Create Rule

curl --request POST \
  --url http://api.gu1.ai/rules \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "description": "<string>",
  "category": "<string>",
  "targetEntityTypes": [
    {}
  ],
  "conditions": {},
  "actions": [
    {}
  ],
  "enabled": true,
  "priority": 123,
  "score": 123,
  "status": "<string>",
  "evaluationMode": "<string>",
  "riskMatrixId": "<string>",
  "countries": [
    {}
  ],
  "scope": {},
  "tags": [
    {}
  ],
  "creationProvenance": {}
}
'

import requests

url = "http://api.gu1.ai/rules"

payload = {
    "name": "<string>",
    "description": "<string>",
    "category": "<string>",
    "targetEntityTypes": [{}],
    "conditions": {},
    "actions": [{}],
    "enabled": True,
    "priority": 123,
    "score": 123,
    "status": "<string>",
    "evaluationMode": "<string>",
    "riskMatrixId": "<string>",
    "countries": [{}],
    "scope": {},
    "tags": [{}],
    "creationProvenance": {}
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: '<string>',
    description: '<string>',
    category: '<string>',
    targetEntityTypes: [{}],
    conditions: {},
    actions: [{}],
    enabled: true,
    priority: 123,
    score: 123,
    status: '<string>',
    evaluationMode: '<string>',
    riskMatrixId: '<string>',
    countries: [{}],
    scope: {},
    tags: [{}],
    creationProvenance: {}
  })
};

fetch('http://api.gu1.ai/rules', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "http://api.gu1.ai/rules",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => '<string>',
    'description' => '<string>',
    'category' => '<string>',
    'targetEntityTypes' => [
        [
                
        ]
    ],
    'conditions' => [
        
    ],
    'actions' => [
        [
                
        ]
    ],
    'enabled' => true,
    'priority' => 123,
    'score' => 123,
    'status' => '<string>',
    'evaluationMode' => '<string>',
    'riskMatrixId' => '<string>',
    'countries' => [
        [
                
        ]
    ],
    'scope' => [
        
    ],
    'tags' => [
        [
                
        ]
    ],
    'creationProvenance' => [
        
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "http://api.gu1.ai/rules"

	payload := strings.NewReader("{\n  \"name\": \"<string>\",\n  \"description\": \"<string>\",\n  \"category\": \"<string>\",\n  \"targetEntityTypes\": [\n    {}\n  ],\n  \"conditions\": {},\n  \"actions\": [\n    {}\n  ],\n  \"enabled\": true,\n  \"priority\": 123,\n  \"score\": 123,\n  \"status\": \"<string>\",\n  \"evaluationMode\": \"<string>\",\n  \"riskMatrixId\": \"<string>\",\n  \"countries\": [\n    {}\n  ],\n  \"scope\": {},\n  \"tags\": [\n    {}\n  ],\n  \"creationProvenance\": {}\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("http://api.gu1.ai/rules")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"<string>\",\n  \"description\": \"<string>\",\n  \"category\": \"<string>\",\n  \"targetEntityTypes\": [\n    {}\n  ],\n  \"conditions\": {},\n  \"actions\": [\n    {}\n  ],\n  \"enabled\": true,\n  \"priority\": 123,\n  \"score\": 123,\n  \"status\": \"<string>\",\n  \"evaluationMode\": \"<string>\",\n  \"riskMatrixId\": \"<string>\",\n  \"countries\": [\n    {}\n  ],\n  \"scope\": {},\n  \"tags\": [\n    {}\n  ],\n  \"creationProvenance\": {}\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("http://api.gu1.ai/rules")

http = Net::HTTP.new(url.host, url.port)

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"<string>\",\n  \"description\": \"<string>\",\n  \"category\": \"<string>\",\n  \"targetEntityTypes\": [\n    {}\n  ],\n  \"conditions\": {},\n  \"actions\": [\n    {}\n  ],\n  \"enabled\": true,\n  \"priority\": 123,\n  \"score\": 123,\n  \"status\": \"<string>\",\n  \"evaluationMode\": \"<string>\",\n  \"riskMatrixId\": \"<string>\",\n  \"countries\": [\n    {}\n  ],\n  \"scope\": {},\n  \"tags\": [\n    {}\n  ],\n  \"creationProvenance\": {}\n}"

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "name": "<string>",
  "description": "<string>",
  "organizationId": "<string>",
  "status": "<string>",
  "enabled": true,
  "version": 123,
  "createdAt": "<string>",
  "createdBy": "<string>",
  "creationProvenance": {},
  "aiReview": {}
}

POST

rules

Create Rule

curl --request POST \
  --url http://api.gu1.ai/rules \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "<string>",
  "description": "<string>",
  "category": "<string>",
  "targetEntityTypes": [
    {}
  ],
  "conditions": {},
  "actions": [
    {}
  ],
  "enabled": true,
  "priority": 123,
  "score": 123,
  "status": "<string>",
  "evaluationMode": "<string>",
  "riskMatrixId": "<string>",
  "countries": [
    {}
  ],
  "scope": {},
  "tags": [
    {}
  ],
  "creationProvenance": {}
}
'

import requests

url = "http://api.gu1.ai/rules"

payload = {
    "name": "<string>",
    "description": "<string>",
    "category": "<string>",
    "targetEntityTypes": [{}],
    "conditions": {},
    "actions": [{}],
    "enabled": True,
    "priority": 123,
    "score": 123,
    "status": "<string>",
    "evaluationMode": "<string>",
    "riskMatrixId": "<string>",
    "countries": [{}],
    "scope": {},
    "tags": [{}],
    "creationProvenance": {}
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: '<string>',
    description: '<string>',
    category: '<string>',
    targetEntityTypes: [{}],
    conditions: {},
    actions: [{}],
    enabled: true,
    priority: 123,
    score: 123,
    status: '<string>',
    evaluationMode: '<string>',
    riskMatrixId: '<string>',
    countries: [{}],
    scope: {},
    tags: [{}],
    creationProvenance: {}
  })
};

fetch('http://api.gu1.ai/rules', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "http://api.gu1.ai/rules",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => '<string>',
    'description' => '<string>',
    'category' => '<string>',
    'targetEntityTypes' => [
        [
                
        ]
    ],
    'conditions' => [
        
    ],
    'actions' => [
        [
                
        ]
    ],
    'enabled' => true,
    'priority' => 123,
    'score' => 123,
    'status' => '<string>',
    'evaluationMode' => '<string>',
    'riskMatrixId' => '<string>',
    'countries' => [
        [
                
        ]
    ],
    'scope' => [
        
    ],
    'tags' => [
        [
                
        ]
    ],
    'creationProvenance' => [
        
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "http://api.gu1.ai/rules"

	payload := strings.NewReader("{\n  \"name\": \"<string>\",\n  \"description\": \"<string>\",\n  \"category\": \"<string>\",\n  \"targetEntityTypes\": [\n    {}\n  ],\n  \"conditions\": {},\n  \"actions\": [\n    {}\n  ],\n  \"enabled\": true,\n  \"priority\": 123,\n  \"score\": 123,\n  \"status\": \"<string>\",\n  \"evaluationMode\": \"<string>\",\n  \"riskMatrixId\": \"<string>\",\n  \"countries\": [\n    {}\n  ],\n  \"scope\": {},\n  \"tags\": [\n    {}\n  ],\n  \"creationProvenance\": {}\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("http://api.gu1.ai/rules")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"<string>\",\n  \"description\": \"<string>\",\n  \"category\": \"<string>\",\n  \"targetEntityTypes\": [\n    {}\n  ],\n  \"conditions\": {},\n  \"actions\": [\n    {}\n  ],\n  \"enabled\": true,\n  \"priority\": 123,\n  \"score\": 123,\n  \"status\": \"<string>\",\n  \"evaluationMode\": \"<string>\",\n  \"riskMatrixId\": \"<string>\",\n  \"countries\": [\n    {}\n  ],\n  \"scope\": {},\n  \"tags\": [\n    {}\n  ],\n  \"creationProvenance\": {}\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("http://api.gu1.ai/rules")

http = Net::HTTP.new(url.host, url.port)

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"<string>\",\n  \"description\": \"<string>\",\n  \"category\": \"<string>\",\n  \"targetEntityTypes\": [\n    {}\n  ],\n  \"conditions\": {},\n  \"actions\": [\n    {}\n  ],\n  \"enabled\": true,\n  \"priority\": 123,\n  \"score\": 123,\n  \"status\": \"<string>\",\n  \"evaluationMode\": \"<string>\",\n  \"riskMatrixId\": \"<string>\",\n  \"countries\": [\n    {}\n  ],\n  \"scope\": {},\n  \"tags\": [\n    {}\n  ],\n  \"creationProvenance\": {}\n}"

response = http.request(request)
puts response.read_body

{
  "id": "<string>",
  "name": "<string>",
  "description": "<string>",
  "organizationId": "<string>",
  "status": "<string>",
  "enabled": true,
  "version": 123,
  "createdAt": "<string>",
  "createdBy": "<string>",
  "creationProvenance": {},
  "aiReview": {}
}

Overview

Creates a new rule for automated risk detection, compliance monitoring, and fraud prevention. Every create runs a synchronous AI review (included; not debited from your AI token wallet) before the rule is persisted. New rules are always stored as in_progress with enabled: false so you can review suggestions and activate manually.

Request fields status and enabled on create are ignored — the API coerces status: in_progress and enabled: false. Expect several seconds of latency while the review completes. Bundle or template flows that create many rules run one review per rule.

Endpoint

POST http://api.gu1.ai/rules

Authentication

Requires a valid API key in the Authorization header:

Authorization: Bearer YOUR_API_KEY

Request Body

string

required

Descriptive name for the rule

string

required

Detailed description of what the rule detects

string

required

Category of the rule: kyc, kyb, aml, fraud, compliance, custom

array

required

Array of entity types this rule applies to: ["person"], ["company"], ["transaction"], ["person", "company"]

object

required

Condition logic structure (see Condition Structure below)

array

required

Array of actions to execute when conditions match (see Actions below)

boolean

Ignored on create — rules are always stored with enabled: false.

number

default:"50"

Rule priority (1-100). Higher values = higher priority

number

Risk score to assign when rule matches (0-100). Used in score-based risk matrices

string

Ignored on create — rules are always stored as in_progress (configuration).

string

default:"async"

Evaluation mode: sync (immediate) or async (background processing)

string

UUID of the risk matrix to associate this rule with

array

Array of ISO country codes to restrict rule execution: ["BR", "AR", "US"]

object

Additional scope configuration including temporal windows and triggers

array

Array of tags for organizing rules: ["high-risk", "pep", "sanctions"]

object

Optional origin metadata persisted on the rule. If omitted, the API defaults to sourceType: api (API key) or user (session). Fields: sourceType (user | agent | import_json | template | bundle | api), conversationId, messageId, platformAgentCategory, triggeredByUserId.

Condition Structure

Rules use a nested condition structure with logical operators:

{
  "operator": "AND" | "OR" | "NOT" | "XOR",
  "conditions": [
    {
      "id": "cond-unique-id",
      "type": "simple",
      "field": "enrichmentData.normalized.taxId",
      "operator": "eq",
      "value": "12.345.678/0001-90",
      "filters": [],
      "countryMetadata": {
        "countryCode": "BR",
        "confidence": 100,
        "manuallySet": true,
        "autoDetected": false,
        "reason": "Selected from BR enrichment fields"
      }
    }
  ]
}

Condition Fields

operator: Logical operator connecting conditions (AND, OR, NOT, XOR)
conditions: Array of condition objects (can be nested for complex logic)
id: Unique identifier for the condition
type: Condition type (simple, complex, array, object)
field: Field path to evaluate (e.g., taxId, entityData.company.revenue, enrichmentData.normalized.sanctions.$.type)
operator: Comparison operator (see Operators below)
value: Value to compare against
filters: Array of filters for array/object fields
countryMetadata: Country-specific metadata for the condition

Operators

Comparison Operators

eq - Equals
neq - Not equals
gt - Greater than
gte - Greater than or equal
lt - Less than
lte - Less than or equal

String Operators

contains - Contains substring
notContains - Does not contain substring
startsWith - Starts with
endsWith - Ends with
regex - Matches regular expression

Array Operators

in - Value is in array
notIn - Value is not in array
hasAny - Has any of the values
hasAll - Has all of the values

List Operators

inList - Value exists in a data list
notInList - Value does not exist in a data list

Existence Operators

exists - Field exists
notExists - Field does not exist
isEmpty - Field is empty/null
isNotEmpty - Field is not empty/null

Boolean Operators

isTrue - Boolean field is true
isFalse - Boolean field is false

Array Field Syntax

For fields within arrays, use the $ symbol:

{
  "field": "enrichmentData.normalized.sanctions.$.type",
  "operator": "in",
  "value": "terrorism",
  "filters": []
}

This evaluates if ANY item in the sanctions array has type equal to "terrorism".

Filters

You can pre-filter array items before evaluation:

{
  "field": "enrichmentData.normalized.legalProceedings.$.amount",
  "operator": "gt",
  "value": 100000,
  "filters": [
    {
      "field": "status",
      "operator": "eq",
      "value": "active"
    }
  ]
}

This evaluates if ANY active legal proceeding has an amount greater than 100,000.

Actions

Rules support multiple action types:

Create Alert

{
  "type": "createAlert",
  "createAlert": {
    "type": "FRAUD" | "COMPLIANCE" | "AML" | "KYC" | "OTHER",
    "title": "High Risk Transaction Detected",
    "description": "Transaction exceeds threshold",
    "severity": "LOW" | "MEDIUM" | "HIGH" | "CRITICAL",
    "recipients": ["user@example.com"]
  },
  "tags": ["high-value", "cross-border"]
}

Update Entity Status

{
  "type": "updateEntityStatus",
  "updateEntityStatus": {
    "status": "blocked",
    "reason": "Failed sanctions check"
  }
}

Send Notification

{
  "type": "sendNotification",
  "sendNotification": {
    "channel": "email" | "sms" | "webhook",
    "recipients": ["compliance@company.com"],
    "message": "Urgent: High risk entity detected"
  }
}

Create Case

{
  "type": "createCase",
  "createCase": {
    "title": "PEP Investigation Required",
    "description": "Entity flagged as politically exposed person",
    "assignee": "user-uuid"
  }
}

Example Requests

Simple KYC Rule - Check Tax ID

curl -X POST http://api.gu1.ai/rules \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "CNPJ Blocklist Check",
    "description": "Block companies with specific CNPJ",
    "category": "kyb",
    "targetEntityTypes": ["company"],
    "enabled": true,
    "priority": 100,
    "score": 85,
    "conditions": {
      "operator": "AND",
      "conditions": [
        {
          "id": "cond-1",
          "type": "simple",
          "field": "enrichmentData.normalized.taxId",
          "operator": "eq",
          "value": "33.592.510/0001-54",
          "filters": [],
          "countryMetadata": {
            "countryCode": "BR",
            "confidence": 100,
            "manuallySet": true,
            "autoDetected": false,
            "reason": "Selected from BR enrichment fields"
          }
        }
      ]
    },
    "actions": [
      {
        "type": "createAlert",
        "createAlert": {
          "type": "COMPLIANCE",
          "title": "Blocklisted Company Detected",
          "description": "Company CNPJ found in blocklist",
          "severity": "CRITICAL",
          "recipients": ["compliance@company.com"]
        },
        "tags": ["blocklist", "high-priority"]
      },
      {
        "type": "updateEntityStatus",
        "updateEntityStatus": {
          "status": "blocked",
          "reason": "CNPJ in blocklist"
        }
      }
    ],
    "scope": {
      "type": "entity",
      "countries": ["BR"],
      "entityTypes": ["company"]
    },
    "status": "active",
    "evaluationMode": "sync"
  }'

const response = await fetch('http://api.gu1.ai/rules', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: 'CNPJ Blocklist Check',
    description: 'Block companies with specific CNPJ',
    category: 'kyb',
    targetEntityTypes: ['company'],
    enabled: true,
    priority: 100,
    score: 85,
    conditions: {
      operator: 'AND',
      conditions: [
        {
          id: 'cond-1',
          type: 'simple',
          field: 'enrichmentData.normalized.taxId',
          operator: 'eq',
          value: '33.592.510/0001-54',
          filters: [],
          countryMetadata: {
            countryCode: 'BR',
            confidence: 100,
            manuallySet: true,
            autoDetected: false,
            reason: 'Selected from BR enrichment fields'
          }
        }
      ]
    },
    actions: [
      {
        type: 'createAlert',
        createAlert: {
          type: 'COMPLIANCE',
          title: 'Blocklisted Company Detected',
          description: 'Company CNPJ found in blocklist',
          severity: 'CRITICAL',
          recipients: ['compliance@company.com']
        },
        tags: ['blocklist', 'high-priority']
      }
    ],
    scope: {
      type: 'entity',
      countries: ['BR'],
      entityTypes: ['company']
    },
    status: 'active',
    evaluationMode: 'sync'
  })
});

const rule = await response.json();
console.log('Rule created:', rule.id);

import requests

response = requests.post(
    'http://api.gu1.ai/rules',
    headers={
        'Authorization': 'Bearer YOUR_API_KEY',
        'Content-Type': 'application/json'
    },
    json={
        'name': 'CNPJ Blocklist Check',
        'description': 'Block companies with specific CNPJ',
        'category': 'kyb',
        'targetEntityTypes': ['company'],
        'enabled': True,
        'priority': 100,
        'score': 85,
        'conditions': {
            'operator': 'AND',
            'conditions': [
                {
                    'id': 'cond-1',
                    'type': 'simple',
                    'field': 'enrichmentData.normalized.taxId',
                    'operator': 'eq',
                    'value': '33.592.510/0001-54',
                    'filters': [],
                    'countryMetadata': {
                        'countryCode': 'BR',
                        'confidence': 100,
                        'manuallySet': True,
                        'autoDetected': False,
                        'reason': 'Selected from BR enrichment fields'
                    }
                }
            ]
        },
        'actions': [
            {
                'type': 'createAlert',
                'createAlert': {
                    'type': 'COMPLIANCE',
                    'title': 'Blocklisted Company Detected',
                    'description': 'Company CNPJ found in blocklist',
                    'severity': 'CRITICAL',
                    'recipients': ['compliance@company.com']
                },
                'tags': ['blocklist', 'high-priority']
            }
        ],
        'scope': {
            'type': 'entity',
            'countries': ['BR'],
            'entityTypes': ['company']
        },
        'status': 'active',
        'evaluationMode': 'sync'
    }
)

rule = response.json()
print(f"Rule created: {rule['id']}")

Complex Rule - Sanctions Check with Multiple Conditions

curl -X POST http://api.gu1.ai/rules \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Terrorism Sanctions Check",
    "description": "Detect entities with terrorism-related sanctions",
    "category": "aml",
    "targetEntityTypes": ["person", "company"],
    "enabled": true,
    "priority": 100,
    "score": 95,
    "conditions": {
      "operator": "OR",
      "conditions": [
        {
          "id": "cond-1",
          "type": "simple",
          "field": "enrichmentData.normalized.sanctions.$.type",
          "operator": "in",
          "value": "terrorism",
          "filters": [],
          "countryMetadata": {
            "countryCode": "GLOBAL",
            "confidence": 100,
            "manuallySet": true,
            "autoDetected": false,
            "reason": "Global sanctions field"
          }
        },
        {
          "id": "cond-2",
          "type": "simple",
          "field": "enrichmentData.normalized.sanctioned",
          "operator": "isTrue",
          "value": true,
          "filters": []
        }
      ]
    },
    "actions": [
      {
        "type": "createAlert",
        "createAlert": {
          "type": "AML",
          "title": "Sanctions Match - Immediate Review Required",
          "description": "Entity matched terrorism sanctions list",
          "severity": "CRITICAL",
          "recipients": ["aml-team@company.com"]
        },
        "tags": ["sanctions", "terrorism", "critical"]
      },
      {
        "type": "updateEntityStatus",
        "updateEntityStatus": {
          "status": "blocked",
          "reason": "Terrorism sanctions match"
        }
      },
      {
        "type": "createCase",
        "createCase": {
          "title": "Sanctions Investigation Required",
          "description": "Entity flagged for terrorism-related sanctions",
          "assignee": "compliance-lead-uuid"
        }
      }
    ],
    "scope": {
      "type": "entity",
      "entityTypes": ["person", "company"]
    },
    "status": "active",
    "evaluationMode": "sync",
    "tags": ["sanctions", "aml", "critical"]
  }'

Transaction Monitoring Rule

curl -X POST http://api.gu1.ai/rules \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "High Value Transaction Alert",
    "description": "Alert on transactions over $50,000 USD",
    "category": "fraud",
    "targetEntityTypes": ["transaction"],
    "enabled": true,
    "priority": 80,
    "score": 70,
    "conditions": {
      "operator": "AND",
      "conditions": [
        {
          "id": "cond-1",
          "type": "simple",
          "field": "amountInUsd",
          "operator": "gt",
          "value": 50000,
          "filters": []
        },
        {
          "id": "cond-2",
          "type": "simple",
          "field": "status",
          "operator": "eq",
          "value": "PENDING",
          "filters": []
        }
      ]
    },
    "actions": [
      {
        "type": "createAlert",
        "createAlert": {
          "type": "FRAUD",
          "title": "High Value Transaction Detected",
          "description": "Transaction exceeds $50,000 threshold",
          "severity": "HIGH",
          "recipients": ["fraud-team@company.com"]
        },
        "tags": ["high-value", "pending-review"]
      }
    ],
    "scope": {
      "type": "transaction"
    },
    "status": "active",
    "evaluationMode": "sync"
  }'

Response

string

UUID of the created rule

string

Rule name

string

Rule description

string

Your organization ID

string

Current rule status

boolean

Whether rule is enabled

number

Rule version number

string

ISO timestamp of creation

string

User ID who created the rule

object

Origin metadata (sourceType, optional agent chat ids).

object

Synchronous AI review summary: verified, reason, functionalityDescription, suggestions, issues.

Response Example

{
  "success": true,
  "message": "Rule created successfully",
  "rule": {
  "id": "e2cdd639-52cc-4749-9b16-927bfa5dfaea",
  "organizationId": "71e8f908-e032-4fcb-b0ce-ad0cd0ffb236",
  "name": "CNPJ Blocklist Check",
  "description": "Block companies with specific CNPJ",
  "category": "kyb",
  "status": "in_progress",
  "enabled": false,
  "priority": 100,
  "score": 85,
  "conditions": {
    "operator": "AND",
    "conditions": [...]
  },
  "actions": [
    {
      "type": "createAlert",
      "createAlert": {...},
      "tags": ["blocklist", "high-priority"]
    }
  ],
  "scope": {
    "type": "entity",
    "countries": ["BR"],
    "entityTypes": ["company"]
  },
  "targetEntityTypes": ["company"],
  "evaluationMode": "sync",
  "version": 1,
  "previousVersionId": null,
  "tags": [],
  "createdBy": "f35c10cb-9b67-4cda-9aea-f36567375dba",
  "createdAt": "2024-12-23T10:00:00.000Z",
  "updatedAt": "2024-12-23T10:00:00.000Z",
  "stats": {
    "executions": 0,
    "successes": 0,
    "failures": 0
  }
  },
  "aiReview": {
    "verified": true,
    "reason": "Conditions align with description.",
    "functionalityDescription": "Creates a KYB alert when the CNPJ matches the blocklist.",
    "suggestions": [],
    "issues": []
  }
}

Error Responses

400 Bad Request - Invalid Condition

{
  "error": "Validation failed",
  "details": {
    "field": "conditions",
    "message": "Invalid operator 'xyz'"
  }
}

400 Bad Request - Missing Required Fields

{
  "error": "Validation failed",
  "details": {
    "missingFields": ["name", "targetEntityTypes", "conditions"]
  }
}

401 Unauthorized

{
  "error": "Invalid or missing API key"
}

Best Practices

Start with Shadow Mode: Use status: "shadow" to test rules without affecting production
Use Descriptive Names: Make rule names clear and searchable
Set Appropriate Priorities: Higher priority rules execute first (1-100 scale)
Tag Your Rules: Use tags for organization and filtering
Country-Specific Rules: Use scope.countries for geo-specific compliance
Test Thoroughly: Test rules with sample data before enabling
Monitor Performance: Use sync mode for critical real-time rules, async for batch processing
Score Strategically: Align scores with your risk matrix thresholds

​Overview

​Endpoint

​Authentication

​Request Body

​Condition Structure

​Condition Fields

​Operators

​Comparison Operators

​String Operators

​Array Operators

​List Operators

​Existence Operators

​Boolean Operators

​Array Field Syntax

​Filters

​Actions

​Create Alert

​Update Entity Status

​Send Notification

​Create Case

​Example Requests

​Simple KYC Rule - Check Tax ID

​Complex Rule - Sanctions Check with Multiple Conditions

​Transaction Monitoring Rule

​Response

​Response Example

​Error Responses

​400 Bad Request - Invalid Condition

​400 Bad Request - Missing Required Fields

​401 Unauthorized

​Best Practices

​See Also

Overview

Endpoint

Authentication

Request Body

Condition Structure

Condition Fields

Operators

Comparison Operators

String Operators

Array Operators

List Operators

Existence Operators

Boolean Operators

Array Field Syntax

Filters

Actions

Create Alert

Update Entity Status

Send Notification

Create Case

Example Requests

Simple KYC Rule - Check Tax ID

Complex Rule - Sanctions Check with Multiple Conditions

Transaction Monitoring Rule

Response

Response Example

Error Responses

400 Bad Request - Invalid Condition

400 Bad Request - Missing Required Fields

401 Unauthorized

Best Practices

See Also