Step 01
Initialize or go stateless.
Open a stateful session when your client maintains context. Use a single POST when each call is independent.
ThreatMinder · MAGGIE AI
MAGGIE AI Developer
Meet MAGGIE · ThreatMinder AI
MAGGIE is the ThreatMinder AI agent. Pick an integration surface — direct entity search, MCP for tool-driven clients, or Batch API for CSV operations — and move from first call to working rollout with live examples.
Quick examples
Switch surfaces and inspect the first call.
MCP
curl -X POST "__PRODUCTION_URL__/api/v2/mcp" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"create_batch","arguments":{"entityType":"PERSON","useCase":"SEAD4","csvContent":"first_name,last_name,city,state\\nJane,Doe,Austin,TX"}}}'
Batch API
curl -X POST "__PRODUCTION_URL__/api/v2/batch" \
-H "X-API-Key: YOUR_API_KEY" \
-F "file=@customers.csv" \
-F "name=customer-rollout"
Integration Studio
The primary tabs switch between product surfaces. The nested tabs switch between workflow, examples, and operational reference. That keeps the first screen compact while still putting real payloads one click away.
Step 01
Open a stateful session when your client maintains context. Use a single POST when each call is independent.
Step 02
Call tools/list to inspect the current
runtime schemas before your client issues tool calls.
Step 03
The current tool set exposes
create_batch and
get_batch_result so job creation and
retrieval stay explicit.
curl -X POST "__PRODUCTION_URL__/api/v2/mcp" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "initialize",
"params": {
"protocolVersion": "2024-11-05",
"clientInfo": { "name": "your-client", "version": "1.0.0" },
"capabilities": {}
}
}'
curl -X POST "__PRODUCTION_URL__/api/v2/mcp" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{
"jsonrpc": "2.0",
"id": 2,
"method": "tools/list",
"params": {}
}'
curl -X POST "__PRODUCTION_URL__/api/v2/mcp" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{
"jsonrpc": "2.0",
"id": 3,
"method": "tools/call",
"params": {
"name": "create_batch",
"arguments": {
"entityType": "BUSINESS",
"useCase": "RESTAURANT-ONBOARD",
"csvContent": "name,address,city,state,zip\nTaco Palace,123 Main St,Austin,TX,78701"
}
}
}'
Available tools
create_batch
Accepts entityType, useCase,
and csvContent. Returns the batch identity.
Available tools
get_batch_result
Accepts a UUID id and returns the processed
CSV when the result is ready.
Step 01
Batch validation depends on both, so map your source schema before upload.
Step 02
Treat the response ID as your job identity for retries, polling, and audit state inside your own system.
Step 03
When the result exists, ThreatMinder returns CSV content containing the enriched output.
PERSON template
first_name,last_name,address,city,state,zip,phone1,email,dob,external_id
Jane,Doe,123 Main St,Austin,TX,78701,5125550199,jane@example.com,1989-08-03,person-001
BUSINESS template
name,address,city,state,zip,phone1,email,external_id
Taco Palace,123 Main St,Austin,TX,78701,5125550148,ops@tacopalace.com,business-001
curl -X POST "__PRODUCTION_URL__/api/v2/batch" \
-H "X-API-Key: YOUR_API_KEY" \
-F "entityType=PERSON" \
-F "useCase=SEAD4" \
-F "file=@./people.csv;type=text/csv"
curl "__PRODUCTION_URL__/api/v2/batch/550e8400-e29b-41d4-a716-446655440000" \
-H "X-API-Key: YOUR_API_KEY"
{
"id": "550e8400-e29b-41d4-a716-446655440000",
"entityType": "PERSON",
"useCase": "SEAD4"
}
Need the public site?
Use the official site when the reader needs the external brand story. Use the studio above when the reader needs working integration detail, live payloads, and reference context.
Supported use cases
Each use case is a stable integration key. MAGGIE resolves the enabled version behind that key, so customers can keep payloads steady while ThreatMinder improves prompts, models, guardrails, and scoring output.
Claimants, employees, partner personnel, and recurring monitoring.
Identity checks, fraud, AML, sanctions, and watchlist screening.
Insider threat, executive protection, events, and foreign connections.
Commercial entities, suppliers, vendors, and onboarding reviews.
Catalog
These are the values accepted by batch and MCP integrations. Descriptions stay high-level here; detailed guardrails live in the versioned policy configured inside ThreatMinder.
SEAD4Baseline people and organization risk screening for broad investigations.
AML-FRAUD-IDENTITYIdentity, fraud, AML, sanctions, watchlist, and adverse-media review.
AML-RISKAML exposure, financial-crime indicators, and compliance-risk scoring.
CLAIMANT-SCREENINGClaim context, identity signals, litigation, activity, and public records.
PARTNER-PERSONNELThird-party personnel review for conflicts, misconduct, and public risk.
PERSONNEL-MONITORINGRecurring personnel checks for new misconduct and public-risk signals.
INSIDER-THREATSignals for access misuse, policy issues, conflicts, and sensitive risk.
EXECUTIVE-PROTECTIONExposure review for executives, VIPs, events, and protective programs.
FOREIGN-CONNECTIONForeign affiliation, influence, ownership, and cross-border exposure.
COMMERCIAL-ENTITYCompany screening for sanctions, ownership, compliance, and operations risk.
SUPPLY-CHAINVendor and supplier verification for supply-chain screening programs.
SUPPLY-CHAIN-RISKEnhanced supplier risk review for vendor, entity, and logistics programs.
RESTAURANT-ONBOARDRestaurant onboarding review for compliance, ownership, and public risk.
Meet MAGGIE · API reference
Start with a workflow, then open the exact endpoint examples when you are ready to build.
Getting started
Most integrations only need one surface. Start here, choose the right workflow, create the correct backoffice permissions, make one request, then add polling or automation once the first run is working.
Best for apps that already know the person, business, or event to screen and want one async MAGGIE search.
POST /api/v2/entity-searches 02Best for agents and orchestrators that discover tools and call MAGGIE through JSON-RPC.
POST /api/v2/mcp 03Best for operational uploads where a customer sends many entities and retrieves an enriched CSV later.
POST /api/v2/batchRecommended flow
Generate a tenant-scoped key in backoffice and enable only the permissions that workflow needs.
Use stable keys like SEAD4,
AML-FRAUD-IDENTITY, or
SUPPLY-CHAIN for direct searches, or
SUPPLY-CHAIN-RISK for Batch/MCP CSV
workflows.
Use the example cURL, keep entity identity fields separated, and store the returned IDs.
Poll status, then page through documents or retrieve the batch result once processing completes.
Meet MAGGIE
MAGGIE is the AI agent ThreatMinder exposes to customers. Every batch decision and tool call in this reference is her running inference. The integration surfaces below are the ways partner systems can hand her work and pick up her results.
What MAGGIE is
Entity screening and batch processing running behind a single ThreatMinder surface.
Where she plugs in
Direct entity search for one-off screening, MCP for tool-driven clients, and Batch API for CSV ops workflows.
Who uses it
This reference is for the engineers wiring MAGGIE into a production customer workflow — not the end user.
Every call to MAGGIE is authenticated with a tenant-scoped API key sent as an HTTP header. Batch API, direct entity search, and MCP share the same scheme. Direct entity search and MCP are permission-scoped in backoffice; CSV batch upload is additionally limited to Enterprise organizations. Backoffice can also limit a key to one or more allowed use cases.
Header
X-API-KeyIssued per customer tenant. Send on every request as an HTTP header.
X-API-Key: YOUR_API_KEY
Permissions
Direct entity search uses
CREATE:ENTITY_SEARCH:OWN and
READ:ENTITY_SEARCH:OWN. MCP access requires
USE:MCP:OWN plus the specific tool permission.
CSV batch upload is available to Enterprise organizations.
Use-case scope
Use-case scopes are optional. When configured, the key can
only create direct searches, batches, or MCP batch jobs for
those use cases, such as SEAD4. Empty scope
means all use cases allowed by the endpoint permission.
Document source scope
Backoffice can also limit result documents by
sourceProvider. Common values include
serp-api, babel-document-search,
babel-people-watchlist, and
babel-people-darkweb. Empty scope means every
document source provider is visible.
IP allowlist
Backoffice can limit a key to exact IP addresses or IPv4
CIDR ranges such as 203.0.113.10 or
203.0.113.0/24. Empty allowlist means any IP is
allowed. Requests outside the allowlist are rejected before
MAGGIE spends customer quota.
The production base URL used across this reference is rendered below from the docs environment. Partners typically pin this value in their own config and surface it in their deployment manifests.
Use case keys are stable integration inputs. MAGGIE resolves the active versioned policy server-side, including the prompt, model, guardrails, and expected output shape.
General / identity
SEAD4, AML-FRAUD-IDENTITY,
AML-RISK
Broad threat assessment, identity verification, fraud, AML, sanctions, and adverse-media screening.
People
CLAIMANT-SCREENING,
PARTNER-PERSONNEL,
PERSONNEL-MONITORING
Person-centric workflows for claimant, partner, and workforce monitoring programs.
Security programs
INSIDER-THREAT,
EXECUTIVE-PROTECTION,
FOREIGN-CONNECTION
Specialized risk programs for insider indicators, executive protection, events, and foreign influence or affiliation.
Business
COMMERCIAL-ENTITY, SUPPLY-CHAIN
,
SUPPLY-CHAIN-RISK,
RESTAURANT-ONBOARD
Business, vendor, supplier, and restaurant onboarding screening for commercial-risk workflows.
Direct Entity Search API
Use this endpoint when a partner system already knows the person, business, or event it wants MAGGIE to process. The API creates one entity-search, reserves capacity, dispatches the pipeline, and returns IDs that can be polled for progress and results.
searchTerm focused on the entity name. Send
location, email, phone, username, and tax identifiers in their
own fields so MAGGIE can compare documents against the expected
identity instead of treating those details as generic search
text.
Send one JSON payload to
POST /api/v2/entity-searches with the
organization API key.
Keep entitySearchId,
searchBatchId, and your
clientRequestId for reconciliation.
Poll status, then page documents once MAGGIE has produced results.
__PRODUCTION_URL__/api/v2/entity-searches
Requires CREATE:ENTITY_SEARCH:OWN. Add
READ:ENTITY_SEARCH:OWN to the same key when the
integration also needs to read status, audit trail, or
documents.
Request
X-API-KeyContent-Typeapplication/jsonsearchTypeperson or business.searchTermuseCase
SEAD4. Supported direct API
values are SEAD4,
SUPPLY-CHAIN, INSIDER-THREAT,
EXECUTIVE-PROTECTION,
AML-RISK, AML-FRAUD-IDENTITY,
CLAIMANT-SCREENING, and
COUNTER-INTELLIGENCE.
clientRequestId
flowId
Request example
curl -X POST "__PRODUCTION_URL__/api/v2/entity-searches" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{
"searchType": "person",
"searchTerm": "John Smith",
"useCase": "AML-FRAUD-IDENTITY",
"firstName": "John",
"lastName": "Smith",
"personCountry": "US",
"stateCode": "FL",
"city": "Miami",
"emails": ["john.smith@example.com"],
"phoneNumbers": ["+1 305 555 0100"],
"clientRequestId": "customer-screening-1001"
}'
clientRequestId when your system has a
stable case, customer, vendor, or screening ID. It remains
optional, but it makes retries and support much cleaner.
Send the fields you know. A name-only search is accepted, but additional identity fields improve matching and reduce false positives when MAGGIE compares retrieved documents to the expected person or business.
searchTerm as the clean person, business, or
event name. Send address, contact, social, and tax fields
separately so MAGGIE can use them for matching without polluting
the primary search name.
Person · general assessment
{
"searchType": "person",
"searchTerm": "Jane Doe",
"useCase": "SEAD4",
"firstName": "Jane",
"middleName": "A",
"lastName": "Doe",
"personCountry": "US",
"stateCode": "TX",
"city": "Austin",
"zipCode": "78701",
"streetOne": "123 Main St",
"clientRequestId": "person-review-001"
}
Person · identity / fraud
{
"searchType": "person",
"searchTerm": "John Smith",
"useCase": "AML-FRAUD-IDENTITY",
"firstName": "John",
"lastName": "Smith",
"emails": ["john.smith@example.com"],
"mobile": "+1 305 555 0100",
"phoneNumbers": ["+1 305 555 0199"],
"usernames": ["johnsmith"],
"personCountry": "US",
"stateCode": "FL"
}
Social handle
{
"searchType": "person",
"searchTerm": "John Doe",
"useCase": "AML-FRAUD-IDENTITY",
"firstName": "John",
"lastName": "Doe",
"usernames": ["JohnDoe"]
}
Business · vendor risk
{
"searchType": "business",
"searchTerm": "Acme Holdings LLC",
"useCase": "SUPPLY-CHAIN",
"businessName": "Acme Holdings LLC",
"businessStreet": "123 Market St",
"businessCity": "San Francisco",
"businessState": "CA",
"businessZip": "94105",
"businessCountry": "US",
"businessEmail": "compliance@acme.example",
"businessPhone": "+1 415 555 0100",
"businessTIN": "12-3456789",
"clientRequestId": "vendor-risk-4001"
}
Event · executive protection
{
"searchType": "business",
"searchTerm": "Black Hat Conference - August 5-10, 2026",
"useCase": "EXECUTIVE-PROTECTION",
"businessName": "Black Hat Conference - August 5-10, 2026",
"businessStreet": "Mandalay Bay Convention Center",
"businessCity": "Las Vegas",
"businessState": "NV",
"businessZip": "89119",
"businessCountry": "US",
"clientRequestId": "event-risk-2026-black-hat"
}
Event requests use the business field family: venue/address
maps to businessStreet, and city/state/ZIP map
to their matching business location fields.
Idempotency
Optional · recommended
clientRequestId is optional. For production
integrations, treat it as the customer's stable reference for
the work being submitted. If a network timeout, queue retry, or
user refresh resends the same request, MAGGIE can return the
existing entity search instead of creating duplicate work.
+
same clientRequestId
=
same entitySearchId
When to send it
Use it when the caller already has a case ID, onboarding ID, transaction ID, customer ID, vendor ID, or workflow run ID.
What it does
Reusing the same value for the same organization returns the existing entity search record instead of charging and processing another duplicate request.
Where it returns
The value is echoed back so customers can reconcile MAGGIE records with their own systems without storing extra mapping tables.
customer-kyc-1001vendor-risk-4001case-2026-00042curl -X POST "__PRODUCTION_URL__/api/v2/entity-searches" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{
"searchType": "business",
"searchTerm": "Acme Holdings LLC",
"useCase": "SUPPLY-CHAIN",
"businessName": "Acme Holdings LLC",
"businessCountry": "US",
"clientRequestId": "vendor-risk-4001"
}'
Response example
The create endpoint returns immediately after MAGGIE accepts the work. Store the returned IDs and URLs. The search continues asynchronously in the pipeline.
entitySearchIdsearchBatchIdstatusUrlauditTrailUrlclientRequestId{
"success": true,
"data": {
"entitySearchId": "907df947-25d9-4719-8683-593c73617dbf",
"searchBatchId": "ff85ff3c-c07a-4681-9551-e42c733e1ff5",
"statusUrl": "/api/v2/entity-searches/907df947-25d9-4719-8683-593c73617dbf/status",
"auditTrailUrl": "/api/v2/entity-searches/907df947-25d9-4719-8683-593c73617dbf/audit-trail",
"searchType": "person",
"searchTerm": "John Smith",
"useCase": "AML-FRAUD-IDENTITY",
"flowId": "default",
"clientRequestId": "customer-screening-1001"
}
}
Poll status first, then page through documents when the search
has produced results. Read endpoints require
READ:ENTITY_SEARCH:OWN and only return records for
the API key's organization. If the key has a document-source
scope, returned documents are also filtered by
sourceProvider.
Status
/api/v2/entity-searches/:id/status
Pipeline status, provider progress, completion flag,
expected document count, reservation reconciliation, and the
original clientRequestId when supplied.
Audit trail
/api/v2/entity-searches/:id/audit-trail
Lambda-level execution timeline for operational debugging and customer support.
Documents
/api/v2/entity-searches/:id/documents?limit=50&cursor=...&q=...&minScore=0.7
Paged document list with risk scores, excerpts, identity
match counts, optional search/score filters, and
nextCursor for the next page. The
source field is the document
sourceProvider when available.
Document detail
/api/v2/entity-searches/:id/documents/:documentId
Full text, risk keywords, identity matches, AI analysis, and
raw source for a single document. If the document's
sourceProvider is outside the API key's
allowlist, MAGGIE returns 404 so disallowed
document existence is not leaked.
curl "__PRODUCTION_URL__/api/v2/entity-searches/907df947-25d9-4719-8683-593c73617dbf/status" \
-H "X-API-Key: YOUR_API_KEY"
curl "__PRODUCTION_URL__/api/v2/entity-searches/907df947-25d9-4719-8683-593c73617dbf/documents?limit=50" \
-H "X-API-Key: YOUR_API_KEY"
Error examples
Treat these as normal integration states: fix validation errors, request the right key permissions, or prompt the customer to add capacity when the organization has reached its limit. All direct entity-search endpoints use the same backend error envelope.
400 validation
{
"success": false,
"error": {
"statusCode": 400,
"message": "Request validation of body failed, because: \"searchType\" must be one of [person, business]"
}
}
401 authentication
{
"success": false,
"error": {
"statusCode": 401,
"message": "API key is not allowed from this IP address"
}
}
403 permission
{
"success": false,
"error": {
"statusCode": 403,
"message": "You do not have permission to perform this action"
}
}
404 not found
{
"success": false,
"error": {
"statusCode": 404,
"message": "Entity-search 907df947-25d9-4719-8683-593c73617dbf not found"
}
}
429 usage limit
{
"success": false,
"limitType": "documentsDiscovered",
"limit": 480,
"used": 480,
"remaining": 0,
"period": "2026-06",
"resetAt": "2026-07-01T00:00:00.000Z",
"error": {
"statusCode": 429,
"message": "Organization monthly usage limit exceeded",
"limitType": "documentsDiscovered",
"limit": 480,
"used": 480,
"remaining": 0,
"period": "2026-06",
"resetAt": "2026-07-01T00:00:00.000Z"
}
}
400 idempotency ownership
{
"success": false,
"error": {
"statusCode": 400,
"message": "clientRequestId is already in use"
}
}
Batch API
The Batch API is the operational surface. Upload a CSV of entities, capture the returned UUID, then poll the retrieval endpoint until the enriched CSV is ready. Two endpoints, one identity, explicit states.
POST /api/v2/entity-searches.
__PRODUCTION_URL__/api/v2/batch
Starts an async batch. Returns the batch identity so you can poll for the result.
X-API-KeyentityTypePERSON or BUSINESS.useCaseSEAD4 or RESTAURANT-ONBOARD).
Batch and MCP CSV workflows use
SUPPLY-CHAIN-RISK for supply chain
screening.
fileflowId
name
curl -X POST "__PRODUCTION_URL__/api/v2/batch" \
-H "X-API-Key: YOUR_API_KEY" \
-F "entityType=PERSON" \
-F "useCase=SEAD4" \
-F "file=@./people.csv;type=text/csv"
Add ?dedup=reuse when a repeat upload with the
same file content should return the existing batch instead
of starting a new run. The default is
dedup=reprocess.
{
"searchBatchId": "550e8400-e29b-41d4-a716-446655440000",
"batchId": "2d8487b8-2ef4-4b07-ae21-b78f79acb3b4",
"isReupload": false,
"documentSha1": "9c7b0c2b...",
"flowId": "default",
"entityType": "PERSON",
"useCase": "SEAD4"
}
__PRODUCTION_URL__/api/v2/batch/:id
Poll this endpoint with the UUID from upload. When processing completes it returns the enriched CSV payload.
:idPOST /api/v2/batch.200202404curl "__PRODUCTION_URL__/api/v2/batch/550e8400-e29b-41d4-a716-446655440000" \
-H "X-API-Key: YOUR_API_KEY"
The public upload surface is /api/v2/batch. The
backoffice and authenticated operators also use
/api/v2/search-batches and
/api/v2/entity-searches for progress, drill-down,
exports, and audit visibility.
Progress
GET /api/v2/search-batchesGET /api/v2/search-batches/:id
Lists and reads search-batch records with status, organization context, document counters, and ETA.
Entity drill-down
GET /api/v2/search-batches/:id/entity-searches
Lists every entity-search created by a batch for per-entity status and result inspection.
Reports
GET /api/v2/search-batches/:id/export-csv
Builds a downloadable CSV from each completed entity-search.
When the uploaded CSV includes
external_id, the export returns it as the first
column so partners can reconcile MAGGIE results to their own
rows.
Audit
GET /api/v2/entity-searches/:id/statusGET /api/v2/entity-searches/:id/audit-trail
Reads pipeline state and the batch-tracker timeline for lambda-level visibility.
MAGGIE validates uploads against the entity schema bound to
entityType. Mapping your source columns up front is
the fastest way to ship a stable integration.
external_id is optional but recommended. MAGGIE
stores it with the entity-search row and returns it in
GET /api/v2/search-batches/:id/export-csv, without
adding it to status or document responses.
PERSON
first_name,last_name,address,city,state,zip,phone1,phone2,phone3,email,dob,username1,username2,username3,external_id
Jane,Doe,123 Main St,Austin,TX,78701,5125550199,,,jane@example.com,1989-08-03,janedoe,,,person-001
BUSINESS
name,address,city,state,zip,phone1,phone2,phone3,email,external_id
Taco Palace,123 Main St,Austin,TX,78701,5125550148,,,ops@tacopalace.com,business-001
MCP
MCP is the surface for copilots, agents, and orchestrators that
already think in tools and sessions. All calls target a single
endpoint and are dispatched by JSON-RPC method. The
API key must include USE:MCP:OWN. Tool visibility
follows the same key permissions:
CREATE:BATCH:OWN enables create_batch,
and READ:BATCH:OWN enables
get_batch_result.
SUPPLY-CHAIN. Batch and
MCP CSV workflows use SUPPLY-CHAIN-RISK.
__PRODUCTION_URL__/api/v2/mcp
Open a stateful MCP session. Skip when your client is fully stateless.
X-API-KeyContent-Typeapplication/jsoncurl -X POST "__PRODUCTION_URL__/api/v2/mcp" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "initialize",
"params": {
"protocolVersion": "2024-11-05",
"clientInfo": { "name": "your-client", "version": "1.0.0" },
"capabilities": {}
}
}'
__PRODUCTION_URL__/api/v2/mcp
Inspect the current tool schemas before issuing a call.
curl -X POST "__PRODUCTION_URL__/api/v2/mcp" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{ "jsonrpc": "2.0", "id": 2, "method": "tools/list", "params": {} }'
__PRODUCTION_URL__/api/v2/mcp
Use create_batch to start a run. Retrieve later
with get_batch_result.
curl -X POST "__PRODUCTION_URL__/api/v2/mcp" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY" \
-d '{
"jsonrpc": "2.0",
"id": 3,
"method": "tools/call",
"params": {
"name": "create_batch",
"arguments": {
"entityType": "BUSINESS",
"useCase": "RESTAURANT-ONBOARD",
"csvContent": "name,address,city,state,zip\nTaco Palace,123 Main St,Austin,TX,78701"
}
}
}'
MAGGIE returns structured JSON for non-2xx responses. Most
errors carry a stable code, a human
message, and an optional
details object for field-level context.
{
"code": "validation_failed",
"message": "useCase is required",
"details": {
"field": "useCase"
}
}