Alert
What a detector opened, routed automated or reviewed, on a decision clock.
Detectors open alerts from scored transfers and from KRI snapshots; the policy routes each one automated or reviewed when it opens and stamps a due time by SLA tier. The alert carries its evidence, the Skoor and band at the time, and whether a hard signal was present. Alerts are decided on the dashboard and inside Claude (connector tool decide_alert); the API lists the ones past their clock and exports them on the record.
Alert
| Field | Type | Notes |
|---|---|---|
| id | string (uuid) | |
| tenantId | string (uuid) | |
| programId | string (uuid) | |
| detector | string | Which detector opened it, e.g. structuring_pattern, or rule:<id>. |
| severity | "low" | "medium" | "high" | |
| subjectType | "transfer" | "entity" | "program" | "counterparty" | "account" | |
| subjectId | string | |
| transferId | string | null | |
| summary | string | |
| evidence | object | What the detector saw; carries routeReason, autoHold and escalation when they apply. |
| skoorAtAlert | integer | null | |
| bandAtAlert | "clear" | "review" | "hold" | "unscored" | null | |
| hardSignal | boolean | A hard signal always routes to a person. |
| status | "open" | "auto_closed" | "closed" | "held" | "escalated" | |
| route | "automated" | "reviewed" | null | Decided by the policy when opened. |
| policyVersion | string | null | |
| openedAt | string (date-time) | |
| closedAt | string | null (date-time) | |
| dedupeKey | string | null | |
| dueAt | string | null (date-time) | Decision clock: when a person must have decided by. |
| escalatedAt | string | null (date-time) | Stamped once when the clock ran out. |
| slaTier | "auto" | "standard" | "complex" | "appeal" | null |
OverdueAlert
| Field | Type | Notes |
|---|---|---|
| id | string (uuid) | |
| programId | string (uuid) | |
| detector | string | |
| severity | string | |
| status | string | |
| route | string | null | |
| slaTier | string | null | |
| openedAt | string (date-time) | |
| dueAt | string | null (date-time) | |
| escalatedAt | string | null (date-time) | |
| summary | string |
Endpoints
get/api/clocks/overdue
Alerts past their decision clock
| Auth | Bearer + X-Operator |
|---|---|
| Operation | Alert · GET /api/clocks/overdue |
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
| tenant (optional) | query | string | Tenant slug. Optional: the bearer token already proves the tenant. Pass it to be explicit. |
Responses
200 — Waiting alerts (open, held, escalated) whose due time has passed, oldest due first, with the clock policy in force. object
| Field | Type | Notes |
|---|---|---|
| asOf | string (date-time) | |
| policy | ClockPolicy | |
| count | integer | |
| alerts | OverdueAlert[] |
401 — Bearer token missing or unknown. Error
| Field | Type | Notes |
|---|---|---|
| error | string | What went wrong, in one sentence. |
| requestId (optional) | string | Present once the gateway is live: the X-Request-Id of the failed request. |
Example
curl -s "https://skoor.ai/risk/api/clocks/overdue?tenant=demo" \ -H "Authorization: Bearer test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \ -H "X-Operator: you@bank.example"