Cases and evidence packs

When something needs investigating, you open a case. When a bank needs to see it, you build an evidence pack.

Note

HalvorAI prepares evidence. It does not make filings or decisions about regulatory reports. An evidence pack supports your bank’s own investigation and any report the bank decides to make.

Cases

A case groups the things that belong to one incident: alerts, events, agents and screenings.

Action	Endpoint
Create a case	POST /v1/cases with a title, a priority (low, medium or high) and optional items
List and read	GET /v1/cases, GET /v1/cases/{id}
Add an item	POST /v1/cases/{id}/items with a type (alert, event, agent or screening) and an id
Remove an item	DELETE /v1/cases/{id}/items/{itemId}. The removal is logged.
Add a note	POST /v1/cases/{id}/notes. Notes cannot be edited or deleted.
Change status	POST /v1/cases/{id}/status to open, in_review or closed, with a closing note

Escalating an alert creates or adds to a case. Notes are append-only, so the record of what the team knew and when stays intact.

Evidence packs

A pack is what you hand your sponsor bank. It is written so a compliance analyst can read it in five minutes, import it into their case tool, and verify it without trusting HalvorAI.

Kind	Built from	Contains
Case pack	One case	The agents, owners, events, evidence, verification results, screenings, alerts, analyst notes and a timeline
Due-diligence report	A date range, the whole organization	An agent inventory, volumes by rail, the five coverage metrics, detector and screening statistics, list freshness and a description of controls

Build a case pack with POST /v1/cases/{id}/packs and a profile. Build a report with POST /v1/reports/due-diligence with from, to and profile. Both return 202: the pack is built in the background, and GET /v1/packs lists packs with their status when it is ready.

curl -X POST https://api.sandbox.halvorai.com/v1/cases/cas_01JA8X.../packs \
  -H "Authorization: Bearer $HALVOR_API_KEY" -H "Content-Type: application/json" \
  -d '{ "profile": "generic" }'

What is inside the zip

pck_01J.../
  summary.pdf         human-readable summary
  manifest.json       every file with its SHA-256, plus pack metadata
  manifest.jws        the manifest, signed with HalvorAI's pack key
  events.jsonl        the events as received, with their signatures
  evidence/           every evidence value
  results.json        verifications, mandate evaluations, screenings, alerts, actions
  chain.json          chain positions and the daily anchors that cover them
  timeline.csv        one row per event, alert and action, in time order
  export/<profile>.csv  an import file for a case tool
  README.txt          how to verify the pack

Export profiles

Profile	Use
generic	One row per payment with transaction, agent, owner, payee, instruction, mandate, verification and screening columns
actimize, feedzai, verafin	The generic columns renamed and ordered for that case tool. These are first versions; your bank’s real column specification replaces them.

Share a pack

POST /v1/packs/{id}/share with expires_in_days (at most 30) returns a link. Anyone with the link can read the summary and timeline and download the zip, with no login. The link is random, only its hash is stored, and each view is logged. Revoke it at any time with DELETE /v1/share-links/{id}.

Packs are stored in US regions with a seven-year retention lock that nobody, including HalvorAI, can shorten.

Verify a pack

A reviewer can check everything in a pack offline. See verify an evidence pack. To be told when a pack is ready, use the pack.ready webhook.

The five numbers

A due-diligence report leads with the five figures banks ask for: attribution coverage, verification coverage, screening coverage, alerts by detector with false-positive rates, and median time to acknowledge. They are also available live from GET /v1/metrics/overview.