> ## Documentation Index > Fetch the complete documentation index at: https://docs.didit.me/llms.txt > Use this file to discover all available pages before exploring further. # 更新 AML 命中状态 API：确认或排除匹配 > 通过 Didit API 将 AML 筛查命中标记为确认匹配、误报或结论不明确，支持单条或批量操作。 更新 AML 命中状态提示 将提示词复制到剪贴板 \

\`Set the review status (disposition) of AML screening hits on a Didit session — one hit, or many at once.

AML screening returns a list of HITS (potential sanction / PEP / watchlist / adverse-media matches). Each hit carries a review_status you can change to record your compliance decision. This does NOT change the overall session decision.

Two endpoints:

1\) Single hit
PATCH https://verification.didit.me/v3/session/{session_id}/update-aml-hit-status/
Body:
\- hit_id (string, required) — the "id" of the hit in the AML check's "hits" array (see GET /v3/session/{id}/decision/), for example "hit_7c1e9a40b2d35f86e0a4c912". A hit id returned in the earlier format is still accepted; the response always returns the current "id".
\- review_status (string, required) — one of "Unreviewed", "Confirmed Match", "False Positive", "Inconclusive".
\- node_id (string, optional) — graph node ID, only if the session has multiple AML checks.

2\) Bulk
PATCH https://verification.didit.me/v3/session/{session_id}/bulk-update-aml-hit-status/
Body:
\- hit_updates (array, required) — list of { "hit_id": "...", "review_status": "..." }.
\- node_id (string, optional).
All-or-nothing: if any hit_id is missing, returns 404 and nothing changes.

Authentication:
x-api-key (client API key) or a user-auth token. Privilege: write:sessions.

Status values:
\- Unreviewed — default for hits at/above the match threshold; still needs review.
\- Confirmed Match — a true match.
\- False Positive — not the same entity; default for hits below the match threshold.
\- Inconclusive — could not determine.

Reviewer decisions are PRESERVED across ongoing-monitoring re-screens.

curl — clear one hit as a false positive:
curl -X PATCH https://verification.didit.me/v3/session//update-aml-hit-status/ \
-H "x-api-key: " \
-H "Content-Type: application/json" \
-d '{ "hit_id": "hit_7c1e9a40b2d35f86e0a4c912", "review_status": "False Positive" }'

curl — bulk:
curl -X PATCH https://verification.didit.me/v3/session//bulk-update-aml-hit-status/ \
-H "x-api-key: " \
-H "Content-Type: application/json" \
-d '{ "hit_updates": [ { "hit_id": "hit_7c1e9a40b2d35f86e0a4c912", "review_status": "Confirmed Match" }, { "hit_id": "hit_3b8f20d6a91c4e75f0b2d6a8", "review_status": "False Positive" } ] }'

Side effects:
\- Fires a data.updated webhook.
\- Appends an activity entry (with actor attribution) to the session review trail.

Failure modes:
\- 400 — review_status not a valid value, hit_id empty, or hit_updates empty.
\- 403 — missing credentials (a wrong, revoked or expired key gets 401), or the caller lacks write:sessions.
\- 404 — session not found, no AML check, or a hit_id was not found.

Related: to change the overall AML step status (Approved/Declined/In Review) use PATCH /v3/session/{id}/features/{node_id}/update-status/ (see /sessions-api/update-feature-status).

For end-to-end Didit integration, paste in the full prompt at /integration/integration-prompt.`

\
粘贴到 ## 功能说明AML 筛查会返回一组**命中结果**，即与制裁名单、PEP 数据库、观察名单和负面新闻相匹配的潜在匹配项。每个命中结果都有一个 `review_status`（处理结果），根据匹配分数，其初始值为 `Unreviewed` 或 `False Positive`。通过此接口，您的团队（或您的自动化流程）可以记录每个命中结果的决策，且不会改变会话的整体决策。命中结果及其 ID 可在[会话决策](https://docs.didit.me/zh/sessions-api/retrieve-session.md)中找到，即 AML 检查的 `hits` 数组。其中每个命中结果的 `id` 即为您在此处传递的 `hit_id`。命中结果的 `id` 以 `hit_` 开头，后跟 24 位十六进制字符，对同一主体再次筛查时保持不变。较早格式的命中结果 ID 仍可被接受，但响应中始终以当前的 `id` 标识该命中结果。## 处理状态| `review_status` | 含义 | | - | - | | `Unreviewed` | 匹配阈值及以上命中结果的默认状态，仍需做出决策。 | | `Confirmed Match` | 确认与被筛查的个人或实体相符。 | | `False Positive` | 并非同一实体。低于匹配阈值的命中结果的默认状态。 | | `Inconclusive` | 无法确定。 |> [!NOTE] > > 审核员的决策会在**持续监控的重新筛查中保留**。当服务商对该实体重新筛查时，您标记为 `False Positive` 的命中结果会保持该状态。## 更新单个命中结果**`PATCH /v3/session/{sessionId}/update-aml-hit-status/`**```bash theme={null} curl -X PATCH https://verification.didit.me/v3/session/4c5c7f3a-.../update-aml-hit-status/ \ -H "x-api-key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "hit_id": "hit_7c1e9a40b2d35f86e0a4c912", "review_status": "False Positive" }' ```对于包含多个 AML 检查的会话（图工作流），可在 URL 中添加 `?node_id=feature_aml_1`，或在请求体中包含 `"node_id"`，以指定目标检查。## 批量更新多个命中结果**`PATCH /v3/session/{sessionId}/bulk-update-aml-hit-status/`**传递 `hit_updates`，即由 `{ hit_id, review_status }` 组成的列表。该操作**全部成功或全部失败**：如果任何 `hit_id` 未找到，请求将返回 `404`，且不会更改任何命中结果。```bash theme={null} curl -X PATCH https://verification.didit.me/v3/session/4c5c7f3a-.../bulk-update-aml-hit-status/ \ -H "x-api-key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "hit_updates": [ { "hit_id": "hit_7c1e9a40b2d35f86e0a4c912", "review_status": "Confirmed Match" }, { "hit_id": "hit_3b8f20d6a91c4e75f0b2d6a8", "review_status": "False Positive" } ] }' ```批量调用成功后，会触发一个 `data.updated` Webhook，并记录一条涵盖所有变更的活动条目。## 更新后会发生什么- **Webhook**：会在该会话上触发 `data.updated` 事件。 - **审计记录**：变更会以操作者（API 密钥或用户）的身份记录在该会话的审核记录中，并可在控制台的活动时间线中查看。 - **AML 步骤的整体状态不受影响**：仅更改命中结果的处理状态，不会自行改变 AML 步骤状态或会话决策。若要更改 AML **步骤**状态（`Approved` / `Declined` / `In Review`），请使用 [update-feature-status](https://docs.didit.me/zh/sessions-api/update-feature-status.md)。若要更改**会话**决策，请使用 [update-status](https://docs.didit.me/zh/sessions-api/update-status.md)。## KYC 与 KYB 支持同时适用于**用户验证（KYC）**和**企业验证（KYB）**会话，Didit 会在两类会话中解析 `sessionId`。对于 KYB，AML 筛查针对企业及其关键人员进行，每项 AML 检查都会展示其各自的命中结果。## 权限需要 `write:sessions` 权限，并使用客户端 API 密钥（`x-api-key`）或用户授权头进行认证。## 错误| 状态码 | 含义 | | - | - | | `400` | `review_status` 不是有效值，`hit_id` 为空，或 `hit_updates` 为空。 | | `403` | 凭证缺失或无效，或调用方缺少 `write:sessions` 权限。 | | `404` | 未找到会话，会话没有 AML 检查，或未找到某个 `hit_id`（批量操作时不会更改任何内容）。 |## 相关内容- [更新功能状态](https://docs.didit.me/zh/sessions-api/update-feature-status.md)：更改 AML **步骤**状态（或其他任意步骤）。 - [更新会话状态](https://docs.didit.me/zh/sessions-api/update-status.md)：更改会话的整体决策。 - [获取会话](https://docs.didit.me/zh/sessions-api/retrieve-session.md)：读取 AML `hits` 及其 ID。 - [AML 筛查](https://docs.didit.me/zh/standalone-apis/aml-screening.md)：了解筛查和评分的工作方式。 ## OpenAPI ````yaml zh/openapi-25.json PATCH /v3/session/{sessionId}/update-aml-hit-status/ openapi: 3.0.0 info: version: 3.0.0 title: Didit Verification API description: 身份证件验证 API。使用 x-api-key 请求头进行身份验证。 servers: - url: https://verification.didit.me security: [] tags: [] paths: /v3/session/{sessionId}/update-aml-hit-status/: patch: tags: - Sessions summary: 更新 AML 命中审核状态 description: >- 设置 AML 筛查返回的**单个 AML 命中项**（潜在的制裁 / PEP / 观察名单 / 负面新闻匹配）的审核状态，且不会更改整个会话决策。通过其 `hit_id`（AML 检查的 `hits` 数组中某个条目的 `id` — 请参阅会话决策）标识该命中项。仍然支持以较早格式返回的命中项 ID；响应始终按其当前 `id` 命名该命中项。 `review_status` 为 `Unreviewed`、`Confirmed Match`、`False Positive` 或 `Inconclusive` 之一。审核员决策会在持续监控更新期间保留，因此当提供商重新筛查时，您标记为 `False Positive` 的命中项将保持该状态。 成功的调用会触发 `data.updated` Webhook，并向会话的审核轨迹附加一条活动条目（包含操作者归因）。对于包含多个 AML 检查的图谱工作流，请传递 `node_id` 以定位特定检查。 使用您的 API 密钥（`x-api-key`）或用户授权请求头进行身份验证 — 两者都必须包含 `write:sessions` 权限。 operationId: patch_v3_session_update_aml_hit_status parameters: - in: path name: sessionId required: true description: 验证会话的 UUID。支持用户（KYC）和企业（KYB）会话 ID，服务会跨两种会话类型解析该 ID。 schema: type: string format: uuid example: 11111111-2222-3333-4444-555555555555 - in: query name: node_id required: false description: 工作流图谱节点 ID。仅在会话包含多个 AML 检查（每个节点一个）时需要；单 AML 会话请省略。 schema: type: string example: feature_aml_1 requestBody: required: true content: application/json: schema: type: object required: - hit_id - review_status properties: hit_id: type: string description: AML 检查中 `hits` 数组里的命中项 `id`（`hit_...`）。以旧格式返回的命中项 id 仍被接受。 example: hit_7c1e9a40b2d35f86e0a4c912 review_status: type: string description: 该命中项的新审核状态。 enum: - Unreviewed - Confirmed Match - False Positive - Inconclusive example: False Positive node_id: type: string description: 可选的图谱节点 ID。当会话包含多个 AML 检查时，请使用此项（在此处或作为查询参数）。 example: feature_aml_1 example: hit_id: hit_7c1e9a40b2d35f86e0a4c912 review_status: False Positive responses: '200': description: 命中项审核状态已更新。 content: application/json: schema: type: object required: - message - hit_id - review_status properties: message: type: string description: 始终为 `Hit status updated successfully`。 hit_id: type: string description: 更新后命中项的 `id`，按会话决策返回的形式呈现；即使请求使用的是旧格式的 id 指定该命中项，也会正常返回。 review_status: type: string enum: - Unreviewed - Confirmed Match - False Positive - Inconclusive description: 当前存储在命中项上的审核状态。 example: message: Hit status updated successfully hit_id: hit_7c1e9a40b2d35f86e0a4c912 review_status: False Positive '400': description: 验证错误 — `hit_id` 为空，或 `review_status` 不是允许的值之一。 content: application/json: example: review_status: - '"Maybe" is not a valid choice.' '403': description: 缺少凭据或权限不足。缺少密钥返回 `403`；错误、已撤销或已过期的密钥返回 `401`。 content: application/json: examples: Invalid Credentials: summary: x-api-key 缺失或无效 value: detail: >- Authentication credentials were not provided or are invalid. Missing Privilege: summary: API 密钥缺少 write:sessions value: detail: You do not have permission to perform this action. '404': description: 未找到会话、会话没有 AML 检查（可选针对给定的 `node_id`），或没有命中项匹配 `hit_id`。 content: application/json: examples: No AML Check: summary: 会话没有 AML 检查 value: detail: The session does not have an AML check. Hit Not Found: summary: 未知的 hit_id value: detail: >- Hit with ID 'hit_9d2e7f41c0a8b3e65d1f0c47' not found in the AML check. security: - ApiKeyAuth: [] x-codeSamples: - lang: curl label: curl source: |- curl -X PATCH \ https://verification.didit.me/v3/session/11111111-2222-3333-4444-555555555555/update-aml-hit-status/ \ -H 'x-api-key: YOUR_API_KEY' \ -H 'Content-Type: application/json' \ -d '{ "hit_id": "abc123", "review_status": "False Positive" }' - lang: python label: Python source: |- from didit import Didit # Reads DIDIT_API_KEY. client = Didit() result = client.sessions.update_aml_hit_status( "11111111-2222-3333-4444-555555555555", hit_id="hit_7c1e9a40b2d35f86e0a4c912", review_status="False Positive", ) print(result) - lang: javascript label: Node.js source: >- import Didit from "@didit-protocol/sdk-node"; // Reads DIDIT_API_KEY. const didit = new Didit(); const result = await didit.sessions.updateAmlHitStatus("11111111-2222-3333-4444-555555555555", { hit_id: "hit_7c1e9a40b2d35f86e0a4c912", review_status: "False Positive", }); console.log(result); - lang: go label: Go source: "ctx := context.Background()\n// Reads DIDIT_API_KEY.\nclient := didit.NewClient()\n\nresult, err := client.Sessions.UpdateAMLHitStatus(ctx, \"11111111-2222-3333-4444-555555555555\", didit.SessionsUpdateAMLHitStatusParams{\n\tHitID: \"hit_7c1e9a40b2d35f86e0a4c912\",\n\tReviewStatus: \"False Positive\",\n})\nif err != nil {\n\tlog.Fatal(err)\n}\nfmt.Printf(\"%+v\\n\", result)" - lang: java label: Java source: >- import me.didit.Didit; import me.didit.types.SessionsUpdateAmlHitStatusParams; // Reads DIDIT_API_KEY. Didit client = new Didit(); var result = client.sessions().updateAmlHitStatus("11111111-2222-3333-4444-555555555555", SessionsUpdateAmlHitStatusParams.builder() .hitId("hit_7c1e9a40b2d35f86e0a4c912") .reviewStatus(SessionsUpdateAmlHitStatusParams.ReviewStatus.of("False Positive")) .build()); System.out.println(result); - lang: php label: PHP source: >- sessions->updateAmlHitStatus('11111111-2222-3333-4444-555555555555', [ 'hit_id' => 'hit_7c1e9a40b2d35f86e0a4c912', 'review_status' => 'False Positive', ]); print_r($result->toArray()); - lang: ruby label: Ruby source: |- require "didit" # Reads DIDIT_API_KEY. didit = Didit::Client.new result = didit.sessions.update_aml_hit_status( "11111111-2222-3333-4444-555555555555", hit_id: "hit_7c1e9a40b2d35f86e0a4c912", review_status: "False Positive" ) puts result.to_h - lang: csharp label: .NET source: >- using System; using System.Text.Json; using Didit; // Reads DIDIT_API_KEY. using var client = new DiditClient(); var result = await client.Sessions.UpdateAmlHitStatusAsync("11111111-2222-3333-4444-555555555555", new SessionsUpdateAmlHitStatusParams { HitId = "hit_7c1e9a40b2d35f86e0a4c912", ReviewStatus = "False Positive", }); Console.WriteLine(JsonSerializer.Serialize(result)); components: securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: >- 您的应用 API 密钥，可在 Business Console 的“开发者 -> API 密钥”中获取。主密钥拥有完整访问权限。指定名称的密钥可设置作用域：针对每个资源设为无权限、只读或读写，限定于特定工作流或已通过的会话、限定于 IP 地址列表，以及设置到期日期。401 表示密钥错误、已撤销或已过期；403 表示未发送密钥、密钥无权访问该资源或操作，或请求来自其 IP 列表之外的地址；在会话路由上返回 404 表示该会话不在该密钥允许的工作流或状态范围内。没有媒体访问权限的密钥获取到的图片、视频和 PDF URL 将为 null；没有会话写入权限的密钥获取到的会话链接和 token 将为 null。请参阅 https://docs.didit.me/console/api-keys。 ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.