review, or another signal, needs a person to look at an account.
A review does not change the account’s risk. It does not report an outcome or apply an enforcement. To record what your team learned, report an outcome as well.
All review operations need an API key with the management scope. A workspace member needs review access in the environment. A key acts only in its own workspace and environment. The other environment answers 404 not_found.
Find accounts that need a review
POST /v1/accounts/search with needs_action: true returns the retained accounts that wait for your team. Each match gives waiting_for reasons. This filter also needs review access. Limits, permissions and page changes describes it.
Open a review
POST /v1/workspaces/{workspace_id}/reviews/{environment} opens a review for one account:
Open a review
- Send
account_id. The account must have a retained assessment in this environment. Otherwise the answer is 404. priorityislow,normal,highorurgent. The default isnormal.assigneeis optional. It must be the external user id of an active member who can read reviews in this environment.
rev_. A new review has status: "open" and version: 1. opened_risk_version is the account’s risk version when the review opened.
An account has one review in each environment. A second review for the same account answers 409 review_exists. Get the existing review and update it. A resolved review stays the account’s review. Reopen it to continue.
A review expires with the environment’s retention. expires_at gives the time. After expiry, you can open a new review for the account.
Read the review
Get one review with
GET /v1/workspaces/{workspace_id}/reviews/{environment}/{review_id}.
List reviews
GET /v1/workspaces/{workspace_id}/reviews/{environment} lists the retained reviews, newest first. All filters are optional and combine with AND:
Use only one of
assignee, assignee_principal_id and unassigned=true. A combination answers 400 invalid_request.
POST /v1/workspaces/{workspace_id}/reviews/{environment}/query takes the same filters, limit and cursor in a JSON body.
It also accepts account_id for this exact account, before pagination. Keep that identifier out of the GET URL. Pages have 1 to 100 items, 50 by default. Pass next_cursor back as cursor with the same filters. The cursor is bound to its filters.
TypeScript
Change a review
Every change sendsexpected_version, the review version that you read. NoResponse applies the change only when the review still has that version. Otherwise the answer is 409 review_version_conflict. Get the review again and check what changed before you send the new version.
PATCH /v1/workspaces/{workspace_id}/reviews/{environment}/{review_id} changes status, priority or assignee. Send at least one of them:
Assign and start a review
statusacceptsopenorin_progress. Use the resolve operation to resolve a review.assignee: nullunassigns the review.- A status change on a resolved review reopens it. The review then has no current resolution. Its resolution history stays.
Add comments
POST /v1/workspaces/{workspace_id}/reviews/{environment}/{review_id}/comments adds a comment:
Add a comment
body has 1 to 2,000 characters. Each comment records the review version that it created. A comment also increments the review version.
GET .../comments pages through the comments, 1 to 100 per page. A review has at most 1,000 comments. The next comment answers 409 review_limit_reached.
Link evidence
A subject links evidence to a review. A link records investigation context only. It does not change account risk, report an outcome or apply an enforcement.POST /v1/workspaces/{workspace_id}/reviews/{environment}/{review_id}/subjects adds a link. kind is one of these:
account: a retained account.assessment: an exact assessment revision. Sendassessment_idandassessment_version.issued_credential: a key association from Associate keys issued by your platform. Sendcredential_id.
Link an assessment revision
reason has 1 to 500 characters. Every reference must belong to its account_id in this environment. Each link keeps the account risk_version from when you added it. A review holds at most 100 links. The next link answers 409 review_limit_reached.
GET .../subjects lists the links. DELETE .../subjects/{subject_id} with expected_version deletes one link and answers 200 with the review. The source account, assessment or key association does not change. Deleting the source data also deletes its links.
Resolve a review
POST /v1/workspaces/{workspace_id}/reviews/{environment}/{review_id}/resolve resolves a review against the exact account decision that your team looked at:
Resolve a review
expected_risk_versionis the account’scurrent_risk_versionthat your team reviewed.conclusionisbenign,abuseorinconclusive.- Send a
noteof 1 to 2,000 characters.
review_version_conflict in these cases:
- The review version or the account risk version changed.
- The review is already resolved.
- The account inputs changed and the decision is not current.
- NoResponse did not capture the decision at that risk version.
Read resolution history
Resolutions do not change. Reopening and resolving again adds a new one.GET .../resolutions pages through them, 1 to 100 per page. Pass next_before_version back as before_version to get older resolutions.
Save review views
A view is a saved review filter. It uses the same filters as the review list:account_id, status, priority, assignee, assignee_principal_id and unassigned.
POST /v1/workspaces/{workspace_id}/views/{environment} saves a view:
TypeScript
- A private view (
shared: false) is visible only to its owner. - A shared view is visible to everyone with review access in the environment.
- Only the owner can change or delete a view. A change or delete of a view that you do not own answers 404
not_found.owner_typeisuserfor a member orapi_keyfor an API key.owner_principal_idis the permanent id of that member or key. - NoResponse saves an
assigneefilter as the member’sassignee_principal_id. namehas 1 to 100 characters.
GET .../views/{environment} lists your private views and all shared views. PATCH .../{view_id} replaces the name, sharing and filter. DELETE .../{view_id} deletes the view and answers 204. Both send expected_version, the view version that you read. A new view sends no expected_version, or 0. A stale version answers 409 review_version_conflict.
An owner has at most 100 views. An environment has at most 100 shared views. Another view answers 409 review_limit_reached.
Export a review
GET /v1/workspaces/{workspace_id}/reviews/{environment}/{review_id}/export returns the review with its comments, resolutions and evidence links. An API key needs management and one of exports, history or audit_manage. A member needs both review access and export access. NoResponse records the download in the audit log before it returns data. If it cannot record the download, the export fails.
The export holds at most 10,000 records and 8 MiB. A larger review answers 413 review_export_too_large, never a partial export. Use the paged comment and resolution operations instead.
Account exports do not include reviews.
Related pages
Feedback and investigations
Report outcomes, search accounts and export account history.
Connect an agent
The MCP tools for reviews and saved views.