> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corsa.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Building rules

> Use the no-code Rule Builder to define transaction monitoring conditions, configure alert actions, test against historical data, and activate rules.

The Rule Builder is a four-step wizard that walks you through creating a transaction monitoring rule — from defining conditions to activating in production.

You can open it by clicking **Create Rule** on the **Transaction Monitoring** → **Rules** page, or by [copying a template](/transaction-monitoring/rule-templates) into your workspace.

***

## Step 1: Define conditions

Conditions describe the pattern you want to detect. Each rule has one or more **condition groups** connected by OR logic ("any path matches"). Within a group, individual conditions are combined with AND or OR logic.

### Adding a condition

Each condition targets an **entity** and a **property**, then applies an **operator** and a **value**:

| Field                   | Description                                                                                                                    |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| **Entity**              | The data source: `transaction`, `client`, `wallet`, or `bankAccount`.                                                          |
| **Entity relationship** | For non-transaction entities: evaluate the `sender`, `receiver`, or `all` participants.                                        |
| **Property**            | The field to inspect (e.g., `amount`, `riskTier`, `country`).                                                                  |
| **Operator**            | The comparison: `equal`, `greaterThan`, `in`, `between`, and [others](/transaction-monitoring/conditions-reference#operators). |
| **Value**               | The threshold or target value.                                                                                                 |

### Aggregation conditions

For pattern detection over time — like velocity checks or cumulative thresholds — add an **aggregation** to a condition:

| Field                    | Description                                                                                                                        |
| ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------- |
| **Aggregation operator** | `sum`, `count`, `avg`, `min`, `max`, `percentile`, and [more](/transaction-monitoring/conditions-reference#aggregation-operators). |
| **Aggregation property** | The field to aggregate (e.g., `amount`).                                                                                           |
| **Time window**          | The lookback period: `in_the_last` 24 hours, `all_time`, `between` two dates, etc.                                                 |
| **Filters**              | Narrow the aggregation scope (e.g., only `WITHDRAW` transactions).                                                                 |

The aggregated result is then compared using the regular operator and value fields. For example: "SUM of `amount` where type = WITHDRAW in the last 24 hours is greater than 50,000."

### Condition groups

Click **Add Group** to create an additional condition path. Groups are connected with OR logic — if **any** group matches, the rule triggers. Within a group, you choose whether conditions combine with AND (`all`) or OR (`any`).

<Tip>See the [Conditions reference](/transaction-monitoring/conditions-reference) for the complete list of operators, entities, aggregation options, and time windows.</Tip>

***

## Step 2: Configure response

Choose what happens when the rule matches a transaction.

### Alert priority

Set the priority for generated alerts:

| Priority   | When to use                                           |
| ---------- | ----------------------------------------------------- |
| **High**   | Patterns requiring immediate analyst attention.       |
| **Medium** | Suspicious activity that should be reviewed promptly. |
| **Low**    | Informational signals for batch review.               |

### Alert routing

You can optionally configure additional fields on the alert action:

* **Sub-category** -- Classify alerts more granularly (e.g., "STRUCTURING", "SANCTIONS\_SCREENING").
* **Assignee** -- Auto-assign the alert to a specific team member by user ID.
* **Due date** -- Set an SLA by specifying the number of hours from alert creation (e.g., `48` for a two-day deadline).

These fields are set in the `config` object of the `CREATE_ALERT` action. See the [conditions reference](/transaction-monitoring/conditions-reference#create_alert) for the full list of config fields.

### Halt transaction

Toggle between two response modes:

* **Alert only** — Create a compliance alert for analyst review. The transaction proceeds normally.
* **Alert + Halt transaction** — Create an alert **and** freeze the transaction until an analyst reviews it.

<Warning>Halting transactions blocks settlement until the alert is resolved. Use this for high-confidence rules where false positives are rare.</Warning>

***

## Step 3: Test

Before activating, test your rule against historical transactions to understand its impact. The Rule Builder includes a built-in testing step — see [Testing rules](/transaction-monitoring/testing-rules) for details on batch testing, single-transaction evaluation, and interpreting results.

***

## Step 4: Review and activate

The final step displays a summary of your rule:

* **Basic info** — Name and description.
* **Formula** — A human-readable representation of your conditions (e.g., "IF amount > 10,000 AND customer risk = HIGH").
* **Response** — Alert priority and whether transactions are halted.

If everything looks correct, click **Activate Rule** to start evaluating live transactions.

<Note>Draft rules are auto-saved. You can close the builder and return later — your progress is preserved.</Note>

***

## Updating active rules

When you edit a rule that is already active, Corsa creates a **new version** behind the scenes. Your changes are not applied until you click **Publish Updates**.

You can optionally provide an **audit reason** explaining the change. This reason is recorded in the rule's audit log for compliance traceability.

***

## Creating rules via API

You can also create and manage rules programmatically. See the [Rules & Evaluation API](/transaction-monitoring/rules-api) for full endpoint documentation.

**Endpoint:** `POST /v1/rules`

<CodeGroup>
  ```json REST API theme={null}
  POST /v1/rules
  Content-Type: application/json

  {
    "name": "High-risk withdrawal detection",
    "description": "Alert on large withdrawals by high-risk customers",
    "conditions": {
      "all": [
        {
          "entity": "client",
          "property": "riskTier",
          "operator": "equal",
          "value": "HIGH"
        },
        {
          "entity": "transaction",
          "aggregationProperty": "amount",
          "aggregationOperator": "sum",
          "aggregationTimeType": "in_the_last",
          "aggregationTimeValue": 1,
          "aggregationTimePeriod": "days",
          "aggregationFilters": [
            {
              "property": "type",
              "operator": "equal",
              "value": "WITHDRAW"
            }
          ],
          "operator": "greaterThanInclusive",
          "value": 50000
        }
      ]
    },
    "actions": [
      {
        "type": "CREATE_ALERT",
        "config": {
          "category": "TRANSACTION_MONITORING",
          "priority": "HIGH",
          "status": "NEW"
        }
      }
    ]
  }
  ```

  ```typescript Javascript theme={null}
  const rule = await corsa.rules.createRule({
    name: "High-risk withdrawal detection",
    description: "Alert on large withdrawals by high-risk customers",
    conditions: {
      all: [
        {
          entity: "client",
          property: "riskTier",
          operator: "equal",
          value: "HIGH",
        },
        {
          entity: "transaction",
          aggregationProperty: "amount",
          aggregationOperator: "sum",
          aggregationTimeType: "in_the_last",
          aggregationTimeValue: 1,
          aggregationTimePeriod: "days",
          aggregationFilters: [
            { property: "type", operator: "equal", value: "WITHDRAW" },
          ],
          operator: "greaterThanInclusive",
          value: 50000,
        },
      ],
    },
    actions: [
      {
        type: "CREATE_ALERT",
        config: {
          category: "TRANSACTION_MONITORING",
          priority: "HIGH",
          status: "NEW",
        },
      },
    ],
  });
  ```

  ```python Python theme={null}
  from corsa_sdk.api.rules.create_rule import _get_kwargs
  from corsa_sdk.models.create_rule_dto import CreateRuleDto

  resp = http.request(**_get_kwargs(
      body=CreateRuleDto(
          name="High-risk withdrawal detection",
          description="Alert on large withdrawals by high-risk customers",
          conditions={"all": [
              {"entity": "client", "property": "riskTier", "operator": "equal", "value": "HIGH"},
              {"entity": "transaction", "aggregationProperty": "amount", "aggregationOperator": "sum", "aggregationTimeType": "in_the_last", "aggregationTimeValue": 1, "aggregationTimePeriod": "days", "aggregationFilters": [{"property": "type", "operator": "equal", "value": "WITHDRAW"}], "operator": "greaterThanInclusive", "value": 50000},
          ]},
          actions=[{"type": "CREATE_ALERT", "config": {"category": "TRANSACTION_MONITORING", "priority": "HIGH", "status": "NEW"}}],
      ),
  ))
  rule = resp.json()
  ```
</CodeGroup>

***

## What's next?

<CardGroup cols={2}>
  <Card title="Conditions reference" icon="code" href="/transaction-monitoring/conditions-reference">
    Full reference for operators, entities, aggregations, and time windows.
  </Card>

  <Card title="Testing rules" icon="flask-vial" href="/transaction-monitoring/testing-rules">
    Validate your rule against historical transactions before activating.
  </Card>

  <Card title="Rules & Evaluation API" icon="square-terminal" href="/transaction-monitoring/rules-api">
    Manage rules programmatically via REST API or SDK.
  </Card>
</CardGroup>