Managing Sub-Dispositions - Corsa Documentation

Sub-dispositions let you extend Corsa’s standard alert and case statuses with custom resolution reasons. For example, a RESOLVED alert can carry a sub-disposition of true_positive_filed_sar or false_positive_rule_tuning so analysts capture the specific outcome without losing the normalized parent status. Full API endpoint details are available in the API Reference (requires API credentials).

Overview

Each sub-disposition belongs to:

A parent status — the standard Corsa status it qualifies (RESOLVED, ESCALATED, IN_REVIEW, CLOSED_DISMISSED, or CLOSED_ESCALATION_TO_SAR)
An entity type — either ALERT or CASE

Sub-dispositions can be preset (system-defined, always available) or custom (created via API). Custom sub-dispositions can be toggled active/inactive without deletion, preserving historical audit data. Parent statuses:

Status	Applies to
`RESOLVED`	Alerts and Cases
`ESCALATED`	Alerts and Cases
`IN_REVIEW`	Alerts and Cases
`CLOSED_DISMISSED`	Cases
`CLOSED_ESCALATION_TO_SAR`	Cases

Seed Preset Sub-Dispositions

Endpoint: POST /v1/sub-dispositions/seed-platform Initializes the platform with the built-in preset sub-dispositions. Call this once during initial platform setup to populate the standard set of resolution reasons (for example, true_positive_filed_sar, false_positive_rule_tuning, and others) that Corsa ships out of the box. If preset sub-dispositions are already seeded, this endpoint is idempotent — calling it again will not create duplicates.

POST /v1/sub-dispositions/seed-platform
Authorization: Bearer <API_TOKEN>:<API_SECRET>

await corsa.subDispositions.seedSubDispositions();

import httpx

httpx.post(
    "https://api.corsa.finance/v1/sub-dispositions/seed-platform",
    headers={"Authorization": f"Bearer {API_TOKEN}:{API_SECRET}"},
)

Returns 200 on success. After seeding, the preset sub-dispositions will appear in GET /v1/sub-dispositions with isPreset: true.

List Sub-Dispositions

Endpoint: GET /v1/sub-dispositions Returns sub-dispositions for the platform. By default returns all sub-dispositions (preset and custom). Use the query parameters below to filter the results.

# All sub-dispositions
GET /v1/sub-dispositions

# Only active alert sub-dispositions for RESOLVED status
GET /v1/sub-dispositions?entityType=ALERT&parentStatus=RESOLVED&isActive=true

// All sub-dispositions
const subDispositions = await corsa.subDispositions.listSubDispositions();

// Filtered — active alert sub-dispositions for RESOLVED status
const resolved = await corsa.subDispositions.listSubDispositions(
  "RESOLVED",   // parentStatus
  "ALERT",      // entityType
  true          // isActive
);

from corsa_sdk.api.sub_dispositions.list_sub_dispositions import _get_kwargs

resp = http.request(**_get_kwargs(
    parent_status="RESOLVED",
    entity_type="ALERT",
    is_active=True,
))
sub_dispositions = resp.json()

Query Parameters

Parameter	Description
`parentStatus`	Filter by parent status: `RESOLVED`, `ESCALATED`, `IN_REVIEW`, `CLOSED_DISMISSED`, or `CLOSED_ESCALATION_TO_SAR`.
`entityType`	Filter by entity type: `ALERT` or `CASE`.
`isActive`	`true` to return only active sub-dispositions; `false` for inactive. Omit to return all.
`page`	Page number (default: `1`).
`limit`	Records per page (default: `50`, max: `200`).

Create a Sub-Disposition

Endpoint: POST /v1/sub-dispositions

POST /v1/sub-dispositions
Content-Type: application/json

{
  "name": "false_positive_rule_tuning",
  "displayName": "False Positive — Rule Tuning",
  "parentStatus": "RESOLVED",
  "entityType": "ALERT"
}

const subDisposition = await corsa.subDispositions.createSubDisposition({
  name: "false_positive_rule_tuning",
  displayName: "False Positive — Rule Tuning",
  parentStatus: "RESOLVED",
  entityType: "ALERT",
});

from corsa_sdk.api.sub_dispositions.create_sub_disposition import _get_kwargs
from corsa_sdk.models.create_sub_disposition_dto import CreateSubDispositionDto

resp = http.request(**_get_kwargs(
    body=CreateSubDispositionDto(
        name="false_positive_rule_tuning",
        display_name="False Positive — Rule Tuning",
        parent_status="RESOLVED",
        entity_type="ALERT",
    ),
))
sub_disposition = resp.json()

Request Fields

Field	Required	Description
`name`	Yes	Internal key in `lower_snake_case` — used in API requests and exports
`parentStatus`	Yes	The parent status this sub-disposition qualifies: `RESOLVED`, `ESCALATED`, `IN_REVIEW`, `CLOSED_DISMISSED`, or `CLOSED_ESCALATION_TO_SAR`
`entityType`	Yes	Entity this applies to: `ALERT` or `CASE`
`displayName`	No	Human-readable label shown to analysts. Defaults to title-cased `name` if omitted

Get a Sub-Disposition

Endpoint: GET /v1/sub-dispositions/{id}

GET /v1/sub-dispositions/sd_abc123

const subDisposition = await corsa.subDispositions.getSubDisposition("sd_abc123");

from corsa_sdk.api.sub_dispositions.get_sub_disposition import _get_kwargs

resp = http.request(**_get_kwargs(id="sd_abc123"))
sub_disposition = resp.json()

Update a Sub-Disposition

Endpoint: PATCH /v1/sub-dispositions/{id} You can update the display name or toggle the active state. Custom sub-dispositions cannot have their name, parentStatus, or entityType changed after creation.

PATCH /v1/sub-dispositions/sd_abc123
Content-Type: application/json

{
  "displayName": "False Positive — Rule Needs Tuning",
  "isActive": true
}

const updated = await corsa.subDispositions.updateSubDisposition("sd_abc123", {
  displayName: "False Positive — Rule Needs Tuning",
  isActive: true,
});

from corsa_sdk.api.sub_dispositions.update_sub_disposition import _get_kwargs
from corsa_sdk.models.update_sub_disposition_dto import UpdateSubDispositionDto

resp = http.request(**_get_kwargs(
    id="sd_abc123",
    body=UpdateSubDispositionDto(
        display_name="False Positive — Rule Needs Tuning",
        is_active=True,
    ),
))
updated = resp.json()

Delete a Sub-Disposition

Endpoint: DELETE /v1/sub-dispositions/{id} Soft-deletes the sub-disposition. Only custom sub-dispositions can be deleted — preset sub-dispositions cannot be removed.

DELETE /v1/sub-dispositions/sd_abc123

await corsa.subDispositions.deleteSubDisposition("sd_abc123");

from corsa_sdk.api.sub_dispositions.delete_sub_disposition import _get_kwargs

http.request(**_get_kwargs(id="sd_abc123"))

Sub-Disposition Response Object

{
  "id": "sd_abc123",
  "platformId": "platform_xyz",
  "name": "false_positive_rule_tuning",
  "displayName": "False Positive — Rule Tuning",
  "parentStatus": "RESOLVED",
  "entityType": "ALERT",
  "isPreset": false,
  "isActive": true,
  "createdAt": "2024-01-15T10:00:00Z",
  "updatedAt": "2024-01-15T10:00:00Z"
}

​Overview

​Seed Preset Sub-Dispositions

​List Sub-Dispositions

​Query Parameters

​Create a Sub-Disposition

​Request Fields

​Get a Sub-Disposition

​Update a Sub-Disposition

​Delete a Sub-Disposition

​Sub-Disposition Response Object