curl -X PATCH \
https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/update-aml-hit-status/ \
-H 'x-api-key: YOUR_API_KEY' \
-H 'Content-Type: application/json' \
-d '{
"hit_id": "abc123",
"review_status": "False Positive"
}'from didit import Didit
# Reads DIDIT_API_KEY.
client = Didit()
result = client.sessions.update_aml_hit_status(
"11111111-2222-3333-4444-555555555555",
hit_id="hit_7c1e9a40b2d35f86e0a4c912",
review_status="False Positive",
)
print(result)import Didit from "@didit-protocol/sdk-node";
// Reads DIDIT_API_KEY.
const didit = new Didit();
const result = await didit.sessions.updateAmlHitStatus("11111111-2222-3333-4444-555555555555", {
hit_id: "hit_7c1e9a40b2d35f86e0a4c912",
review_status: "False Positive",
});
console.log(result);ctx := context.Background()
// Reads DIDIT_API_KEY.
client := didit.NewClient()
result, err := client.Sessions.UpdateAMLHitStatus(ctx, "11111111-2222-3333-4444-555555555555", didit.SessionsUpdateAMLHitStatusParams{
HitID: "hit_7c1e9a40b2d35f86e0a4c912",
ReviewStatus: "False Positive",
})
if err != nil {
log.Fatal(err)
}
fmt.Printf("%+v\n", result)import me.didit.Didit;
import me.didit.types.SessionsUpdateAmlHitStatusParams;
// Reads DIDIT_API_KEY.
Didit client = new Didit();
var result = client.sessions().updateAmlHitStatus("11111111-2222-3333-4444-555555555555", SessionsUpdateAmlHitStatusParams.builder()
.hitId("hit_7c1e9a40b2d35f86e0a4c912")
.reviewStatus(SessionsUpdateAmlHitStatusParams.ReviewStatus.of("False Positive"))
.build());
System.out.println(result);<?php
require 'vendor/autoload.php';
use Didit\DiditClient;
// Reads DIDIT_API_KEY.
$didit = new DiditClient();
$result = $didit->sessions->updateAmlHitStatus('11111111-2222-3333-4444-555555555555', [
'hit_id' => 'hit_7c1e9a40b2d35f86e0a4c912',
'review_status' => 'False Positive',
]);
print_r($result->toArray());require "didit"
# Reads DIDIT_API_KEY.
didit = Didit::Client.new
result = didit.sessions.update_aml_hit_status(
"11111111-2222-3333-4444-555555555555",
hit_id: "hit_7c1e9a40b2d35f86e0a4c912",
review_status: "False Positive"
)
puts result.to_husing System;
using System.Text.Json;
using Didit;
// Reads DIDIT_API_KEY.
using var client = new DiditClient();
var result = await client.Sessions.UpdateAmlHitStatusAsync("11111111-2222-3333-4444-555555555555", new SessionsUpdateAmlHitStatusParams
{
HitId = "hit_7c1e9a40b2d35f86e0a4c912",
ReviewStatus = "False Positive",
});
Console.WriteLine(JsonSerializer.Serialize(result));{
"message": "Hit status updated successfully",
"hit_id": "hit_7c1e9a40b2d35f86e0a4c912",
"review_status": "False Positive"
}Update AML Hit Status API: Clear & Confirm Matches
Mark individual AML screening hits as Confirmed Match, False Positive, or Inconclusive — single or in bulk — straight from the API.
curl -X PATCH \
https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/update-aml-hit-status/ \
-H 'x-api-key: YOUR_API_KEY' \
-H 'Content-Type: application/json' \
-d '{
"hit_id": "abc123",
"review_status": "False Positive"
}'from didit import Didit
# Reads DIDIT_API_KEY.
client = Didit()
result = client.sessions.update_aml_hit_status(
"11111111-2222-3333-4444-555555555555",
hit_id="hit_7c1e9a40b2d35f86e0a4c912",
review_status="False Positive",
)
print(result)import Didit from "@didit-protocol/sdk-node";
// Reads DIDIT_API_KEY.
const didit = new Didit();
const result = await didit.sessions.updateAmlHitStatus("11111111-2222-3333-4444-555555555555", {
hit_id: "hit_7c1e9a40b2d35f86e0a4c912",
review_status: "False Positive",
});
console.log(result);ctx := context.Background()
// Reads DIDIT_API_KEY.
client := didit.NewClient()
result, err := client.Sessions.UpdateAMLHitStatus(ctx, "11111111-2222-3333-4444-555555555555", didit.SessionsUpdateAMLHitStatusParams{
HitID: "hit_7c1e9a40b2d35f86e0a4c912",
ReviewStatus: "False Positive",
})
if err != nil {
log.Fatal(err)
}
fmt.Printf("%+v\n", result)import me.didit.Didit;
import me.didit.types.SessionsUpdateAmlHitStatusParams;
// Reads DIDIT_API_KEY.
Didit client = new Didit();
var result = client.sessions().updateAmlHitStatus("11111111-2222-3333-4444-555555555555", SessionsUpdateAmlHitStatusParams.builder()
.hitId("hit_7c1e9a40b2d35f86e0a4c912")
.reviewStatus(SessionsUpdateAmlHitStatusParams.ReviewStatus.of("False Positive"))
.build());
System.out.println(result);<?php
require 'vendor/autoload.php';
use Didit\DiditClient;
// Reads DIDIT_API_KEY.
$didit = new DiditClient();
$result = $didit->sessions->updateAmlHitStatus('11111111-2222-3333-4444-555555555555', [
'hit_id' => 'hit_7c1e9a40b2d35f86e0a4c912',
'review_status' => 'False Positive',
]);
print_r($result->toArray());require "didit"
# Reads DIDIT_API_KEY.
didit = Didit::Client.new
result = didit.sessions.update_aml_hit_status(
"11111111-2222-3333-4444-555555555555",
hit_id: "hit_7c1e9a40b2d35f86e0a4c912",
review_status: "False Positive"
)
puts result.to_husing System;
using System.Text.Json;
using Didit;
// Reads DIDIT_API_KEY.
using var client = new DiditClient();
var result = await client.Sessions.UpdateAmlHitStatusAsync("11111111-2222-3333-4444-555555555555", new SessionsUpdateAmlHitStatusParams
{
HitId = "hit_7c1e9a40b2d35f86e0a4c912",
ReviewStatus = "False Positive",
});
Console.WriteLine(JsonSerializer.Serialize(result));{
"message": "Hit status updated successfully",
"hit_id": "hit_7c1e9a40b2d35f86e0a4c912",
"review_status": "False Positive"
}What this does
AML screening returns a list of hits — potential matches against sanction lists, PEP databases, watchlists, and adverse media. Each hit has areview_status (its disposition) that starts as Unreviewed or False Positive depending on the match score. This endpoint lets your team (or your automation) record a decision on each hit — without changing the overall session decision.
Find the hits and their IDs in the session decision — the AML check’s hits array, where each hit’s id is the hit_id you pass here.
A hit id is hit_ followed by 24 hexadecimal characters, and stays the same when the subject is screened again. A hit id returned in the earlier format is still accepted; the response always names the hit by its current id.
Review statuses
review_status | Meaning |
|---|---|
Unreviewed | Default for hits at or above the match threshold — still needs a decision. |
Confirmed Match | A true match for the screened individual / entity. |
False Positive | Not the same entity. Default for hits below the match threshold. |
Inconclusive | Could not be determined. |
False Positive keeps that status when the provider re-screens the entity.Update a single hit
PATCH /v3/session/{sessionId}/update-aml-hit-status/
curl -X PATCH https://verification.didit.me/v3/session/4c5c7f3a-.../update-aml-hit-status/ \
-H "x-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"hit_id": "hit_7c1e9a40b2d35f86e0a4c912",
"review_status": "False Positive"
}'
?node_id=feature_aml_1 to the URL or include "node_id" in the body to target a specific check.
Update many hits at once
PATCH /v3/session/{sessionId}/bulk-update-aml-hit-status/
Pass hit_updates, a list of { hit_id, review_status } pairs. The operation is all-or-nothing: if any hit_id is not found, the request returns 404 and no hit is changed.
curl -X PATCH https://verification.didit.me/v3/session/4c5c7f3a-.../bulk-update-aml-hit-status/ \
-H "x-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"hit_updates": [
{ "hit_id": "hit_7c1e9a40b2d35f86e0a4c912", "review_status": "Confirmed Match" },
{ "hit_id": "hit_3b8f20d6a91c4e75f0b2d6a8", "review_status": "False Positive" }
]
}'
data.updated webhook and records one activity entry covering all the changes.
What happens after an update
- Webhook — a
data.updatedevent fires on the session. - Audit trail — the change is recorded on the session’s review trail with the actor (API key or user), visible in the console’s activity timeline.
- Overall AML step status is untouched — changing a hit’s disposition does not, by itself, change the AML step status or the session decision. To change the AML step status (
Approved/Declined/In Review), use update-feature-status. To change the session decision, use update-status.
KYC and KYB support
Works for both User Verification (KYC) and Business Verification (KYB) sessions — Didit resolves thesessionId across both. For KYB, AML screening runs on the company and its key people; each AML check exposes its own hits.
Permission
Requires thewrite:sessions privilege, with either a client API key (x-api-key) or a user authorization header.
Errors
| Status | Meaning |
|---|---|
400 | review_status is not a valid value, hit_id is empty, or hit_updates is empty. |
403 | Missing/invalid credentials, or the caller lacks write:sessions. |
404 | Session not found, the session has no AML check, or a hit_id was not found (bulk: nothing is changed). |
Related
- Update feature status — change the AML step status (or any other step).
- Update session status — change the overall session decision.
- Retrieve session — read the AML
hitsand their IDs. - AML screening — how screening and scoring work.
Authorizations
Your application's API key, from Developers -> API keys in the Business Console. The primary key has full access. A named key can be scoped: none, read or write per resource, limited to some workflows or to approved sessions, to a list of IP addresses, and to an expiry date. 401 means the key is wrong, revoked or expired; 403 means no key was sent, the key has no access to this resource or action, or the request came from an address outside its IP list; 404 on a session route means the session is outside the key's workflows or statuses. A key without media access receives image, video and PDF URLs as null, and a key without sessions write receives session links and tokens as null. See https://docs.didit.me/console/api-keys.
Path Parameters
UUID of the verification session. Accepts both user (KYC) and business (KYB) session IDs — the service resolves the ID across both session types.
"11111111-2222-3333-4444-555555555555"
Query Parameters
Workflow graph node ID. Required only when the session has multiple AML checks (one per node); omit it for single-AML sessions.
"feature_aml_1"
Body
The id of the hit in the AML check's hits array (hit_...). A hit id returned in the earlier format is still accepted.
"hit_7c1e9a40b2d35f86e0a4c912"
The new review status for the hit.
Unreviewed, Confirmed Match, False Positive, Inconclusive "False Positive"
Optional graph node ID. Use it (here or as a query parameter) when the session has multiple AML checks.
"feature_aml_1"
Response
Hit review status updated.
Always Hit status updated successfully.
The id of the updated hit, as the session decision returns it, also when the request named the hit by an id in the earlier format.
The review status now stored on the hit.
Unreviewed, Confirmed Match, False Positive, Inconclusive