> ## Documentation Index > Fetch the complete documentation index at: https://docs.useasterisk.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Document only operations in the linked OpenAPI contract: the source-data ingestion operations and the source-scoped outbound webhook management operations. > Treat the generated OpenAPI document as authoritative for request fields. Never invent compatibility fields, alternate endpoints, or additional source models. > Preserve explicit nulls, decimal strings, timestamps, source identifiers, immutable version identifiers, and document-version links exactly as defined. # Upload a historical RFI lifecycle event > Records one immutable request, response, expiry, closure, or cancellation event for a source-owned RFI. Events retain the source request identity and customer binding needed to measure repeat requests and expiry without exposing response contents. ## OpenAPI ````yaml /openapi/ingestion.openapi.yaml post /api/ingestion/rfi-events openapi: 3.1.0 info: title: Karsa Data Ingestion API version: current description: >- Source-bound writes for documents, business onboardings, customers, kyb-dossiers, accounts, transactions, outcomes, screening observations, screening dispositions, monitoring controls, monitoring control executions, historical RFI events, source checkpoints, native SEON screening observations, native AiPrise screening observations, and native Chainalysis screening observations. servers: - url: https://api.sandbox.useasterisk.com description: Karsa sandbox API (synthetic test data) - url: https://api.useasterisk.com description: Karsa production API security: [] tags: - name: Customers description: >- Create and version individual or business customer records, including atomic business onboarding where every beneficial owner is an individual Customer. - name: Verifications description: >- Submit immutable customer evidence snapshots for KYC or KYB evaluation, or start a KYB run for a business customer and poll its status. - name: Accounts description: >- Create and version customer-linked bank accounts, virtual accounts, and wallets without coupling the contract to a provider. - name: Documents description: Submit immutable document bytes or URL references and metadata. - name: Transactions description: Create and version money-movement records. - name: Sources description: >- Record source-attested, append-only completeness checkpoints used to qualify downstream evidence windows. - name: Outcomes description: >- Record source outcomes against customers, accounts, transactions, or documents. - name: Screening description: >- Submit provider-neutral verification, screening, alert, and reviewer-disposition evidence for Routine 6 qualification. - name: Controls description: >- Submit the source-owned monitoring control catalog and immutable execution evidence used to assess control coverage. - name: Requests description: >- Submit immutable historical request-for-information lifecycle events used to measure repeat requests and expiry. - name: Webhooks description: >- Manage source-scoped outbound destinations, receive later KYB evaluation lifecycle changes, and list recorded events to catch up on missed deliveries. paths: /api/ingestion/rfi-events: post: tags: - Requests summary: Upload a historical RFI lifecycle event description: >- Records one immutable request, response, expiry, closure, or cancellation event for a source-owned RFI. Events retain the source request identity and customer binding needed to measure repeat requests and expiry without exposing response contents. operationId: ingestHistoricalRfiEvent parameters: - schema: type: string minLength: 1 maxLength: 200 description: >- Stable source submission identifier, unique for this source and route example: 01J9ZQ2YD15Y2YZ5H0W3J7D3E2 required: true name: Idempotency-Key in: header requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/HistoricalRfiEventWrite' examples: request: value: externalId: rfi-event-example-001 requestExternalId: receiver-rfi-example-001 customerId: customer_resource_example_01 eventType: REQUESTED fieldKeys: - beneficiary_relationship - source_of_funds sourceStatus: open responseExternalId: null disposition: null actorExternalId: reviewer-example-001 dueAt: '2026-09-22T04:00:00.000Z' occurredAt: '2026-09-15T04:00:00.000Z' effectiveAt: '2026-09-15T04:00:00.000Z' providerDetails: null responses: '200': description: The identical source historical RFI event already exists content: application/json: schema: $ref: '#/components/schemas/ControlEvidenceIngestionResponse' examples: success: value: outcome: EXISTING resourceId: historical_RFI_event_resource_example_01 observedAt: '2026-09-15T04:00:01.000Z' '201': description: The immutable source historical RFI event was created content: application/json: schema: $ref: '#/components/schemas/ControlEvidenceIngestionResponse' examples: success: value: outcome: CREATED resourceId: historical_RFI_event_resource_example_01 observedAt: '2026-09-15T04:00:01.000Z' '400': description: 'INVALID_REQUEST: The request did not match the ingestion schema' content: application/problem+json: schema: $ref: '#/components/schemas/Problem' examples: INVALID_REQUEST: value: type: https://karsa.app/problems/invalid-request title: Ingestion Rejected status: 400 detail: The request did not match the ingestion schema code: INVALID_REQUEST requestId: req_example_01 '401': description: >- AUTHENTICATION_REQUIRED: A source-bound bearer credential is required content: application/problem+json: schema: $ref: '#/components/schemas/Problem' examples: AUTHENTICATION_REQUIRED: value: type: https://karsa.app/problems/authentication-required title: Ingestion Rejected status: 401 detail: A source-bound bearer credential is required code: AUTHENTICATION_REQUIRED requestId: req_example_01 '404': description: 'RESOURCE_NOT_FOUND: A referenced source resource was not found' content: application/problem+json: schema: $ref: '#/components/schemas/Problem' examples: RESOURCE_NOT_FOUND: value: type: https://karsa.app/problems/resource-not-found title: Ingestion Rejected status: 404 detail: A referenced source resource was not found code: RESOURCE_NOT_FOUND requestId: req_example_01 '409': description: 'SOURCE_IDENTITY_CONFLICT: The source identity is already bound' content: application/problem+json: schema: $ref: '#/components/schemas/Problem' examples: SOURCE_IDENTITY_CONFLICT: value: type: https://karsa.app/problems/source-identity-conflict title: Ingestion Rejected status: 409 detail: The source identity is already bound code: SOURCE_IDENTITY_CONFLICT requestId: req_example_01 '422': description: 'FUTURE_EFFECTIVE_AT: Future-effective scheduling is not supported' content: application/problem+json: schema: $ref: '#/components/schemas/Problem' examples: FUTURE_EFFECTIVE_AT: value: type: https://karsa.app/problems/future-effective-at title: Ingestion Rejected status: 422 detail: Future-effective scheduling is not supported code: FUTURE_EFFECTIVE_AT requestId: req_example_01 '429': description: 'RATE_LIMITED: The ingestion source exceeded its configured rate' content: application/problem+json: schema: $ref: '#/components/schemas/Problem' examples: RATE_LIMITED: value: type: https://karsa.app/problems/rate-limited title: Ingestion Rejected status: 429 detail: The ingestion source exceeded its configured rate code: RATE_LIMITED requestId: req_example_01 '500': description: >- INGESTION_INTERNAL_ERROR: The ingestion request could not be completed content: application/problem+json: schema: $ref: '#/components/schemas/Problem' examples: INGESTION_INTERNAL_ERROR: value: type: https://karsa.app/problems/ingestion-internal-error title: Ingestion Unavailable status: 500 detail: The ingestion request could not be completed code: INGESTION_INTERNAL_ERROR requestId: req_example_01 security: - ingestionBearer: [] components: schemas: HistoricalRfiEventWrite: type: object properties: externalId: type: string minLength: 1 maxLength: 240 description: Stable source identity for this immutable RFI event. requestExternalId: type: string minLength: 1 maxLength: 240 description: >- Stable source request identity shared by every event in the RFI lifecycle. customerId: type: string minLength: 1 maxLength: 240 description: Karsa customer resourceId returned by customer ingestion. eventType: type: string enum: - REQUESTED - RESPONDED - EXPIRED - CLOSED - CANCELLED fieldKeys: type: array items: type: string minLength: 1 maxLength: 240 maxItems: 100 default: [] description: >- Requested field names only. Do not send raw customer response values here. sourceStatus: type: string minLength: 1 maxLength: 240 responseExternalId: type: - string - 'null' minLength: 1 maxLength: 240 default: null disposition: type: - string - 'null' minLength: 1 maxLength: 5000 default: null actorExternalId: type: - string - 'null' minLength: 1 maxLength: 240 default: null dueAt: type: - string - 'null' format: date-time default: null occurredAt: type: string format: date-time effectiveAt: type: string format: date-time providerDetails: type: - object - 'null' additionalProperties: {} default: null description: >- Optional bounded source metadata. Credentials and signed URLs are rejected. required: - externalId - requestExternalId - customerId - eventType - sourceStatus - occurredAt - effectiveAt additionalProperties: false ControlEvidenceIngestionResponse: type: object properties: outcome: type: string enum: - CREATED - EXISTING resourceId: type: string minLength: 1 observedAt: type: string format: date-time required: - outcome - resourceId - observedAt additionalProperties: false Problem: type: object properties: type: type: string minLength: 1 title: type: string minLength: 1 status: type: integer detail: type: string minLength: 1 code: type: string minLength: 1 requestId: type: string minLength: 1 existingRunId: type: string minLength: 1 issues: type: array items: type: object properties: path: type: string message: type: string required: - path - message additionalProperties: false maxItems: 20 required: - type - title - status - detail - code - requestId additionalProperties: false securitySchemes: ingestionBearer: type: http scheme: bearer description: >- Source-bound WorkOS API key or configured machine OIDC token. OIDC webhook management requires karsa:webhooks:manage. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.