# Comment an AML Case

A note kept with the case, for whoever works it.

## Overview

- `body`: 1 to 2000 characters, trimmed; one made only of spaces: `400` `AML_CASE_INVALID` (`A comment of 1 to 2000 characters is required.`, `details.field` `body`). Open and decided cases both take comments.
- `201` with the comment: `id`, `authorId`, `authorRole`, `authorScope` (`tenant`), `body`, `createdAt`. Read the comments with [Get a Case](https://docs.aureahub.com/docs/aml-case-get.md).
- The text stays with the case: your audit trail records that a comment was written (`aml_case.commented`), never its text, and no event carries it.
- For `owner`, `tenantadmin`, `non_signing_admin` and `security_admin`. `404` `AML_CASE_NOT_FOUND` for none of your tenant's cases; `403` `AML_CASE_AUREA_DECIDES` on an `onboarding` case, which Aurea works.

## Endpoint

### `POST /v1/aml-cases/{caseId}/comments`

Authentication: bearer token required.

Adds a comment to one of your tenant's AML cases.

**Path parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `caseId` | string (uuid) | yes | The case's id |

**Request body**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `body` | string | yes | The comment, 1 to 2000 characters |

**Responses**

`201` Kept

```json
{
  "id": "2e8c4a1f-6b3d-4f90-8a7c-5d1e9b3f2a64",
  "authorId": "0d2f6b8a-4c1e-4a93-b7d5-2e9f1c3a8b60",
  "authorRole": "security_admin",
  "authorScope": "tenant",
  "body": "Asked the customer for details of the counterparty.",
  "createdAt": "2026-10-13T09:52:10.400Z"
}
```

**Example request**

```bash
curl -X POST https://api.aureahub.com/v1/aml-cases/5f2a8c1e-7b3d-4e90-a6c2-1d8e4b7f3a95/comments \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "body": "Asked the customer for details of the counterparty." }'
```

---

Web version: https://docs.aureahub.com/#aml-case-comment