> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corsa.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing Suspicious Activity Reports (SAR)

> Update SAR fields, sign off sections, and advance a SAR through its lifecycle to submission using the Corsa API.

Once a case is [closed as SAR](/api/managing-alerts-and-cases#step-15-close-a-case-as-sar), Corsa automatically creates a draft SAR filing pre-linked to that case. Use the endpoints on this page to fill out the filing, sign off each section, and advance it through its lifecycle until it is submitted to your regulator.

Full API endpoint details are available in the [API Reference](https://api.corsa.finance/api-spec.json) (requires API credentials).

***

## SAR Lifecycle

```
DRAFT → IN_REVIEW → FILED
```

| Status      | Description                                                                                                            |
| ----------- | ---------------------------------------------------------------------------------------------------------------------- |
| `DRAFT`     | Created automatically when a case is closed as SAR. Fill out the report fields and sign off sections before advancing. |
| `IN_REVIEW` | All sections have been reviewed. The report is ready for final sign-off before filing.                                 |
| `FILED`     | The SAR has been submitted. Most fields can no longer be changed.                                                      |

Call `POST /v1/sar/{id}/submit` to advance from `DRAFT` to `IN_REVIEW`, and again to advance from `IN_REVIEW` to `FILED`.

***

## Update a SAR

**Endpoint:** `PUT /v1/sar/{id}/update`

Fill in or update the report fields. Most fields can be updated freely while the SAR is in `DRAFT` or `IN_REVIEW` status. Fields marked "cannot be changed once FILED" lock after submission.

<CodeGroup>
  ```json REST API theme={null}
  PUT /v1/sar/sar_abc123def456/update
  Content-Type: application/json

  {
    "referenceId": "SAR-2024-001234",
    "filingType": "SAR",
    "priority": "HIGH",
    "suspicionCategory": "STRUCTURING",
    "regulator": "FINCEN",
    "totalValueInFiat": 125000.50,
    "baseCurrency": "USD",
    "jurisdiction": "US",
    "summary": "Subject conducted 14 deposits between $9,000 and $9,999 over 30 days to avoid CTR reporting thresholds.",
    "narrative": "Between January 1 and January 31, 2024, the subject...",
    "typologyTags": ["structuring", "smurfing"],
    "geographiesInvolved": ["US"],
    "lawEnforcementInquiry": false
  }
  ```

  ```typescript Javascript theme={null}
  const sar = await fetch(
    `${BASE_URL}/v1/sar/sar_abc123def456/update`,
    {
      method: "PUT",
      headers: {
        Authorization: `Bearer ${API_TOKEN}:${API_SECRET}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        referenceId: "SAR-2024-001234",
        filingType: "SAR",
        priority: "HIGH",
        suspicionCategory: "STRUCTURING",
        regulator: "FINCEN",
        totalValueInFiat: 125000.50,
        baseCurrency: "USD",
        jurisdiction: "US",
        summary: "Subject conducted 14 deposits between $9,000 and $9,999 over 30 days.",
        narrative: "Between January 1 and January 31, 2024, the subject...",
        typologyTags: ["structuring", "smurfing"],
        geographiesInvolved: ["US"],
        lawEnforcementInquiry: false,
      }),
    }
  );
  const updated = await sar.json();
  ```

  ```python Python theme={null}
  import httpx

  resp = httpx.put(
      "https://api.corsa.finance/v1/sar/sar_abc123def456/update",
      headers={"Authorization": f"Bearer {API_TOKEN}:{API_SECRET}"},
      json={
          "referenceId": "SAR-2024-001234",
          "filingType": "SAR",
          "priority": "HIGH",
          "suspicionCategory": "STRUCTURING",
          "regulator": "FINCEN",
          "totalValueInFiat": 125000.50,
          "baseCurrency": "USD",
          "jurisdiction": "US",
          "summary": "Subject conducted 14 deposits between $9,000 and $9,999 over 30 days.",
          "narrative": "Between January 1 and January 31, 2024, the subject...",
          "typologyTags": ["structuring", "smurfing"],
          "geographiesInvolved": ["US"],
          "lawEnforcementInquiry": False,
      },
  )
  sar = resp.json()
  ```
</CodeGroup>

### Request Fields

| Field                   | Description                                                                                                 |
| ----------------------- | ----------------------------------------------------------------------------------------------------------- |
| `referenceId`           | External or human-facing reference ID for the report (e.g. `SAR-2024-001234`). Max 255 characters.          |
| `filingType`            | Type of regulatory filing: `SAR`, `STR`, `UAR`, or `OTHER`.                                                 |
| `priority`              | Report priority: `LOW`, `MEDIUM`, or `HIGH`.                                                                |
| `suspicionCategory`     | Category of suspicious activity. See [Suspicion categories](#suspicion-categories) below.                   |
| `regulator`             | Regulator the report is filed with: `FINCEN`, `OTHER`, or `NA`.                                             |
| `totalValueInFiat`      | Total reported transaction value. Cannot be changed once the SAR is `FILED`.                                |
| `baseCurrency`          | ISO currency code for `totalValueInFiat` (e.g. `USD`). Cannot be changed once `FILED`.                      |
| `jurisdiction`          | Reporting jurisdiction (e.g. `US`). Max 100 characters.                                                     |
| `summary`               | Short summary of the suspicious activity. Max 2,000 characters.                                             |
| `narrative`             | Full narrative section of the report. Max 20,000 characters.                                                |
| `typologyTags`          | User-defined typology tags for categorizing the activity (e.g. `["structuring", "smurfing"]`). Max 50 tags. |
| `geographiesInvolved`   | ISO 3166-1 alpha-2 country codes for countries involved (e.g. `["US", "PA"]`). Max 100 entries.             |
| `lawEnforcementInquiry` | `true` if there is an associated law enforcement inquiry.                                                   |
| `assigneeId`            | Corsa user ID of the analyst responsible for this filing.                                                   |

### Suspicion categories

| Value                          | Description                                           |
| ------------------------------ | ----------------------------------------------------- |
| `STRUCTURING`                  | Structuring or smurfing to avoid reporting thresholds |
| `TERRORIST_FINANCING`          | Suspected terrorist financing activity                |
| `FRAUD`                        | Suspected fraud                                       |
| `MONEY_LAUNDERING`             | General money laundering activity                     |
| `GAMING_ACTIVITIES`            | Gaming-related suspicious activity                    |
| `IDENTIFICATION_DOCUMENTATION` | Issues with identity documentation                    |
| `CYBER_EVENT`                  | Cybercrime or cyber-enabled activity                  |
| `MORTGAGE_FRAUD`               | Mortgage-related fraud                                |
| `INSURANCE`                    | Insurance-related suspicious activity                 |
| `SECURITIES_FUTURES_OPTIONS`   | Securities, futures, or options fraud                 |
| `OTHER_SUSPICIOUS_ACTIVITIES`  | Suspicious activity not covered by other categories   |
| `OTHER`                        | Other                                                 |

***

## Sign Off a Section

**Endpoint:** `PUT /v1/sar/{id}/section-review`

SARs are divided into sections that must be individually reviewed and signed off before the filing can be submitted. Sign off a section to mark it as complete, or reopen it to make additional changes.

| Section              | Description                                                    |
| -------------------- | -------------------------------------------------------------- |
| `SUBJECTS`           | Subjects of the report (individuals or entities involved)      |
| `ACTIVITY`           | Details of the suspicious activity                             |
| `INSTITUTION`        | Information about the reporting institution's branch or office |
| `FILING_INSTITUTION` | Contact information for the filing institution                 |
| `NARRATIVE`          | Full narrative and typology description                        |

<CodeGroup>
  ```json REST API theme={null}
  # Sign off the NARRATIVE section
  PUT /v1/sar/sar_abc123def456/section-review
  Content-Type: application/json

  {
    "section": "NARRATIVE",
    "reviewed": true
  }

  # Reopen a previously signed-off section
  PUT /v1/sar/sar_abc123def456/section-review
  Content-Type: application/json

  {
    "section": "NARRATIVE",
    "reviewed": false
  }
  ```

  ```typescript Javascript theme={null}
  // Sign off the NARRATIVE section
  const sar = await fetch(
    `${BASE_URL}/v1/sar/sar_abc123def456/section-review`,
    {
      method: "PUT",
      headers: {
        Authorization: `Bearer ${API_TOKEN}:${API_SECRET}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        section: "NARRATIVE",
        reviewed: true,
      }),
    }
  );
  const updated = await sar.json();
  ```

  ```python Python theme={null}
  import httpx

  resp = httpx.put(
      "https://api.corsa.finance/v1/sar/sar_abc123def456/section-review",
      headers={"Authorization": f"Bearer {API_TOKEN}:{API_SECRET}"},
      json={"section": "NARRATIVE", "reviewed": True},
  )
  sar = resp.json()
  ```
</CodeGroup>

### Request Fields

| Field      | Required | Description                                                                                                     |
| ---------- | -------- | --------------------------------------------------------------------------------------------------------------- |
| `section`  | Yes      | The section to sign off or reopen: `SUBJECTS`, `ACTIVITY`, `INSTITUTION`, `FILING_INSTITUTION`, or `NARRATIVE`. |
| `reviewed` | Yes      | `true` to sign off the section; `false` to reopen it and clear the existing sign-off.                           |

***

## Advance the SAR Lifecycle

**Endpoint:** `POST /v1/sar/{id}/submit`

Advances the SAR to the next status in its lifecycle. Call this endpoint twice to take a SAR from `DRAFT` to `FILED`:

1. First call: `DRAFT` → `IN_REVIEW`
2. Second call: `IN_REVIEW` → `FILED`

<CodeGroup>
  ```json REST API theme={null}
  POST /v1/sar/sar_abc123def456/submit
  ```

  ```typescript Javascript theme={null}
  const sar = await fetch(
    `${BASE_URL}/v1/sar/sar_abc123def456/submit`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${API_TOKEN}:${API_SECRET}`,
      },
    }
  );
  const advanced = await sar.json();
  ```

  ```python Python theme={null}
  import httpx

  resp = httpx.post(
      "https://api.corsa.finance/v1/sar/sar_abc123def456/submit",
      headers={"Authorization": f"Bearer {API_TOKEN}:{API_SECRET}"},
  )
  sar = resp.json()
  ```
</CodeGroup>

<Warning>Once a SAR is `FILED`, monetary fields (`totalValueInFiat`, `baseCurrency`) cannot be changed. Verify all report data before submitting.</Warning>

***

## SAR Response Object

```json theme={null}
{
  "id": "sar_abc123def456",
  "referenceId": "SAR-2024-001234",
  "status": "DRAFT",
  "filingType": "SAR",
  "priority": "HIGH",
  "suspicionCategory": "STRUCTURING",
  "regulator": "FINCEN",
  "totalValueInFiat": 125000.50,
  "baseCurrency": "USD",
  "jurisdiction": "US",
  "summary": "Subject conducted 14 deposits between $9,000 and $9,999 over 30 days.",
  "typologyTags": ["structuring", "smurfing"],
  "geographiesInvolved": ["US"],
  "lawEnforcementInquiry": false,
  "createdAt": "2024-01-15T10:00:00Z",
  "updatedAt": "2024-01-15T16:30:00Z"
}
```

***

## What's Next?

<CardGroup cols={2}>
  <Card title="Managing Alerts & Cases" icon="list-check" href="/api/managing-alerts-and-cases">
    Close a case as SAR to create the initial filing.
  </Card>

  <Card title="Managing Attachments" icon="paperclip" href="/api/managing-attachments">
    Upload supporting documents and link them to a SAR filing.
  </Card>
</CardGroup>