> Toden documentation. For the full index fetch /llms.txt. Every page is available as Markdown by appending .md to its URL. Identity verification uses /api/kyc, Risk Intelligence uses /api/v1; they are separate contracts with different error shapes. Never invent an endpoint, field or enum value: read the API reference page for the operation first.

# What Risk Intelligence is

> Real-time decisions, ongoing customer monitoring, Travel Rule controls and investigations.

Risk Intelligence helps your backend answer one operational question: **can this
customer action proceed, does it need review, or should it stop?** Toden connects
the decision to the customer, evidence, alerts and any resulting investigation.

## Choose the job you need

| Job                                              | Start here                                                | Result                                                                                                     |
| ------------------------------------------------ | --------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
| Decide on a payment, transfer or crypto movement | `POST /api/v1/transactions`                               | A synchronous `allow`, `review` or `block` summary.                                                        |
| Investigate a wallet                             | Spot Checks → Wallet, or `POST /api/v1/wallet-screenings` | A wallet risk result with exposures and triggered rule versions. A transaction hash alone is not screened. |
| Decide on a login, sign-up or account change     | `POST /api/v1/activities`                                 | The same synchronous decision summary.                                                                     |
| Register a customer you already verified         | `POST /api/v1/entities`                                   | An Entity ID for risk assessment and monitoring.                                                           |
| Screen an existing customer                      | `POST /api/v1/risk-assessments`                           | A risk snapshot using the checks you selected.                                                             |
| Keep an existing customer under review           | `POST /api/v1/monitoring/subscriptions`                   | Scheduled checks, material changes and alerts.                                                             |
| Apply Travel Rule controls to crypto             | Add `transaction.travelRule`                              | Applicability, missing information and transfer action.                                                    |
| Investigate a material alert                     | Investigations                                            | Owner, evidence, timeline, remediation and outcome.                                                        |

## Read the small result first

Activity and transaction responses include `assessment.summary`. It contains the
outcome, strongest plain-language reason, score, risk level and next action. Use
that object for normal routing. Read the detailed rules, screening and billing
evidence only when an operator needs to investigate.

```json
{
  "outcome": "review",
  "title": "Review required",
  "reason": "Transaction value exceeded the active review threshold.",
  "score": 50,
  "riskLevel": "medium",
  "matchedRules": 1,
  "nextAction": {
    "type": "review_activity",
    "label": "Review transaction"
  }
}
```

## What is synchronous and what is not

* Activity and transaction decisions return in the request. Their assessed
  webhooks are optional notifications carrying the same summary.
* Monitoring is ongoing. Runs, changes and alerts arrive after enrolment.
* Travel Rule is part of a crypto transaction. Missing information keeps the
  current validation generation pending until you submit the named fields.
* Investigations are casework records. Assignment and status changes return
  immediately and remain in the timeline.

All Risk Intelligence server calls use a secret key and the versioned base URL
`https://sandbox-api.toden.co/api/v1` in Sandbox or
`https://api.toden.co/api/v1` in Production.

In the dashboard, manage one customer's monitoring state and frequency from the
Entity. Use Risk Intelligence for portfolio changes, Review Queue for action,
and Rules & Policies for monitoring defaults.

## Next steps

* [Run your first decision](/risk-intelligence/quickstart).
* [Read customer risk and monitoring together](/risk-intelligence/customers/customer-risk-reads).
* [Send complete transactions and activities](/risk-intelligence/monitoring/events).
* [Start continuous monitoring](/risk-intelligence/monitoring/policies).
* [Integrate Travel Rule](/risk-intelligence/travel-rule/overview).
* [Configure webhooks](/integrate/webhooks/overview).
* [Work with alerts and investigations](/risk-intelligence/operations/investigations).