Start workflow run

Run a coordinated risk workflow.

Required scope: workflows:execute. AMLOK returns evidence and assessment results. The institution performs all borrower outreach and intervention in its own systems. Once account cancellation is submitted, processing and usage deductions stop immediately. Reject new operational commands with 409 invalid_state; pending work is cancelled without another debit. Read-only reporting remains available until workspace deletion. Billable work requires available credits covering its cost; otherwise return 402 insufficient_credits before accepting work, with no debit. A separately requested full underwriting uses Insights. Signal change-driven reassessment is included in Signal and does not create an additional Insights charge. A root underwrite request is a full Insights underwriting and requires application_id and input_manifest_id. Other workflow types require processing_context and are included stages. Signal reassessment is a Signal child run, never a separately billed root underwrite. Workload checks reject known over-limit inputs with 422 workload_limit_exceeded. If discovery reveals more records later, pause as blocked_by_limit before processing beyond the limit. No automatic tier upgrade occurs. Available credits are checked at acceptance and again atomically with output publication and the one usage debit at successful completion. No credits are reserved. If funds were spent by concurrent work, keep the run waiting_for_credits and withhold its final output; resume without duplicate processing when funded. Cancelled runs never publish or charge. Each evidence manifest is immutable. While an unfinished run waits for required evidence, accepted evidence can create a successor manifest; retain initial_input_manifest_id, update input_manifest_id and record_version, and emit an audit event identifying both manifests. The final snapshot and usage link to the final manifest. This continuation keeps the same run and single charge. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt.

POST /v1/workflow-runs

cURL

cURL

curl --request POST --fail-with-body --max-time 30 \
  "${AMLOK_API_BASE_URL}/v1/workflow-runs" \
  --header "Authorization: Bearer ${AMLOK_API_KEY}" \
  --header "Accept: application/json" \
  --header 'Idempotency-Key: idem_example_1001' \
  --header 'Content-Type: application/json' \
  --data '{
  "subject_id": "biz_example",
  "workflow_type": "underwrite",
  "workflow_version": "underwrite-v1",
  "input_resource_ids": [
    "app_example",
    "doc_example"
  ],
  "application_id": "app_example",
  "input_manifest_id": "manifest_example"
}'

202

synthetic

{
  "data": {
    "id": "wfr_example",
    "object": "workflow_run",
    "subject_id": "biz_example",
    "created_at": "2026-10-22T13:00:00Z",
    "updated_at": "2026-10-22T14:00:00Z",
    "record_version": 1,
    "source_refs": [],
    "data_status": "pending",
    "missing_fields": [],
    "schema_version": "1.4.2",
    "workflow_type": "underwrite",
    "workflow_version": "underwrite-v1",
    "status": "queued",
    "input_resource_ids": [
      "app_example",
      "doc_example"
    ],
    "output_resource_ids": [],
    "application_id": "app_example",
    "product": "insights",
    "input_manifest_id": "manifest_example",
    "initial_input_manifest_id": "manifest_example",
    "workload_id": "workload_example",
    "billing_usage_id": null,
    "monitoring_period_id": null,
    "blocked_reason": null,
    "stop_reason": null,
    "failure": null,
    "attempt": 1
  },
  "meta": {
    "request_id": "req_example",
    "schema_version": "1.4.2",
    "generated_at": "2026-10-23T14:00:00Z",
    "data_status": "pending"
  }
}

Required scope: workflows:execute

Run a coordinated risk workflow.

Required scope: workflows:execute. AMLOK returns evidence and assessment results. The institution performs all borrower outreach and intervention in its own systems. Once account cancellation is submitted, processing and usage deductions stop immediately. Reject new operational commands with 409 invalid_state; pending work is cancelled without another debit. Read-only reporting remains available until workspace deletion. Billable work requires available credits covering its cost; otherwise return 402 insufficient_credits before accepting work, with no debit. A separately requested full underwriting uses Insights. Signal change-driven reassessment is included in Signal and does not create an additional Insights charge. A root underwrite request is a full Insights underwriting and requires application_id and input_manifest_id. Other workflow types require processing_context and are included stages. Signal reassessment is a Signal child run, never a separately billed root underwrite. Workload checks reject known over-limit inputs with 422 workload_limit_exceeded. If discovery reveals more records later, pause as blocked_by_limit before processing beyond the limit. No automatic tier upgrade occurs. Available credits are checked at acceptance and again atomically with output publication and the one usage debit at successful completion. No credits are reserved. If funds were spent by concurrent work, keep the run waiting_for_credits and withhold its final output; resume without duplicate processing when funded. Cancelled runs never publish or charge. Each evidence manifest is immutable. While an unfinished run waits for required evidence, accepted evidence can create a successor manifest; retain initial_input_manifest_id, update input_manifest_id and record_version, and emit an audit event identifying both manifests. The final snapshot and usage link to the final manifest. This continuation keeps the same run and single charge. Accepted commands have a durable request receipt. Full response replay lasts 24 hours; afterward the same key and target return 409 idempotency_result_expired without re-execution. Different payloads return 409 idempotency_conflict. Use GET /v1/request-receipts/lookup to find the original resource. The fingerprint includes the resolved target path and intended payload; a key used on another target is rejected rather than replayed onto it. Pre-execution validation or insufficient-credit rejection creates no accepted receipt.

Product scope · Processing lifecycle · Errors

Authorizations

Authorization · string · header · required

Server-to-server API key bound to exactly one workspace, institution tenant and environment. No caller-supplied workspace override is accepted. Do not use in public browser code.

Headers

X-Request-ID · string

Optional caller correlation ID; the response includes AMLOK request_id.

Idempotency-Key · string · required

Reuse for retries of the same intended command and identical payload. Retention: 24 hours.

Body

application/json

subject_id · string · required

Primary workflow subject.

Minimum string length: 1

workflow_type · enum<string> · required

One of four assessment workflow types.

Available options: verify, underwrite, monitor, investigate

workflow_version · string · required

Approved ID from GET /v1/configuration workflow_versions, matching this workflow type and product.

Minimum string length: 1

input_resource_ids · string[] · required

Input records authorized for this run.

Minimum array length: 1

input_manifest_id · string · required

Ready immutable initial manifest for this run. All input references must exist in this manifest. Its ID is retained as initial_input_manifest_id. Accepted missing evidence can produce a successor manifest without changing the run or creating another charge; the current input_manifest_id and audit event identify it.

Minimum string length: 1

processing_context · object

Parent must belong to this workspace. Same-subject stages need no association. Only person KYC may target a different subject: supply an active subject_association_id linking that person to the parent business. Insights requires an unfinished authorized root run; Signal requires an active paid period. Stage scope, consent, association and workload are checked on every attempt. The parent business remains the billing and workload subject. No standalone service or extra charge.

Option 1

Option 2

Show child attributes

application_id · string

Application context if applicable.

Minimum string length: 1

loan_id · string

Loan context if applicable.

Minimum string length: 1

Response

202

application/json

Run a coordinated risk workflow. Accepted work is not yet complete.

data · workflow_run · object · required

Coordinated execution of Verify, Underwrite, Monitor or Investigate. Population depends on source and tenant entitlement.

Show child attributes

meta · object · required

Show child attributes