Flagright

• Outputs

  Transaction, user, case, alert, rule-action, and SAR lifecycle notifications

  Source Checked 2026-09-18
• Webhooks

  HTTPS endpoints receive JSON event payloads, including changes to cases, alerts, and regulatory report status.

  Source Checked 2026-09-18
• Dependency

  Client-operated HTTPS webhook endpoint

  Source Checked 2026-09-18
• Outputs

  Approved filings through supported regulator APIs, or filing packages where direct submission is unsupported

  Source Checked 2026-09-18
• Dependency

  Human approval in the filing lifecycle

  Source Checked 2026-09-18
• Inputs

  Names, dates of birth, selected list data, and configurable matching settings

  Source Checked 2026-09-18
• Connected provider

  OpenSanctions

  Source Checked 2026-09-18
• Connected provider

  KYC6

  Source Checked 2026-09-18
• Connected provider

  Customer-supplied risk data feeds

  Source Checked 2026-09-18
• Dependency

  Configure edit-distance, phonetic, transliteration, token, and date-tolerance rules for the intended population

  Source Checked 2026-09-18
• Inputs

  Customer transaction history, behavioral baselines, and counterparty relationships

  Source Checked 2026-09-18
• Outputs

  Anomaly findings, peer-deviation alerts, and counterparty clusters

  Source Checked 2026-09-18
• Dependency

  Validate new monitoring policies with historical backtests and shadow alerts before activation

  Source Checked 2026-09-18
• Inputs

  Transaction history, accounts, entities, counterparty context, and screening results

  Source Checked 2026-09-18
• Outputs

  Multi-hop fund traces and relationship clusters for investigation

  Source Checked 2026-09-18
• Outputs

  HTTPS JSON events with id, type, data, and millisecond createdTimestamp

  Source Checked 2026-09-18
• Outputs

  User/transaction changes, alert/case events, and SAR lifecycle notifications

  Source Checked 2026-09-18
• Dependency

  Register a publicly reachable HTTPS endpoint and selected event types

  Source Checked 2026-09-18
• Webhooks

  Return 2xx before the 10-second timeout. The guide describes retries for 3xx/4xx/5xx responses for up to three days, then failure.

  Source Checked 2026-09-18
• Deployment

  Published production webhook origins include Oregon, Frankfurt, London, Ireland, Singapore, Hong Kong, Sydney, and UAE

  Source Checked 2026-09-18
• Inputs

  Raw request body and the endpoint-specific signing secret

  Source Checked 2026-09-18
• Outputs

  HMAC-SHA256 hex signature matched against X-Flagright-Signature

  Source Checked 2026-09-18
• Dependency

  Retrieve each endpoint's secret from Console settings

  Source Checked 2026-09-18
• Dependency

  Accept any valid comma-separated signature during secret rotation

  Source Checked 2026-09-18
• Outputs

  Configured risk-level, risk-score, or any-risk-change notifications

  Source Checked 2026-09-18
• Webhooks

  Changes caused directly by an API call are returned in that API response. Non-API changes can trigger risk webhooks.

  Source Checked 2026-09-18
• Outputs

  FRAML and Management OpenAPI specifications

  Source Checked 2026-09-18
• Outputs

  Official TypeScript/Node, Python, Java, and Go clients

  Source Checked 2026-09-18
• Dependency

  Choose the correct API surface and environment before generating or configuring a client

  Source Checked 2026-09-18
• Inputs

  Case evidence, institution policies, and analyst corrections

  Source Checked 2026-09-18
• Outputs

  Validated narratives, confidence scores, and exportable evidence/action records

  Source Checked 2026-09-18
• Dependency

  Configured automation levels, approvals, permissions, retention, and residency controls

  Source Checked 2026-09-18

An example for your internal adapter. This is not a vendor endpoint, request, or response.

{
  "contract": "internal-risk-review/v1",
  "vendorId": "flagright",
  "internalCorrelationId": "example-001",
  "vendorRecordId": null,
  "control": "Detection and rule management",
  "evidence": [],
  "status": "pending",
  "decision": "review",
  "requiresHumanReview": true
}

• Illustrative internal integration contract. This is not a vendor request, response, endpoint, or SDK example.
• Empty country, deployment, or provider lists mean not verified in this review. A documented country refers to the specific product noted in its source, not universal platform coverage.
• This introductory page does not establish retry counts, ordering, or authentication guarantees. Verify those before accepting production events.
• The page does not enumerate a named regulator and interface for every jurisdiction. Broad filing coverage is not enough to pass this site's strict direct-filing filter.
• Matching settings are not calibrated fraud probabilities. Connected data feeds have separate scope and rights.
• The page describes ML detectors but does not provide independently validated detection or false-positive benchmarks.
• This establishes transaction-network analysis, not complete corporate ownership discovery.
• A regulator-related event type does not establish universal direct filing coverage.
• Confirm timeout-specific failure behavior and replay recovery during integration. These are source-IP locations, not customer screening coverage.
• Each endpoint has its own secret. Do not verify a reserialized payload or assume a common secret across endpoints.
• Examples include manual overrides, risk locks, SAR-related recalculation, and list/PEP updates. API callers must inspect the response instead of waiting for a duplicate webhook.
• Generated results remain reviewable, editable, and overridable. Incomplete evidence lowers confidence or triggers review. The page does not publish the supported model/provider matrix.