API

Authenticate with Bearer keys (azw_live_… / azw_test_…). Optional Idempotency-Key header on screen calls (8–255 chars; same key + same body replays the original result; different body → 409). Base path /api/v1. Machine-readable contract: /openapi.json.

Endpoints

• GET /health — liveness
• GET /health/ready — DB + list freshness
• GET /me — organisation, plan, key scopes, environment
• GET /usage — period meters vs quotas
• GET /lists — current auditable list snapshots
• POST /screens/person — live sanctions / terror designation matching · passport / national ID when present on lists
• POST /screens/entity — organisation / legal-name + registration number
• POST /screens/wallet — designated wallets when present on list snapshots
• POST /screens/address — listed addresses from OFAC + ZA FIC TFS snapshots
• POST /screens/compromised — endpoint ready; compromised email/phone corpus is roadmap (returns honest coverage gaps until ingested)
• GET /screens/{resultId} — retrieve evidence
• POST /ai/adverse-media — live GDELT discovery (search: true) with citations + optional OpenAI summary, or summarise excerpts you supply (advisory; not a deterministic screening corpus)
• GET /cases · GET|PATCH /cases/{id} · GET /cases/{id}/export — case workflow + evidence pack
• GET /audit/export — audit log download
• GET /graph/{profileId} — relationship neighbors (shared addresses / graph-lite)
• GET|POST /monitor — continuous watches (person / entity / wallet); rescreened when lists refresh · monitor:manage
• POST|DELETE /monitor/{watchId} — force rescreen or disable
• GET|POST /webhooks — signed event delivery (monitor.alert on status worsening)

curl -s https://apzwatch.apzportal.apzor.com/api/v1/screens/person \
  -H "Authorization: Bearer azw_live_…" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: person-kyc-001" \
  -d '{
    "fullName": "Jane Example",
    "givenName": "Jane",
    "familyName": "Example",
    "dateOfBirth": "1980-01-15",
    "nationality": "ZA",
    "countryOfResidence": "ZA",
    "email": "jane@example.com",
    "passportNumber": "A12345678",
    "nationalId": "8001015009087"
  }'

# Every screen response includes auditable listVersions
# (listName, listCode, effectiveDate, publishedAt, fetchedAt,
#  recordCount, contentHash, sourceUrl).
# Live hit categories today: sanctions | terror | wallet_designation
# Hits include matchBand (strong|likely|possible|unlikely), matchReasons, entityProfileId.
# Exact name alone is never strong — needs DOB/country/ID/wallet corroboration.
# (durable adverse_media / compromised corpora still expanding)