Create risk profile

curl --request POST \
  --url https://api.platform.bitnob.com/kyt/risk-profiles \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --header 'X-API-Key: <api-key>' \
  --data '
{
  "name": "default",
  "rules": [
    {
      "categories": "[\"sanctions\"]",
      "direction": "outgoing",
      "exposure_type": "direct",
      "level_actions": {
        "high": "block",
        "none": "allow",
        "severe": "block"
      },
      "max_exposure_usd": "5000",
      "min_exposure_usd": "1000"
    }
  ]
}
'

const options = {
  method: 'POST',
  headers: {
    'Idempotency-Key': '<idempotency-key>',
    'X-API-Key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: 'default',
    rules: [
      {
        categories: '["sanctions"]',
        direction: 'outgoing',
        exposure_type: 'direct',
        level_actions: {high: 'block', none: 'allow', severe: 'block'},
        max_exposure_usd: '5000',
        min_exposure_usd: '1000'
      }
    ]
  })
};

fetch('https://api.platform.bitnob.com/kyt/risk-profiles', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.platform.bitnob.com/kyt/risk-profiles"

payload = {
    "name": "default",
    "rules": [
        {
            "categories": "[\"sanctions\"]",
            "direction": "outgoing",
            "exposure_type": "direct",
            "level_actions": {
                "high": "block",
                "none": "allow",
                "severe": "block"
            },
            "max_exposure_usd": "5000",
            "min_exposure_usd": "1000"
        }
    ]
}
headers = {
    "Idempotency-Key": "<idempotency-key>",
    "X-API-Key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.platform.bitnob.com/kyt/risk-profiles",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => 'default',
    'rules' => [
        [
                'categories' => '["sanctions"]',
                'direction' => 'outgoing',
                'exposure_type' => 'direct',
                'level_actions' => [
                                'high' => 'block',
                                'none' => 'allow',
                                'severe' => 'block'
                ],
                'max_exposure_usd' => '5000',
                'min_exposure_usd' => '1000'
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "Idempotency-Key: <idempotency-key>",
    "X-API-Key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.platform.bitnob.com/kyt/risk-profiles"

	payload := strings.NewReader("{\n  \"name\": \"default\",\n  \"rules\": [\n    {\n      \"categories\": \"[\\\"sanctions\\\"]\",\n      \"direction\": \"outgoing\",\n      \"exposure_type\": \"direct\",\n      \"level_actions\": {\n        \"high\": \"block\",\n        \"none\": \"allow\",\n        \"severe\": \"block\"\n      },\n      \"max_exposure_usd\": \"5000\",\n      \"min_exposure_usd\": \"1000\"\n    }\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Idempotency-Key", "<idempotency-key>")
	req.Header.Add("X-API-Key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.platform.bitnob.com/kyt/risk-profiles")
  .header("Idempotency-Key", "<idempotency-key>")
  .header("X-API-Key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"default\",\n  \"rules\": [\n    {\n      \"categories\": \"[\\\"sanctions\\\"]\",\n      \"direction\": \"outgoing\",\n      \"exposure_type\": \"direct\",\n      \"level_actions\": {\n        \"high\": \"block\",\n        \"none\": \"allow\",\n        \"severe\": \"block\"\n      },\n      \"max_exposure_usd\": \"5000\",\n      \"min_exposure_usd\": \"1000\"\n    }\n  ]\n}")
  .asString();

{
  "catchall": {
    "high": "block",
    "low": "allow",
    "medium": "hold",
    "none": "allow",
    "severe": "block"
  },
  "created_at": "2026-05-16T10:30:00Z",
  "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
  "is_default": true,
  "name": "default",
  "object": "risk_profile",
  "rules": [
    {
      "categories": "[\"sanctions\"]",
      "direction": "outgoing",
      "exposure_type": "direct",
      "level_actions": {
        "high": "block",
        "none": "allow",
        "severe": "block"
      },
      "max_exposure_usd": "5000",
      "min_exposure_usd": "1000"
    }
  ],
  "updated_at": "2026-05-16T10:30:00Z"
}

{
  "error": {
    "code": "<string>",
    "details": {},
    "message": "<string>",
    "param": "<string>",
    "request_id": "<string>",
    "type": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "details": {},
    "message": "<string>",
    "param": "<string>",
    "request_id": "<string>",
    "type": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "details": {},
    "message": "<string>",
    "param": "<string>",
    "request_id": "<string>",
    "type": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "details": {},
    "message": "<string>",
    "param": "<string>",
    "request_id": "<string>",
    "type": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "details": {},
    "message": "<string>",
    "param": "<string>",
    "request_id": "<string>",
    "type": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "details": {},
    "message": "<string>",
    "param": "<string>",
    "request_id": "<string>",
    "type": "<string>"
  }
}

KYT

Create risk profile

Creates a KYT risk profile. When catchall is supplied it must map all five alert levels (none, low, medium, high, severe) to an action (allow, hold, block, or flag: credit but flag for review); if it is omitted, a safe default catch-all is applied. Each rule targets one or more categories from the KYT category catalogue (see GET /kyt/categories). Rules are checked for conflicts: two rules that assign the same category and alert level different actions within overlapping exposure scope are rejected. The first profile an organization creates becomes its default automatically. The Idempotency-Key header is required.

POST

kyt

risk-profiles

Create risk profile

curl --request POST \
  --url https://api.platform.bitnob.com/kyt/risk-profiles \
  --header 'Content-Type: application/json' \
  --header 'Idempotency-Key: <idempotency-key>' \
  --header 'X-API-Key: <api-key>' \
  --data '
{
  "name": "default",
  "rules": [
    {
      "categories": "[\"sanctions\"]",
      "direction": "outgoing",
      "exposure_type": "direct",
      "level_actions": {
        "high": "block",
        "none": "allow",
        "severe": "block"
      },
      "max_exposure_usd": "5000",
      "min_exposure_usd": "1000"
    }
  ]
}
'

const options = {
  method: 'POST',
  headers: {
    'Idempotency-Key': '<idempotency-key>',
    'X-API-Key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: 'default',
    rules: [
      {
        categories: '["sanctions"]',
        direction: 'outgoing',
        exposure_type: 'direct',
        level_actions: {high: 'block', none: 'allow', severe: 'block'},
        max_exposure_usd: '5000',
        min_exposure_usd: '1000'
      }
    ]
  })
};

fetch('https://api.platform.bitnob.com/kyt/risk-profiles', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.platform.bitnob.com/kyt/risk-profiles"

payload = {
    "name": "default",
    "rules": [
        {
            "categories": "[\"sanctions\"]",
            "direction": "outgoing",
            "exposure_type": "direct",
            "level_actions": {
                "high": "block",
                "none": "allow",
                "severe": "block"
            },
            "max_exposure_usd": "5000",
            "min_exposure_usd": "1000"
        }
    ]
}
headers = {
    "Idempotency-Key": "<idempotency-key>",
    "X-API-Key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.platform.bitnob.com/kyt/risk-profiles",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => 'default',
    'rules' => [
        [
                'categories' => '["sanctions"]',
                'direction' => 'outgoing',
                'exposure_type' => 'direct',
                'level_actions' => [
                                'high' => 'block',
                                'none' => 'allow',
                                'severe' => 'block'
                ],
                'max_exposure_usd' => '5000',
                'min_exposure_usd' => '1000'
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "Idempotency-Key: <idempotency-key>",
    "X-API-Key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.platform.bitnob.com/kyt/risk-profiles"

	payload := strings.NewReader("{\n  \"name\": \"default\",\n  \"rules\": [\n    {\n      \"categories\": \"[\\\"sanctions\\\"]\",\n      \"direction\": \"outgoing\",\n      \"exposure_type\": \"direct\",\n      \"level_actions\": {\n        \"high\": \"block\",\n        \"none\": \"allow\",\n        \"severe\": \"block\"\n      },\n      \"max_exposure_usd\": \"5000\",\n      \"min_exposure_usd\": \"1000\"\n    }\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Idempotency-Key", "<idempotency-key>")
	req.Header.Add("X-API-Key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.platform.bitnob.com/kyt/risk-profiles")
  .header("Idempotency-Key", "<idempotency-key>")
  .header("X-API-Key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"default\",\n  \"rules\": [\n    {\n      \"categories\": \"[\\\"sanctions\\\"]\",\n      \"direction\": \"outgoing\",\n      \"exposure_type\": \"direct\",\n      \"level_actions\": {\n        \"high\": \"block\",\n        \"none\": \"allow\",\n        \"severe\": \"block\"\n      },\n      \"max_exposure_usd\": \"5000\",\n      \"min_exposure_usd\": \"1000\"\n    }\n  ]\n}")
  .asString();

{
  "catchall": {
    "high": "block",
    "low": "allow",
    "medium": "hold",
    "none": "allow",
    "severe": "block"
  },
  "created_at": "2026-05-16T10:30:00Z",
  "id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
  "is_default": true,
  "name": "default",
  "object": "risk_profile",
  "rules": [
    {
      "categories": "[\"sanctions\"]",
      "direction": "outgoing",
      "exposure_type": "direct",
      "level_actions": {
        "high": "block",
        "none": "allow",
        "severe": "block"
      },
      "max_exposure_usd": "5000",
      "min_exposure_usd": "1000"
    }
  ],
  "updated_at": "2026-05-16T10:30:00Z"
}

{
  "error": {
    "code": "<string>",
    "details": {},
    "message": "<string>",
    "param": "<string>",
    "request_id": "<string>",
    "type": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "details": {},
    "message": "<string>",
    "param": "<string>",
    "request_id": "<string>",
    "type": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "details": {},
    "message": "<string>",
    "param": "<string>",
    "request_id": "<string>",
    "type": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "details": {},
    "message": "<string>",
    "param": "<string>",
    "request_id": "<string>",
    "type": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "details": {},
    "message": "<string>",
    "param": "<string>",
    "request_id": "<string>",
    "type": "<string>"
  }
}

{
  "error": {
    "code": "<string>",
    "details": {},
    "message": "<string>",
    "param": "<string>",
    "request_id": "<string>",
    "type": "<string>"
  }
}

Authorizations

X-API-Key

string

header

required

Headers

API-Version

enum<string>

default:v1

API version (defaults to the latest supported version if omitted).

Available options:

v1

Idempotency-Key

string

required

Unique key (1-255 printable ASCII chars) used to safely retry write operations. Same key + body returns the cached response; same key + different body returns 409.

Required string length: 1 - 255

Body

application/json

name

string

required

Human-readable name for the risk profile.

Required string length: 1 - 100

Example:

"default"

catchall

object

Baseline decision for every alert level, applied to any alert not matched by a rule. Optional: omit to use a safe default; if supplied, all five levels are required.

Show child attributes

rules

object[]

Category rules evaluated before the catch-all. A rule's level_actions take precedence over the catch-all for the levels it sets.

Show child attributes

Response

Created

catchall

object

Baseline decision for every alert level, applied to any alert not matched by a rule.

Show child attributes

created_at

string<date-time>

When the risk profile was created.

Example:

"2026-05-16T10:30:00Z"

string

Unique identifier of the risk profile.

Example:

"f47ac10b-58cc-4372-a567-0e02b2c3d479"

is_default

boolean

Whether this profile is the organization's active default, applied to screening decisions.

Example:

true

name

string

Human-readable name of the risk profile.

Example:

"default"

object

string

Object type discriminator; always "risk_profile".

Example:

"risk_profile"

rules

object[]

Category rules evaluated before the catch-all.

Show child attributes

updated_at

string<date-time>

When the risk profile was last updated.

Example:

"2026-05-16T10:30:00Z"

Get started

Meta

Assets

Vaults

Wallets

Transactions

Gas stations

Sponsored transfers

Consolidation

Policies

KYT

Insights

Users

Subscriptions

Webhooks

RPC

Create risk profile

Authorizations

Headers

Body

Response