Choose the access your team needs
Decide who needs to screen, read results, review matches, or approve a case. Owners and administrators can limit the supported actions for analyst, developer, and viewer roles. They can also require a policy for production screening. The server checks access to production reads, exports, billing, and approvals.
Set who may approve each type of decision and when a second reviewer is needed. Changes to the team, policies, keys, webhooks, and other settings appear in the administration audit. This record is separate from case decisions and subject evidence.
Configure the workspace before a production integration
An owner or administrator sets the required production policy, reviewer and approver roles, retention policy, and document repositories in the dashboard. Your integration reads published policies from /policies and checks allowance at /usage. Show governance errors to an administrator; do not try to change settings to get past them.
Settings, membership, invitations, key management, and the administration audit require human sessions. An application route is not automatically an API-key endpoint. The consumer API reference lists the operations your machine client can use.
For a sensitive document, first approve its repository and store the original file there. A reviewer can then add the HTTPS link, version, and provenance to the case. A SanctionsKit hold or report export does not copy or preserve that external file.
Keep the controls used for each decision
New decisions save the controls in force when the reviewer acted. These include the organization approval configuration and revision, restricted approval and production roles, and the screening policy ID, version, and review rule. Case details, review history, and audit packets call this appliedControls. Archive decision records use applied_controls.
Older decisions without a saved snapshot return null. The snapshot omits notification recipients and document locations. Current settings are not inserted to fill a gap in the historical record.
Choose which notices the team receives
Set an email recipient and opt in separately to monitoring changes and overdue checks. Emails contain event links without submitted subject details. Email delivery depends on the configured service. Use dashboard events and delivery history to check what happened.
Set up organization documents
Open Settings → Organization documents. An owner or administrator chooses a document service, or selects Other to enter its name, then enters its HTTPS repository URL. This approves that exact hostname for case links. It does not connect accounts, change permissions, or give SanctionsKit upload access.
Upload original PDFs, images, and passport scans directly to your organization’s approved document service. A reviewer then pastes the existing link into the case. SanctionsKit saves the reference, version, provenance, optional SHA-256, and human verification state. It does not upload, fetch, copy, or independently verify the original file.
Your organization manages access, sharing, security, and retention in that service. Approving a repository does not establish that its configuration is suitable for sensitive files. Limit access to the people who need it and keep originals for the period your policy requires.
Use one timezone for the team
Owners and administrators choose a timezone during setup or under Settings → Date and time. It applies in both sandbox and production; the default is UTC. The dashboard labels the timezone used for timestamps, deadline entry, and report days. Changing it does not move saved events, deadlines, or expiry times.
Dates use a named month, such as 22 Sep 2026. Routine timestamps use a 24-hour clock to the minute; audit and security events include seconds. Evidence details and machine exports retain exact values. Birth dates, partial dates, and publisher calendar dates keep their known precision without timezone conversion. Public source timestamps use UTC.
When clocks move forward, some local times do not exist. Choose another time. When clocks move back, a time can occur twice; choose the earlier or later occurrence. An open date-entry draft keeps its labelled timezone if the organization setting changes.
GET /api/v1/settings returns timeZone. An authorized human session can PATCH timeZone with an IANA location name such as America/Denver. Report API requests may pass timeZone; leaving it out uses UTC date boundaries. The response and export metadata record the chosen range and timezone.
Avoid overwriting another administrator’s changes
GET /api/v1/settings returns governance and governance_revision. Include the current expectedGovernanceRevision when updating governance. If another administrator changed the settings first, the server returns 409. Reload the settings, compare the changes, and try again with the current revision.
Settings and the administration audit require an authorized human session. API-key scopes do not grant organization administration, and changes to human roles do not rewrite API-key scopes. Keys keep their assigned environment and permissions. Keep them on the server and grant only what each integration needs.
Frequently asked questions
Who can change sanctions screening access controls?
Owners and administrators manage the supported workspace controls through authorized human sessions. API keys retain their assigned scopes and environment. Giving a key more screening scopes does not let it change membership, approval rules, or organization settings.
Does approving a document repository connect or upload my files?
No. It allows case links to that exact HTTPS hostname. Store original files in your organization’s document service, then have a reviewer add the existing link to a case. Your organization still manages the file’s permissions, sharing, security, and retention.
Why did my governance settings update return 409?
The settings may have changed since you read them. Reload governance and governance_revision, review the difference, and submit the update with the current expectedGovernanceRevision. This prevents one administrator from silently overwriting another’s changes.
Does changing the organization timezone move saved deadlines?
No. It changes how the dashboard displays times and handles new date entry and report days. Saved events, deadlines, and expiry instants remain fixed. Existing date-entry drafts keep their labelled timezone. A report API request without timeZone continues to use UTC boundaries.
KEEP BUILDING