> ## Documentation Index
> Fetch the complete documentation index at: https://docs.quantumapi.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance

> AML screening results and provider callbacks.

When `CUSTODY_COMPLIANCE_ENABLED=true`, every outbound transaction is screened by the configured provider (`chainalysis` or `shuftipro`) before broadcast. The transaction stays in `PENDING_AML_SCREENING` until the screening completes.

See [Errors and codes](/qustody/errors) for screening-failure recovery and [Configuration reference](/reference/configuration) for provider setup.

## List screenings

```http theme={null}
GET /v1/compliance/screenings?status=completed&from=2026-04-01T00:00:00Z&to=2026-04-30T23:59:59Z&page=1&per_page=50
```

**Filters**

| Param            | Type   | Description                                 |
| ---------------- | ------ | ------------------------------------------- |
| `status`         | string | `pending`, `completed`, `flagged`, `failed` |
| `provider`       | string | `chainalysis`, `shuftipro`                  |
| `risk_score_min` | int    | 0–100                                       |

**Response 200**

```json theme={null}
{
  "screenings": [
    {
      "id": "scr_01HXYZ...",
      "transaction_id": "tx_...",
      "provider": "chainalysis",
      "status": "flagged",
      "risk_score": 87,
      "risk_categories": ["sanctions", "darknet"],
      "raw_response": {...},
      "completed_at": "2026-04-27T10:15:30Z",
      "created_at": "2026-04-27T10:15:00Z"
    }
  ]
}
```

## Get screening

```http theme={null}
GET /v1/compliance/screenings/{id}
```

## Get screening for a transaction

```http theme={null}
GET /v1/compliance/transactions/{txId}/screening
```

Returns the most recent screening for a given transaction, or `404` if none exists.

## Shufti Pro async callback

```http theme={null}
POST /v1/compliance/callback/shuftipro
```

Provider-only endpoint. Authenticated by Shufti Pro's HMAC signature header — no Qustody bearer token. Callers should not invoke this directly; configure the URL in Shufti Pro and the platform handles it automatically.

The handler:

1. Verifies the `Signature` header against `CUSTODY_SHUFTIPRO_SECRET_KEY`
2. Updates the screening record
3. Resumes the transaction (`PENDING_AML_SCREENING` → `READY_FOR_BROADCAST` or → `BLOCKED_BY_AML`)
4. Emits the `transaction.aml_screening.completed` webhook

## Required permissions

| Endpoint                                 | Permission             |
| ---------------------------------------- | ---------------------- |
| `GET /v1/compliance/screenings*`         | `compliance:read`      |
| `POST /v1/compliance/callback/shuftipro` | (none — provider HMAC) |