Cases

A case is the Risk unit of work. Evidence, assessments, and reports belong to it. Status changes are audited. The model may suggest typology. It does not close the case.

Open

POST /v1/risk/cases
Authorization: Bearer eridian_sk_...
Idempotency-Key: case-fc-2026-0912

{
  "project_id": "prj_risk_001",
  "title": "Unusual outbound series on desk PX-12",
  "typology": "aml",
  "severity": "high",
  "source": "transaction_monitoring",
  "external_id": "TM-88421",
  "model": "auto",
  "triage": true
}

typology is aml | sanctions | fraud | market_abuse | operational | other. Required scope: risk:write.

Assign

POST /v1/risk/cases/cse_0912/assign

{
  "assignee_id": "usr_fc_analyst",
  "reviewer_id": "usr_fc_lead"
}

On Enterprise, assigning a severity: high case to the same principal as reviewer_id is rejected (409 segregation_of_duties).

Status

POST /v1/risk/cases/cse_0912/status

{
  "status": "investigating",
  "comment": "Linked TM-88421 alerts 1-17."
}

Close requires disposition: false_positive | true_positive | sar_filed | other. sar_filed does not transmit a filing. It records that your filing system did. Eridian is not the filing channel.

Notes

POST /v1/risk/cases/cse_0912/notes

{
  "body": "Customer called. Explained payroll batch.",
  "privilege": false
}

Model-generated notes are tagged actor: model and must cite evidence ids. Analyst notes are actor: user.

List

GET /v1/risk/cases?status=open&typology=aml&starting_after=cse_0900

See Pagination. Filters never include full evidence bodies.

See Financial Crime for typology-specific fields and Risk Approvals for status transitions that need a second person.