> ## Documentation Index > Fetch the complete documentation index at: https://docs.useasterisk.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Document only operations in the linked OpenAPI contract: the source-data ingestion operations and the source-scoped outbound webhook management operations. > Treat the generated OpenAPI document as authoritative for request fields. Never invent compatibility fields, alternate endpoints, or additional source models. > Preserve explicit nulls, decimal strings, timestamps, source identifiers, immutable version identifiers, and document-version links exactly as defined. # Upload a monitoring control version > Records one immutable version from the authenticated source's authoritative control catalog. Scope, depth, and configuration fingerprints allow overlap and change analysis without treating vendor alerts as the catalog. ## OpenAPI ````yaml /openapi/ingestion.openapi.yaml post /api/ingestion/monitoring-controls openapi: 3.1.0 info: title: Karsa Data Ingestion API version: current description: >- Source-bound writes for documents, business onboardings, customers, kyb-dossiers, accounts, transactions, outcomes, screening observations, screening dispositions, monitoring controls, monitoring control executions, historical RFI events, source checkpoints, native SEON screening observations, native AiPrise screening observations, and native Chainalysis screening observations. servers: - url: https://api.sandbox.useasterisk.com description: Karsa sandbox API (synthetic test data) - url: https://api.useasterisk.com description: Karsa production API security: [] tags: - name: Customers description: >- Create and version individual or business customer records, including atomic business onboarding where every beneficial owner is an individual Customer. - name: Verifications description: >- Submit immutable customer evidence snapshots for KYC or KYB evaluation, or start a KYB run for a business customer and poll its status. - name: Accounts description: >- Create and version customer-linked bank accounts, virtual accounts, and wallets without coupling the contract to a provider. - name: Documents description: Submit immutable document bytes or URL references and metadata. - name: Transactions description: Create and version money-movement records. - name: Sources description: >- Record source-attested, append-only completeness checkpoints used to qualify downstream evidence windows. - name: Outcomes description: >- Record source outcomes against customers, accounts, transactions, or documents. - name: Screening description: >- Submit provider-neutral verification, screening, alert, and reviewer-disposition evidence for Routine 6 qualification. - name: Controls description: >- Submit the source-owned monitoring control catalog and immutable execution evidence used to assess control coverage. - name: Requests description: >- Submit immutable historical request-for-information lifecycle events used to measure repeat requests and expiry. - name: Webhooks description: >- Manage source-scoped outbound destinations, receive later KYB evaluation lifecycle changes, and list recorded events to catch up on missed deliveries. paths: /api/ingestion/monitoring-controls: post: tags: - Controls summary: Upload a monitoring control version description: >- Records one immutable version from the authenticated source's authoritative control catalog. Scope, depth, and configuration fingerprints allow overlap and change analysis without treating vendor alerts as the catalog. operationId: ingestMonitoringControl parameters: - schema: type: string minLength: 1 maxLength: 200 description: >- Stable source submission identifier, unique for this source and route example: 01J9ZQ2YD15Y2YZ5H0W3J7D3E2 required: true name: Idempotency-Key in: header requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/MonitoringControlWrite' examples: request: value: externalId: control-screening-primary-v3 controlId: screening-primary controlVersion: '2026-09-01T00:00:00.000Z' obligationRefs: - aml-policy:transaction-monitoring policyVersion: aml-policy-2026-09 owner: compliance-operations controlType: ACTIVITY_MONITORING provider: SEON effectiveFrom: '2026-09-01T00:00:00.000Z' effectiveTo: null cadence: CONTINUOUS schedule: ON_EACH_TRANSACTION configured: true scheduled: true scopeFingerprint: >- aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa depthFingerprint: >- bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb configurationFingerprint: >- cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc costMinorUnits: 25 costCurrency: USD effectiveAt: '2026-09-01T00:00:00.000Z' providerDetails: null responses: '200': description: The identical source monitoring control already exists content: application/json: schema: $ref: '#/components/schemas/ControlEvidenceIngestionResponse' examples: success: value: outcome: EXISTING resourceId: monitoring_control_resource_example_01 observedAt: '2026-09-15T04:00:01.000Z' '201': description: The immutable source monitoring control was created content: application/json: schema: $ref: '#/components/schemas/ControlEvidenceIngestionResponse' examples: success: value: outcome: CREATED resourceId: monitoring_control_resource_example_01 observedAt: '2026-09-15T04:00:01.000Z' '400': description: 'INVALID_REQUEST: The request did not match the ingestion schema' content: application/problem+json: schema: $ref: '#/components/schemas/Problem' examples: INVALID_REQUEST: value: type: https://karsa.app/problems/invalid-request title: Ingestion Rejected status: 400 detail: The request did not match the ingestion schema code: INVALID_REQUEST requestId: req_example_01 '401': description: >- AUTHENTICATION_REQUIRED: A source-bound bearer credential is required content: application/problem+json: schema: $ref: '#/components/schemas/Problem' examples: AUTHENTICATION_REQUIRED: value: type: https://karsa.app/problems/authentication-required title: Ingestion Rejected status: 401 detail: A source-bound bearer credential is required code: AUTHENTICATION_REQUIRED requestId: req_example_01 '404': description: 'RESOURCE_NOT_FOUND: A referenced source resource was not found' content: application/problem+json: schema: $ref: '#/components/schemas/Problem' examples: RESOURCE_NOT_FOUND: value: type: https://karsa.app/problems/resource-not-found title: Ingestion Rejected status: 404 detail: A referenced source resource was not found code: RESOURCE_NOT_FOUND requestId: req_example_01 '409': description: 'SOURCE_IDENTITY_CONFLICT: The source identity is already bound' content: application/problem+json: schema: $ref: '#/components/schemas/Problem' examples: SOURCE_IDENTITY_CONFLICT: value: type: https://karsa.app/problems/source-identity-conflict title: Ingestion Rejected status: 409 detail: The source identity is already bound code: SOURCE_IDENTITY_CONFLICT requestId: req_example_01 '422': description: 'FUTURE_EFFECTIVE_AT: Future-effective scheduling is not supported' content: application/problem+json: schema: $ref: '#/components/schemas/Problem' examples: FUTURE_EFFECTIVE_AT: value: type: https://karsa.app/problems/future-effective-at title: Ingestion Rejected status: 422 detail: Future-effective scheduling is not supported code: FUTURE_EFFECTIVE_AT requestId: req_example_01 '429': description: 'RATE_LIMITED: The ingestion source exceeded its configured rate' content: application/problem+json: schema: $ref: '#/components/schemas/Problem' examples: RATE_LIMITED: value: type: https://karsa.app/problems/rate-limited title: Ingestion Rejected status: 429 detail: The ingestion source exceeded its configured rate code: RATE_LIMITED requestId: req_example_01 '500': description: >- INGESTION_INTERNAL_ERROR: The ingestion request could not be completed content: application/problem+json: schema: $ref: '#/components/schemas/Problem' examples: INGESTION_INTERNAL_ERROR: value: type: https://karsa.app/problems/ingestion-internal-error title: Ingestion Unavailable status: 500 detail: The ingestion request could not be completed code: INGESTION_INTERNAL_ERROR requestId: req_example_01 security: - ingestionBearer: [] components: schemas: MonitoringControlWrite: type: object properties: externalId: type: string minLength: 1 maxLength: 240 description: Stable source identity for this immutable control version. controlId: type: string minLength: 1 maxLength: 240 description: Stable source control identity shared by all of its versions. controlVersion: type: string minLength: 1 maxLength: 240 description: Source-owned control version or release identifier. obligationRefs: type: array items: type: string minLength: 1 maxLength: 240 minItems: 1 maxItems: 50 description: >- Authoritative policy or regulatory obligations addressed by this control. policyVersion: type: string minLength: 1 maxLength: 240 owner: type: string minLength: 1 maxLength: 240 controlType: type: string enum: - SCREENING - DOCUMENT - ACTIVITY_MONITORING - ENHANCED_TREATMENT - WARNING_REVIEW - RFI - OTHER provider: type: - string - 'null' minLength: 1 maxLength: 240 default: null effectiveFrom: type: string format: date-time effectiveTo: type: - string - 'null' format: date-time default: null cadence: type: string minLength: 1 maxLength: 240 description: Human-readable expected cadence, such as CONTINUOUS or MONTHLY. schedule: type: - string - 'null' minLength: 1 maxLength: 240 default: null description: Optional source schedule or trigger expression. configured: type: boolean scheduled: type: boolean scopeFingerprint: type: string pattern: ^[a-f0-9]{64}$ description: SHA-256 of the canonical covered population and subject scope. depthFingerprint: type: string pattern: ^[a-f0-9]{64}$ description: SHA-256 of the canonical checks, categories, and evidence depth. configurationFingerprint: type: string pattern: ^[a-f0-9]{64}$ description: >- SHA-256 of the canonical source configuration after secrets are removed. costMinorUnits: type: - integer - 'null' minimum: 0 maximum: 9007199254740991 default: null costCurrency: type: - string - 'null' pattern: ^[A-Z]{3}$ default: null effectiveAt: type: string format: date-time providerDetails: type: - object - 'null' additionalProperties: {} default: null description: >- Optional bounded source metadata. Credentials and signed URLs are rejected. required: - externalId - controlId - controlVersion - obligationRefs - policyVersion - owner - controlType - effectiveFrom - cadence - configured - scheduled - scopeFingerprint - depthFingerprint - configurationFingerprint - effectiveAt additionalProperties: false ControlEvidenceIngestionResponse: type: object properties: outcome: type: string enum: - CREATED - EXISTING resourceId: type: string minLength: 1 observedAt: type: string format: date-time required: - outcome - resourceId - observedAt additionalProperties: false Problem: type: object properties: type: type: string minLength: 1 title: type: string minLength: 1 status: type: integer detail: type: string minLength: 1 code: type: string minLength: 1 requestId: type: string minLength: 1 existingRunId: type: string minLength: 1 issues: type: array items: type: object properties: path: type: string message: type: string required: - path - message additionalProperties: false maxItems: 20 required: - type - title - status - detail - code - requestId additionalProperties: false securitySchemes: ingestionBearer: type: http scheme: bearer description: >- Source-bound WorkOS API key or configured machine OIDC token. OIDC webhook management requires karsa:webhooks:manage. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.