# Decide an AML Case

Release the match, or confirm it — once, with a written reason.

## Overview

- `decision`: `release` — the match is bypassed: a held operation goes on as the call that started it would have, a refused call's counterparty passes on the way out for 24 hours (for the same list entries), a received transfer's wallet signs again; or `confirm` — it stands: a held operation is rejected (`REJECTED`, `AML_CASE_CONFIRMED`), a received transfer's wallet stays quarantined. What follows each: [Screening & AML Cases](https://docs.aureahub.com/docs/guide-screening.md) › Release or Confirm.
- `reason`: 1 to 1000 characters, trimmed — kept with the case, answered by its reads, never in an event or the audit trail. Empty once trimmed: `400` `AML_CASE_INVALID` with `details.field` `reason`.
- **Not an `onboarding` case**: Aurea's compliance decides those, and deciding one answers `403` `AML_CASE_AUREA_DECIDES` ([Screening & AML Cases › AML Cases](https://docs.aureahub.com/docs/guide-screening.md)).
- **Once**: a decided case answers `409` `AML_CASE_DECIDED`. The decision, the screening, the quarantine and the held operation change together, or none of them does.
- `200` with the case and its `decision`. A released held operation goes on just after the answer; follow it with [Get an Operation](https://docs.aureahub.com/docs/operation-get.md), and the case's `continuation` says when it went on and the status its call answered.
- For `owner`, `tenantadmin`, `non_signing_admin` and `security_admin`. Written to your audit trail as `aml_case.released` or `aml_case.confirmed`, and sent as those events to the endpoints that name them.

## Endpoint

### `POST /v1/aml-cases/{caseId}/decision`

Authentication: bearer token required.

Releases or confirms an open AML case's match, with a written reason.

**Path parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `caseId` | string (uuid) | yes | The case's id |

**Request body**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `decision` | string | yes | `release` or `confirm` |
| `reason` | string | yes | Why, 1 to 1000 characters |

**Responses**

`200` Confirmed

```json
{
  "id": "5f2a8c1e-7b3d-4e90-a6c2-1d8e4b7f3a95",
  "status": "confirmed",
  "held": true,
  "decision": {
    "outcome": "confirmed",
    "reason": "Counterparty confirmed as the wallet of the listed entity.",
    "decidedBy": "0d2f6b8a-4c1e-4a93-b7d5-2e9f1c3a8b60",
    "decidedRole": "security_admin",
    "decidedScope": "tenant",
    "decidedAt": "2026-10-13T10:20:44.902Z",
    "exemptionUntil": null
  },
  "continuation": null,
  "…": "the case, as in List AML Cases"
}
```

`409` Decided

```json
{
  "statusCode": 409,
  "error": "ConflictError",
  "message": "This AML case is already decided.",
  "details": { "code": "AML_CASE_DECIDED" }
}
```

**Example request**

```bash
curl -X POST https://api.aureahub.com/v1/aml-cases/5f2a8c1e-7b3d-4e90-a6c2-1d8e4b7f3a95/decision \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "decision": "confirm", "reason": "Counterparty confirmed as the wallet of the listed entity." }'
```

---

Web version: https://docs.aureahub.com/#aml-case-decide