Alerts

An alert is a record that a transaction or pattern requires attention — either from a rule match, a provider flag (sanctions, wallet risk), or a manual analyst escalation. Alerts are the unit of triage in the Business Console.

​

Alert lifecycle

​

Alert sources

​

Alert statuses

​

Alert fields

​

Linking alerts to cases

A single alert might be small enough to resolve on its own. Larger or pattern-based investigations warrant a case — a container for multiple alerts, transactions, users, and evidence. See Cases for the case model. Link from the alert detail pane: Alerts → [alert] → Link to case. You can link to an existing case or create a new one from the alert.

​

SAR workflow

For jurisdictions requiring Suspicious Activity Reports (SARs) or CTRs (Currency Transaction Reports):

1. Move the alert to PENDING_SAR and attach supporting evidence.
2. Generate the SAR filing (PDF + structured metadata) via Alerts → [alert] → Generate SAR.
3. Submit to your regulator’s portal through your usual filing channel.
4. Mark the alert as SAR_FILED and record the filing reference number.

Didit does not directly submit SARs to regulators — SAR filing remains your compliance team’s responsibility. The console generates the artifact (form + evidence) to streamline the process.

​

Console workflow

​

Alerts list

Located at Transactions → Alerts. Columns: Alert ID, Title, Transaction, Applicant, Status, Assigned to, Due date, Source, Severity. Filters: by status, source, severity, assigned analyst, date range. Saved views supported.

​

Alert triage

Double-click an alert to open the triage surface:

• Summary — rule that fired, transaction context, score, matched conditions.
• Transaction — the underlying transaction with all parties and payment methods.
• User / Business — linked entity profile.
• Related alerts — other alerts tied to the same user or pattern.
• Actions — assign, add note, link to case, close (resolve / dismiss), generate SAR.

​

Bulk actions

From the alerts list:

• Bulk assign to an analyst.
• Bulk dismiss (use with care — logged to audit).
• Bulk link to case to group related alerts into one investigation.

​

Assignment and SLAs

• Alerts can be auto-assigned to a round-robin analyst pool configured at Settings → Team → Analyst pool.
• due_at is computed from the alert’s severity and your SLA matrix at Settings → Transaction Monitoring → SLAs.
• Overdue alerts are surfaced on the Alerts dashboard and via weekly email digests.

​

Alert webhooks

Alerts currently flow through the transaction.status.updated webhook and are surfaced in the transaction response. Dedicated alert lifecycle webhooks are on the roadmap — subscribe to application changelog for updates.

​

Programmatic access

Alert CRUD is console-only in the public API today — there is no public alert endpoint in this openapi spec. Use the console to triage and resolve alerts. Transactions with alerts can be retrieved via GET /v3/transactions/ and inspected in bulk.

​

Next steps