POST/simulate/risk-status

Simulate Risk Status

Sets the verdict on the application's risk assessment. Does not fire a webhook — the risk assessment is informational to a broker.

The status you set sticks. It is stamped with a broker-override marker (statusUpdatedBy prefixed b_), and every system path that would otherwise recompute this status — the status calculator and, for screenings, the re-derivation from the ComplyAdvantage match status — leaves it alone from then on. The underlying record is still refreshed; only the status is preserved.

Without this endpoint the risk assessment decides itself once every other step is past draft, which is why an application can appear to pass risk with no action from anyone.

Blocked in production. Returns 400 when simulation is disabled (broker.simulate.enabled=false or production environment).

Headers

Field	Type	Required	Possible values	Description
`session-token`	string	Required	—	SessionToken obtained from the Create GMA Session endpoint. All secured endpoints require this header.

Request body

Field	Type	Required	Possible values	Description
`Id`	string	Required	—	Application ID.
`Status`	integer	Required	2 (missing) \| 3 (approved) \| 4 (rejected)	Target risk-assessment status.
`Remark`	string	Optional	—	Optional remark stored on the risk assessment. Not delivered as a webhook — this endpoint fires none.

Example request

{
  "Id": "6a3a2f324c2e4b093dce834b",
  "Status": 3,
  "Remark": "Within acceptable risk range."
}

{
  "Id": "6a3a2f324c2e4b093dce834b",
  "Status": 3,
  "Remark": "Within acceptable risk range."
}

Response

Field	Type	Possible values	Description
`ResponseCode`	integer	200 \| 201 \| 204 \| 301 \| 400 \| 401 \| 403 \| 404 \| 410 \| 422 \| 500 \| 503	API result code in the response envelope. Indicates success or the error category (e.g. 200 success, 400 bad request, 401 unauthorized).
`ResponseMessage`	string	Success \| Created \| NoContent \| BadRequest \| Unauthorized \| Forbidden \| NotFound \| Gone \| UnprocessableContent \| ServerError \| ResourceMoved \| ServiceUnAvailable \| UnProcessableEntity	Human-readable label paired with ResponseCode (e.g. Success, BadRequest, Unauthorized). Use with ResponseCode to interpret the outcome.
`ResponseData`	object	Please refer to below example for response body	Updated risk-assessment identifiers. `ApplicationId` is the application that was targeted.

Example response

{
  "ResponseCode": 200,
  "ResponseMessage": "Success",
  "ResponseData": {
    "DocumentId": "6a3a2f324c2e4b093dce834b",
    "IndividualId": "6a3a2f324c2e4b093dce834b",
    "CommentId": "6a3a2f324c2e4b093dce834b",
    "Status": 0,
    "BusinessScreening": true,
    "ApplicationId": "6a3a2f324c2e4b093dce834b"
  }
}

{
  "ResponseCode": 200,
  "ResponseMessage": "Success",
  "ResponseData": {
    "DocumentId": "6a3a2f324c2e4b093dce834b",
    "IndividualId": "6a3a2f324c2e4b093dce834b",
    "CommentId": "6a3a2f324c2e4b093dce834b",
    "Status": 0,
    "BusinessScreening": true,
    "ApplicationId": "6a3a2f324c2e4b093dce834b"
  }
}

Does **not** fire a webhook. Returns 400 if simulation is disabled or the application is not found.

Requires `session-token: {SessionToken}` from Create GMA Session. Use the same client IP as authentication.