" ] }, "description": "Soft-deletes the key. In-flight requests using it begin failing immediately." } } ] }, { "name": "Watchlists", "description": "", "item": [ { "name": "Fetch a watchlist with sample entries and recent matches", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/watchlists/:id", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "watchlists", ":id" ] }, "description": "Returns the watchlist metadata, the first 25 entries (for\nverification), and the 50 most recent match-log entries.\n" } }, { "name": "Delete a watchlist", "request": { "method": "DELETE", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/watchlists/:id", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "watchlists", ":id" ] }, "description": "Soft-deletes the watchlist. The daily sync agent skips it on next run." } } ] }, { "name": "Pre-Deal Copilot", "description": "SKU", "item": [ { "name": "Sub-30s pre-deal clearance verdict + restructure suggestion", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/predeal/check", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "predeal", "check" ] }, "description": "The front-office surface. Paste a proposed deal description and\nget back a clearance probability + verdict tier (clear/review/\nheavy_friction/block), the blockers that drove the verdict, and a\nClaude-drafted restructure suggestion in front-office lexicon.\n\nFive primitives run in parallel under the hood: cluster blocklist\nlookup (exact + alias), regulatory tradability (origin + destination),\nadverse media (reported as unmeasured until a source returns a row),\nsanctions entity name-match,\nverified-counterparty profile lookup. Plus the intelligence layer:\ntime-to-clearance, bank-of-record suggestion, regulator-proximity.\n\nEvery call writes a row to the `predeal_checks` decision ledger and\nreturns that row's id as `receipt_id`. A publicly verifiable receipt\nalso returns a keyless `verify_url`\n(`https://oilflow.us/api/public/verify/`) that anyone can\nfetch to get the HMAC-signed record of the verdict;\n`receipt_visibility` says which case you got.\nSet `X-OilFlow-Data-Class: private` to keep the row out of\ncross-customer aggregations (Bank Enterprise default), and\n`X-OilFlow-Receipt-Visibility` to decide separately whether a stranger\nholding the id may fetch the receipt.\n", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } } }, { "name": "60-second counterparty pulse (cluster + adverse media + sanctions + history)", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/predeal/pulse/:entity", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "predeal", "pulse", ":entity" ] }, "description": "60-second counterparty pulse (cluster + adverse media + sanctions + history)" } }, { "name": "Mine the decision ledger corpus for analogous deals", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/predeal/precedents", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "predeal", "precedents" ] }, "description": "Mine the decision ledger corpus for analogous deals" } }, { "name": "Generate three Claude-ranked restructure candidates for a flagged deal", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/predeal/restructure", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "predeal", "restructure" ] }, "description": "Generate three Claude-ranked restructure candidates for a flagged deal", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } } }, { "name": "Draft counter-language in 5 languages, 2 tones", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/predeal/negotiate", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "predeal", "negotiate" ] }, "description": "Draft counter-language in 5 languages, 2 tones", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } } }, { "name": "RM personal decision history + calibration stats", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/predeal/history", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "predeal", "history" ] }, "description": "RM personal decision history + calibration stats" } } ] }, { "name": "Defense Ledger", "description": "SKU", "item": [ { "name": "Generate a regulator-grade defense pack from a Pre-Deal verdict or KYC screen", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/defense/generate", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "defense", "generate" ] }, "description": "Aggregates evidence_reviewed + blockers_at_decision +\nalternatives_considered + peer_context (last 180 days, same\ncounterparty, aggregable only) + regulatory_context, then calls\nClaude Opus for a 200-400 word narrative. Stored in `defense_packs`\nwith `signoff_status='draft'`. Provide either `predeal_check_id`\n(live) or `kyc_request_id` (live as of 2026-06-08).\n", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } } }, { "name": "MLRO sign-off with SHA-256 cryptographic binding", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/defense/:request_id/sign", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "defense", ":request_id", "sign" ] }, "description": "Binds the defense pack to a regulated individual (MLRO / Compliance\nOfficer) via attestation. Computes a SHA-256 hash over the\ncanonical-JSON serialization of evidence_pack + narrative +\ndecision + decision_basis_summary + counterparty_normalized +\nsignoff_by + signoff_at + signoff_attestation. Hash stored on\nthe row alongside the algo + ordered input list. Subsequent\nmodification of any hashed field breaks the binding and is\ndetectable via the /verify endpoint. The canonicalization\nalgorithm is published at\n/products/defense-ledger/verification.\n\nRescind: POST the same endpoint with `attestation: \"RESCIND - ...\"`.\nOriginal signoff_hash + signoff_by + signoff_at are preserved.\n", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } } }, { "name": "Recompute the canonical hash from the live row + compare to stored signoff_hash", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/defense/:request_id/verify", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "defense", ":request_id", "verify" ] }, "description": "Independent tamper-evidence check. Returns `hash_match: true` when\nthe recomputed digest equals the stored signoff_hash. Returns\n`hash_match: false` when evidence_pack / narrative / decision /\nsignoff_* fields have been modified after the original sign. A\nregulator can recompute the SHA-256 from raw row data using the\npublished canonicalization algorithm rather than relying on this\nendpoint. A match is an internal consistency check: the pack\nmatches its stored canonical rows. It does not prove the rows were\nnot rewritten.\n" } }, { "name": "Return the canonical hashable payload + stored hash for an independent recompute", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/defense/:request_id/raw", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "defense", ":request_id", "raw" ] }, "description": "Closes the last trust-on-OilFlow gap in the Defense Pack\nverification story. The /verify endpoint computes match/mismatch\nbut requires trusting OilFlow's implementation. This endpoint\nreturns the EXACT canonical-JSON bytes that fed the SHA-256\ndigest at sign time, plus the stored hash + the ordered field\nlist. An independent verifier (browser-runnable at\n/products/defense-ledger/verifier) computes SHA-256 in any\nstandard library and compares. No OilFlow code runs in the\nverification path.\n" } }, { "name": "Render the evidence pack in a regulator-specific narrative format", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/defense/:request_id/render", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "defense", ":request_id", "render" ] }, "description": "Render the evidence pack in a regulator-specific narrative format" } }, { "name": "Print-friendly HTML render of a defense pack (Save-as-PDF in browser)", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/defense/:request_id/render-print", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "defense", ":request_id", "render-print" ] }, "description": "Returns the same regulator-format narrative the JSON `/render`\nendpoint produces, wrapped in a print-styled HTML document. The\nMLRO opens it in a browser, presses Cmd+P / Ctrl+P, saves as PDF.\nIncludes the SHA-256 hash binding + verify URL in the footer so an\nexaminer can re-verify tamper-evidence on the resulting PDF.\nRate limit: 30 req/min.\n" } } ] }, { "name": "Verified Counterparty Network", "description": "Counterparty-side opt-in for the two-sided OilFlow Verified network. Document-backed UBO disclosure + reference letters + +15 clearance lift on Pre-Deal verdicts.", "item": [ { "name": "Counterparty self-serve submission (public, IP-rate-limited)", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/verified/submit", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "verified", "submit" ] }, "description": "Counterparty submits company info + 4 attestations + optional\nsupporting documents (UBO disclosure, company registration,\nreference letter, license, trade-history sample) + optional\nreference contacts. Lands as `status='pending'` for operator\nmoderation. Cross-checked against `broker_scam_blocklist` \u2014\nconfirmed-fraud matches reject outright; likely/suspected matches\nsurface as soft-match flags for priority operator review.\nPublic endpoint, no auth, 5 req/min per IP.\n", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } } }, { "name": "Counterparty self-service document + reference-contact refresh on an approved profile", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/verified/:slug/update-documents", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "verified", ":slug", "update-documents" ] }, "description": "Approved counterparties incrementally refresh documents +\nreference contacts (e.g. UBO changes, license renewal, new\nreference contacts after additional deals close). Documents +\ncontacts are APPENDED, never replaced. IP-rate-limited 3 req/hour.\nFires `verified_profile.documents_updated` webhook on success.\n\nAuth \u2014 two paths accepted:\nPreferred (magic-link, migration 168): obtain a session token via\nthe request-update \u2192 update-token flow, then send\n`Authorization: Bearer `. Hardened against email\nspoofing; the email body field is ignored when a Bearer token is\npresent. Interim (migration 167 fallback): include\n`submitter_email` in the body. Case-insensitive match against\nthe email on file authorizes the update. Kept for backwards\ncompatibility while customers migrate to magic-link.\n", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } } }, { "name": "Step 1 of the magic-link self-update flow \u2014 emails a 30-min single-use token", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/verified/:slug/request-update", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "verified", ":slug", "request-update" ] }, "description": "Issues a short-lived single-use magic-link token and emails it\nto the email on file for the profile (we deliberately do NOT\nread any email from the request body \u2014 defeats the email-spoof\nvector). The link expires in 30 minutes and the response never\nreveals which email was contacted. Rate limit: 3 req/hour per\nIP + 5 req/24h per slug.\n", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } } }, { "name": "Step 2 of the magic-link self-update flow \u2014 exchanges magic-link for 24-hour session token", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/verified/:slug/update-token/:token", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "verified", ":slug", "update-token", ":token" ] }, "description": "Validates the magic-link token (kind=magic_link, status=pending,\nnot expired, slug match, email on file still matches the email\nthe token was issued to) and issues a 24-hour session token.\nMagic-link row flips to status='consumed' atomically.\n" } }, { "name": "Public anyone-can-check lookup against verified directory + cluster blocklist", "request": { "method": "GET", "header": [ { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/public/verified/lookup", "host": [ "{{base_url}}" ], "path": [ "api", "public", "verified", "lookup" ] }, "description": "Friction-free D&B-style lookup. Returns a tier (block / caution /\nverified / unknown) + the matching verified profile (if any) +\nthe matching cluster blocklist row (if any) + a recommendation\nnarrative. No auth required, 15 req/min per IP.\n" } }, { "name": "Read the caller's verified-by-OilFlow profile (opt-in badge)", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/profile/verified", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "profile", "verified" ] }, "description": "Returns the authenticated member's verified_profiles row, or null\nif not opted in. Lane 3B-4 opt-in toggle for customers (distinct\nfrom the counterparty-self-serve flow at /api/v1/verified/submit).\n" } }, { "name": "Opt in \u2014 publish a verified-by-OilFlow profile", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/profile/verified", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "profile", "verified" ] }, "description": "Upserts a verified_profiles row keyed by member_id with a slug\nderived from company_name + member id. Only members with\nverification_status='verified' may opt in.\n", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } } }, { "name": "Opt out \u2014 un-publish the verified-by-OilFlow profile", "request": { "method": "DELETE", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/profile/verified", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "profile", "verified" ] }, "description": "Opt out \u2014 un-publish the verified-by-OilFlow profile" } } ] }, { "name": "Compliance Intelligence", "description": "", "item": [ { "name": "Latest market intelligence aggregations (signals + benchmarks + morning brief)", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/intel", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "intel" ] }, "description": "Returns the most recent OilFlow market-intel snapshot. Aggregates\nregulatory-matrix deltas, sanctions-list updates, cluster-blocklist\nadds, and the daily morning brief.\n" } }, { "name": "Latest market signals (price dislocations, tender alerts, supply disruptions)", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/signals", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "signals" ] }, "description": "Real-time signal feed surfaced from the news_signal agent. The\nadverse-media monitor has never returned a finding, so it contributes\nno rows today. Rate-limited 60/min per API key.\n" } }, { "name": "Universal compliance query \u2014 sanctions + clusters + adverse media + corporate registry + UBO + trade refs", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/search", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "search" ] }, "description": "Unified compliance query interface. One POST returns aggregated\nsignals from every OilFlow surface: sanctions (8 lists \u2014 OFAC SDN,\nOFAC Consolidated, UN, EU, UK HMT, Canada SEMA, AU DFAT, Swiss\nSECO), OilFlow cluster blocklist, adverse media (unmeasured: no\nsource has returned a row),\nOpenCorporates + GLEIF, regulatory ruleset, UBO graph,\nvessel/cargo links, trade-reference history, weighted aggregate\nrisk score (0-100). PEP screening is NOT included \u2014 coverage is\nsanctions-only and results say so explicitly.\n", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } } }, { "name": "List the caller's recent matches (legacy marketplace surface, retained for API customers using the deal-attribution lookup)", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/matches", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "matches" ] }, "description": "Pre-pivot marketplace surface retained for backwards compatibility\nwith API customers that integrated against it. New integrations\nshould prefer /api/v1/kyc/screen + /api/v1/predeal/check instead.\nWill be sunset 2027-Q1 with at least 90 days notice.\n" } } ] }, { "name": "KYC-as-API", "description": "", "item": [ { "name": "Poll an async KYC pipeline job result", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/kyc/results/:request_id", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "kyc", "results", ":request_id" ] }, "description": "Customer poll target after the synchronous /api/v1/kyc/screen\nresponse. Returns `status='queued'|'running'` until the agent\nfinishes the 5 async steps, then `status='completed'` with the\nfull merged results.\n" } }, { "name": "Submit trade-reference contacts for a KYC counterparty", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/kyc/trade-refs", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "kyc", "trade-refs" ] }, "description": "Customer compliance officer submits up to 3 trade-reference\ncontacts for a counterparty under KYC. OilFlow emails each\nreference with a unique tokenized response link; responses flow\nback into the kyc_async_jobs result.\n", "body": { "mode": "raw", "raw": "{}", "options": { "raw": { "language": "json" } } } } }, { "name": "Corporate registry lookup (OpenCorporates + GLEIF cross-reference)", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/registry/lookup", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "registry", "lookup" ] }, "description": "Wraps OpenCorporates as the primary global registry and cross-\nreferences GLEIF for an authoritative LEI when one exists.\nReturns the single canonical company record across both sources.\nFor jurisdictions outside OpenCorporates' 140+ index, response\nincludes `coverage: \"skeletal\"` and falls back to the GLEIF\nresult only \u2014 honest framing, no fake hits.\n" } } ] }, { "name": "Customer Watchlists", "description": "", "item": [ { "name": "List the customer's watchlists with entry counts + last-scanned time", "request": { "method": "GET", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/watchlists", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "watchlists" ] }, "description": "Lane 3C-2 customer watchlist management. Daily agents/watchlist_sync\nscans every active entry against cluster blocklist upgrades and\ncompliance_checks sanctions-screening hits (adverse_media_findings is\nscanned too, and has held zero rows for its whole lifetime) \u2014\nfiring `watchlist.match_detected` via the Lane 2A webhook pipeline\non each match.\n" } }, { "name": "Create a watchlist from a CSV body", "request": { "method": "POST", "header": [ { "key": "Authorization", "value": "Bearer {{api_key}}" }, { "key": "Accept", "value": "application/json" }, { "key": "Content-Type", "value": "application/json" } ], "url": { "raw": "{{base_url}}/api/v1/watchlists", "host": [ "{{base_url}}" ], "path": [ "api", "v1", "watchlists" ] }, "description": "CSV format: `entity_name[,aliases][,jurisdictions]`. Aliases and\njurisdictions are pipe-separated lists inside the CSV cell. The\nfirst column (entity_name) is required.\n", "body": { "mode": "raw", "raw": "{\n \"name\": \"Counterparty book \\u2014 Q2\",\n \"description\": \"Auto-uploaded from internal compliance system\",\n \"csv\": \"entity_name,aliases,jurisdictions\\n\\\"Acme Trading FZE\\\",\\\"Acme FZE | Acme Trading\\\",\\\"UAE | KSA\\\"\\n\"\n}", "options": { "raw": { "language": "json" } } } } } ] } ], "variable": [ { "key": "base_url", "value": "https://oilflow.us", "description": "OilFlow API base URL." }, { "key": "api_key", "value": "oilflow_REPLACE_WITH_YOUR_KEY", "description": "Get a sandbox key at https://oilflow.us/sandbox or a production key at https://oilflow.us/pricing." } ] }