Auditing & Compliance

Orca provides comprehensive auditing capabilities to help you track changes to rules and understand how risk decisions are made.

Rule Management

List Rules

Retrieve every rule configured for your client, in any state.

Endpoint: GET /v1/rules

Query Parameters

This endpoint takes no parameters. It returns every rule configured for your client on each call.

Response

The response is a JSON array of rule objects, not a wrapped object. There is no pagination.


[
  {
    "id": "rule_123456",
    "name": "High Value Transaction",
    "riskLevel": "medium",
    "status": "active",
    "createdAt": 1734167723000,
    "updatedAt": 1734167723000
  },
  {
    "id": "rule_789012",
    "name": "Suspicious IP Location",
    "riskLevel": "high",
    "status": "active",
    "createdAt": 1734166723000,
    "updatedAt": 1734167123000
  }
]

Response Schema

Field	Type	Description
`[].id`	string	Rule identifier. This is the rule’s display ID where one is set, otherwise its internal ID
`[].name`	string	Name of the rule
`[].riskLevel`	enum	Risk level the rule assigns when it triggers: `low`, `medium_low`, `medium`, `high`, `very_high`, `n/a`
`[].status`	enum	Rule state: `active`, `inactive`, `draft`, `archived`, `muted`, `dry-run`
`[].createdAt`	number	Rule creation timestamp, Unix epoch milliseconds
`[].updatedAt`	number	Last update timestamp, Unix epoch milliseconds

Responses

200: Rules returned
400: An error occurred while retrieving rules

Comments

Case notes attached to a user. Comments are written by your reviewers or your own systems and are retained as part of the audit trail alongside the rule decisions they relate to.

Add Comment

Attach a comment to a user.

Endpoint: POST /v1/comments/user/{userId}

Path Parameters

Parameter	Type	Required	Description
`userId`	string	Yes	Identifier of the user the comment concerns. Must match the `userId` in the request body

Request Schema

Field	Type	Required	Description
`userId`	string	Yes	Identifier of the user. Must match the `userId` in the path, otherwise the request is rejected
`comment`	string	Yes	The comment text
`commenterId`	string	Yes	Identifier of the person or system adding the comment
`commenterDisplayName`	string	No	Human-readable name of the commenter, for display in the audit trail
`externalId`	string	No	Your own identifier for the comment
`transactionId`	string	No	Transaction the comment relates to, if any
`ruleTriggerEventId`	string	No	Rule trigger event the comment relates to, if any
`action`	string	No	Action taken alongside the comment, if any
`createdAt`	number	No	Unix epoch milliseconds. Defaults to receipt time

Example Request


{
  "userId": "USER123",
  "comment": "Contacted customer, confirmed the transfer was legitimate.",
  "commenterId": "EMP-2841",
  "commenterDisplayName": "Jane Doe",
  "transactionId": "TXN123456",
  "action": "cleared",
  "createdAt": 1734167723000
}

Responses

200: Comment accepted
400: userId in the path does not match the body, or the comment could not be processed
401: Unauthorized

Note: The comment is written asynchronously, so a 200 confirms the request was accepted rather than that the comment has been persisted.

List Comments

Retrieve comments across all users for your client.

Endpoint: GET /v1/comments

Query Parameters

Parameter	Type	Required	Description
`start`	number	No	Range start, Unix epoch milliseconds
`end`	number	No	Range end, Unix epoch milliseconds
`limit`	number	No	Maximum comments to return

Response Example


{
  "comments": [
    {
      "id": "cmt_01JQ4T8ZC7K2XN",
      "userId": "USER123",
      "comment": "Contacted customer, confirmed the transfer was legitimate.",
      "commenterId": "EMP-2841",
      "commenterDisplayName": "Jane Doe",
      "transactionId": "TXN123456",
      "action": "cleared",
      "createdAt": 1734167723000
    }
  ]
}

Responses

200: Comments returned
401: Unauthorized

List Comments for a User

Retrieve comments for a single user.

Endpoint: GET /v1/comments/user/{userId}

Path Parameters

Parameter	Type	Required	Description
`userId`	string	Yes	Identifier of the user whose comments to return

Query Parameters

Same as List Comments — start, end and limit.

Response

Same shape as List Comments, filtered to the given user.

Responses

200: Comments returned
401: Unauthorized