Surveillance API
Wash-trade, spoofing, restricted-list and cross-component alerts.
Objects
An alert comes from a deterministic detector: surveillance (wash trades, spoofing patterns, restricted-list hits), cross_component (signals from several components together), access (unusual access) or orders (stuck and duplicate orders). It has a severity, a summary, the detector's details, a suggested fix, and optionally a narrative (by the AI when it is on).
Life cycle
open → reviewed | dismissed | escalated, with a note: POST /surveillance/alerts/{id}/review.
Typical use
Poll GET /surveillance/alerts?status=open&kind=surveillance from your case-management system, open each with GET /surveillance/alerts/{id}, and record the outcome with a review.
Endpoints
| Call | What it does | Scope |
|---|---|---|
GET/surveillance/alerts | Surveillance and anomaly alerts | surveillance:read |
GET/surveillance/alerts/{id} | One alert | surveillance:read |
POST/surveillance/alerts/{id}/review | Review an alert (reviewed, dismissed, escalated) with a note | surveillance:write |