> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corsa.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Ingest Compliance Alerts & Investigation Cases

> Push compliance alerts and escalate them to investigation cases in Corsa via the REST API.

This guide walks you through pushing external alerts into Corsa and escalating them to investigation cases for your compliance team.

Full API endpoint details are available in the [API Reference](https://api.corsa.finance/api-spec.json) (requires API credentials).

<Note>Before ingesting alerts, make sure the related clients and operations have already been ingested. See the [Ingesting Clients](/api/ingesting-clients) and [Ingesting Operations](/api/ingesting-operations) guides.</Note>

***

## Step 1: Ingest Alerts

Push external alerts (from third-party vendors or internal systems) into Corsa for centralized monitoring and case management.

**Endpoint:** `POST /v1/alerts`

<CodeGroup>
  ```json REST API theme={null}
  POST /v1/alerts
  Content-Type: application/json

  {
    "referenceId": "EXT-ALERT-555",
    "category": "TRANSACTION_MONITORING",
    "priority": "HIGH",
    "status": "NEW",
    "description": "Large withdrawal detected for a high-risk account.",
    "raisedAt": "2024-01-17T09:00:00Z",
    "source": {
      "vendor": "OTHER",
      "vendorAlertId": "INT-SYS-99",
      "alertSource": "API"
    },
    "associatedClients": [
      "123e4567-e89b-12d3-a456-426614174000"
    ],
    "assigneeId": "user-uuid-of-analyst"
  }
  ```

  ```typescript Javascript theme={null}
  const alert = await corsa.alerts.createAlert({
    referenceId: "EXT-ALERT-555",
    category: "TRANSACTION_MONITORING",
    priority: "HIGH",
    status: "NEW",
    description: "Large withdrawal detected for a high-risk account.",
    raisedAt: "2024-01-17T09:00:00Z",
    source: {
      vendor: "OTHER",
      vendorAlertId: "INT-SYS-99",
      alertSource: "API",
    },
    associatedClients: ["123e4567-e89b-12d3-a456-426614174000"],
    assigneeId: "user-uuid-of-analyst",
  });
  ```

  ```python Python theme={null}
  from corsa_sdk.api.alerts.create_alert import _get_kwargs
  from corsa_sdk.models.create_alert_dto import CreateAlertDto

  resp = http.request(**_get_kwargs(
      body=CreateAlertDto(
          reference_id="EXT-ALERT-555",
          category="TRANSACTION_MONITORING",
          priority="HIGH",
          status="NEW",
          description="Large withdrawal detected for a high-risk account.",
          raised_at="2024-01-17T09:00:00Z",
          source={"vendor": "OTHER", "vendorAlertId": "INT-SYS-99", "alertSource": "API"},
          associated_clients=["123e4567-e89b-12d3-a456-426614174000"],
          assignee_id="user-uuid-of-analyst",
      ),
  ))
  alert = resp.json()
  ```
</CodeGroup>

<Note>The `assigneeId` field is optional. If not provided, the alert will be created without an assignee.</Note>

The `associatedClients` array should contain the Corsa client `id`(s) returned when you ingested the client.

***

## Step 2: Escalate an Alert to a Case

When an alert requires further investigation or formal review, escalate it to a **Case**. This links the alert to a new case, allowing investigators to track the entire lifecycle from detection to resolution.

**Endpoint:** `POST /v1/cases`

<CodeGroup>
  ```json REST API theme={null}
  POST /v1/cases
  Content-Type: application/json

  {
    "referenceId": "CASE-2024-001",
    "priority": "HIGH",
    "category": "TRANSACTION_MONITORING",
    "subCategory": "Suspicious Activity",
    "status": "UNDER_INVESTIGATION",
    "description": "Investigation opened for high-value transaction pattern.",
    "alertsIds": [
      "alert-uuid-from-previous-step"
    ],
    "transactionsIds": [
      "transaction-uuid-related-to-alert"
    ],
    "clientsIds": [
      "client-uuid-related-to-alert"
    ],
    "assigneeId": "analyst-uuid",
    "reviewersIds": [],
    "dueDate": "2024-01-25T17:00:00Z"
  }
  ```

  ```typescript Javascript theme={null}
  const caseResult = await corsa.cases.createCase({
    referenceId: "CASE-2024-001",
    priority: "HIGH",
    category: "TRANSACTION_MONITORING",
    subCategory: "Suspicious Activity",
    status: "UNDER_INVESTIGATION",
    description: "Investigation opened for high-value transaction pattern.",
    alertsIds: ["alert-uuid-from-previous-step"],
    transactionsIds: ["transaction-uuid-related-to-alert"],
    clientsIds: ["client-uuid-related-to-alert"],
    assigneeId: "analyst-uuid",
    reviewersIds: [],
    dueDate: "2024-01-25T17:00:00Z",
  });
  ```

  ```python Python theme={null}
  from corsa_sdk.api.cases.create_case import _get_kwargs
  from corsa_sdk.models.create_case_dto import CreateCaseDto

  resp = http.request(**_get_kwargs(
      body=CreateCaseDto(
          reference_id="CASE-2024-001",
          priority="HIGH",
          category="TRANSACTION_MONITORING",
          sub_category="Suspicious Activity",
          status="UNDER_INVESTIGATION",
          description="Investigation opened for high-value transaction pattern.",
          alerts_ids=["alert-uuid-from-previous-step"],
          transactions_ids=["transaction-uuid-related-to-alert"],
          clients_ids=["client-uuid-related-to-alert"],
          assignee_id="analyst-uuid",
          reviewers_ids=[],
          due_date="2024-01-25T17:00:00Z",
      ),
  ))
  case_result = resp.json()
  ```
</CodeGroup>

<Note>The `reviewersIds` field is required but can be an empty array. The case `status` will be automatically set to `NEW` upon creation, regardless of what you specify in the request.</Note>

This links the alert to the new case, allowing investigators to track the entire lifecycle from detection (Alert) to resolution (Case).

***

## What's Next?

<CardGroup cols={3}>
  <Card title="Manage Alerts & Cases" icon="list-check" href="/api/managing-alerts-and-cases">
    Batch create, bulk assign, update, and escalate alerts and cases.
  </Card>

  <Card title="Manage Attachments" icon="paperclip" href="/api/managing-attachments">
    Upload and link files to alerts, cases, and other entities.
  </Card>

  <Card title="Transaction Monitoring" icon="scale-balanced" href="/transaction-monitoring/index">
    Set up transaction monitoring rules.
  </Card>
</CardGroup>