> ## Documentation Index > Fetch the complete documentation index at: https://docs.didit.me/llms.txt > Use this file to discover all available pages before exploring further. # Export AML Screening History > Download the ongoing AML monitoring history of a session as a CSV file, one line per completed re-screen, ready to hand to an auditor. Export AML Screening History API Prompt Copy prompt to clipboard 
  \`Download the ongoing AML monitoring history of one Didit verification session as a CSV file through the API.

  Endpoint:
  GET [https://verification.didit.me/v3/session/\{session\_id}/aml-screening-history/export/](https://verification.didit.me/v3/session/\{session_id}/aml-screening-history/export/)

  Authentication:
  Send my Didit API key in the x-api-key header. A scoped key needs decisions: read and media: read (the response is a file; without media: read the call returns 403).

  Goal:

  * Produce the audit evidence that ongoing AML monitoring ran for a subject, as a file a compliance team can hand to an auditor.

  Query parameters:

  * node\_id (optional): the workflow node ID of the AML check when the session ran several AML steps. Without it, the most recent AML check is used.

  Behavior:

  * Works for user (KYC) and business (KYB) session IDs.
  * Streams text/csv with Content-Disposition: attachment; filename="aml-screening-history-SESSION\_ID.csv". Not paginated: the file holds the whole history, newest first.
  * The first line is the header. Each following line is one completed re-screen.
  * Columns: screened\_at, outcome, provider, aml\_status, aml\_score, total\_hits, datasets\_captured\_at, datasets\_sanctions\_last\_updated\_at, datasets\_pep\_last\_updated\_at, datasets\_warnings\_last\_updated\_at, datasets\_adverse\_media\_last\_updated\_at, datasets\_catalog\_version.
  * Empty cell = unknown. Dataset dates are never estimated.
  * provider is an identifier of the data source; treat it as an opaque string.
  * Values that would start a spreadsheet formula (=, +, -, @) are prefixed with an apostrophe.
  * Errors come back as JSON, not CSV.

  Example call:
  curl -X GET "[https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/aml-screening-history/export/](https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/aml-screening-history/export/)" \
  -H "x-api-key: YOUR\_API\_KEY" \
  -o aml-screening-history.csv

  Failure modes:

  * 401: the API key has expired.
  * 403: missing or invalid key, a key of another application, a scoped key without decisions: read or media: read, or a request from outside the key's IP allowlist.
  * 404: the session does not exist, was deleted, or is outside a scoped key's limits, or it has no AML check (for that node\_id).

  Side effects: none. This is a pure read.

  For the full integration shape, see /integration/integration-prompt.\`
Paste into The file has the same screenings as [List AML screening history](/management-api/sessions/aml-screening-history.md), flattened to one line each, with the dataset update date of each list family (sanctions, PEP, warnings, adverse media) where one was reported. The Business Console offers the same export next to the AML result. See [Continuous AML monitoring](/core-technology/aml-screening/continuous-monitoring-aml-screening.md) for what each value means. ## OpenAPI ````yaml GET /v3/session/{sessionId}/aml-screening-history/export/ openapi: 3.0.0 info: version: 3.0.0 title: Didit Verification API description: Identity verification API. Authenticate with x-api-key header. servers: - url: https://verification.didit.me security: [] tags: [] paths: /v3/session/{sessionId}/aml-screening-history/export/: get: tags: - Sessions summary: Export AML screening history as CSV description: >- Download the same ongoing-monitoring history as `GET /v3/session/{sessionId}/aml-screening-history/` as a CSV file, one line per completed re-screen, newest first, ready to hand to an auditor. The file is streamed whole (no pagination) and starts with a header line; an empty cell means unknown, dataset dates are never estimated, and a value that would start a spreadsheet formula is prefixed with an apostrophe. Works for KYC and KYB session IDs; pass `node_id` when the session ran more than one AML step. Errors are returned as JSON, not CSV. A scoped API key needs `decisions: read` and `media: read`: the response is a file, so a key without `media: read` gets `403`. operationId: get_v3_session_aml_screening_history_export parameters: - name: sessionId in: path required: true description: >- UUID of the verification session (the `session_id` returned by `POST /v3/session/`). Accepts both User Verification (KYC) and Business Verification (KYB) session IDs: the server resolves the ID across both session types. Must be a well-formed UUID; a malformed value does not match the route and returns an HTML `404`. schema: type: string format: uuid example: 11111111-2222-3333-4444-555555555555 - name: node_id in: query required: false description: >- Workflow graph node ID of the AML check. Needed only when the session ran more than one AML step; without it the most recent AML check is used. An unknown node returns `404`. schema: type: string example: feature_aml_1 responses: '200': description: >- The CSV file, streamed as `text/csv` with CRLF line endings. Columns, in order: `screened_at` (when the re-screen finished), `outcome` (`NO_CHANGE`, `CHANGED` or `FAILED`), `provider` (opaque identifier of the AML data source; do not branch on it), `aml_status`, `aml_score`, `total_hits`, `datasets_captured_at`, `datasets_sanctions_last_updated_at`, `datasets_pep_last_updated_at`, `datasets_warnings_last_updated_at`, `datasets_adverse_media_last_updated_at` and `datasets_catalog_version`. Dates are ISO 8601 with a UTC offset. A session with no re-screens yet returns the header line only. headers: Content-Disposition: description: '`attachment; filename="aml-screening-history-{sessionId}.csv"`.' schema: type: string example: >- attachment; filename="aml-screening-history-11111111-2222-3333-4444-555555555555.csv" content: text/csv: schema: type: string format: binary example: "screened_at,outcome,provider,aml_status,aml_score,total_hits,datasets_captured_at,datasets_sanctions_last_updated_at,datasets_pep_last_updated_at,datasets_warnings_last_updated_at,datasets_adverse_media_last_updated_at,datasets_catalog_version\r\n2026-09-14T04:12:33.481207+00:00,NO_CHANGE,aml_data_source,Approved,0.0,0,2026-09-14T03:58:02.114820+00:00,2026-09-13T21:10:00+00:00,2026-09-13T08:00:00+00:00,2026-09-12T18:45:00+00:00,,2026-09-13\r\n2026-09-13T04:11:58.020914+00:00,FAILED,aml_data_source,Approved,0.0,0,,,,,,\r\n" '401': description: >- The scoped API key has expired. This is the only case that returns `401`: a missing, invalid or revoked key returns `403`. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Expired key: summary: The key's expiry date has passed value: detail: This API key has expired. '403': description: >- Authentication or authorization failure. Missing, invalid and revoked keys return `403` (not `401`); so do a key of another application, a scoped key without the permission this endpoint needs, and a request from outside the key's IP allowlist. Distinguish them by `detail`. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Missing or invalid credentials: summary: No x-api-key header, or the key failed validation value: detail: >- Authentication credentials were not provided or are invalid. Other application: summary: >- A valid key that belongs to a different application than the session value: detail: You do not have permission to perform this action. Scoped key without decisions read: summary: 'Scoped key lacks decisions: read' value: detail: This API key has no read access to decisions. Scoped key without media read: summary: 'Scoped key lacks media: read (the response is a file)' value: detail: This API key has no read access to media. IP not allowed: summary: Request from outside the key's IP allowlist value: detail: This API key can't be used from this IP address. '404': description: >- The session does not exist, was deleted or is outside a scoped key's limits, or it has no AML check (for the given `node_id`). The session lookup runs before the credential check, so an unknown `sessionId` returns `404` even without a valid key. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Unknown session: summary: No session with this ID exists, or it was deleted value: detail: Not found. Outside key limits: summary: >- The session is outside a scoped key's limits (also returned for a session deleted moments ago) value: detail: Session not found. No AML check: summary: The session never ran an AML step value: detail: The session does not have an AML check. No AML check for node: summary: node_id does not match an AML check of the session value: detail: >- The session does not have an AML check for node 'feature_aml_2'. '429': description: >- Rate limit exceeded: 600 GET requests per minute per API key. Wait `Retry-After` seconds before retrying; the `X-RateLimit-*` headers show the budget. content: application/json: schema: type: object properties: detail: type: string description: Human-readable error message. examples: Rate limited: summary: Budget for the current minute exhausted value: detail: >- GET request rate limit exceeded. You can make up to 600 requests per minute. headers: Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 1 example: 30 security: - ApiKeyAuth: [] x-codeSamples: - lang: curl label: curl source: >- curl -X GET 'https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/aml-screening-history/export/' \ -H 'x-api-key: YOUR_API_KEY' \ -o aml-screening-history.csv - lang: python label: Python source: |- import os import requests session_id = '11111111-2222-3333-4444-555555555555' resp = requests.get( f'https://verification.didit.me/v3/session/{session_id}/aml-screening-history/export/', headers={'x-api-key': os.environ['DIDIT_API_KEY']}, timeout=10, ) resp.raise_for_status() with open('aml-screening-history.csv', 'wb') as fh: fh.write(resp.content) - lang: javascript label: JavaScript source: >- import { writeFile } from 'node:fs/promises'; const sessionId = '11111111-2222-3333-4444-555555555555'; const resp = await fetch(`https://verification.didit.me/v3/session/${sessionId}/aml-screening-history/export/`, { headers: { 'x-api-key': process.env.DIDIT_API_KEY }, }); if (!resp.ok) throw new Error(`Export failed: ${resp.status}`); await writeFile('aml-screening-history.csv', await resp.text()); components: securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: >- Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is missing, wrong, revoked or expired; 403 means the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.