---
title: "Add new transaction suspicious activities"
method: POST
path: "/v2/transaction_suspicious_activity"
tags: ["Transaction Suspicious Activities"]
---

# Add new transaction suspicious activities

`POST /v2/transaction_suspicious_activity`

## Request body

- object[] — Transaction suspicious activity data to add. sar_id is optional and can be updated later to associate the suspicious activity to the transaction suspicious activity report. Note: not all suspicious activity will be associated with a report.
  - `detection_date` string, date-time, required — Timestamp at which suspicious activity was detected on a transaction in ISO 8601 format. Use the actual detection time, not the current timestamp.
  - `is_test` boolean — Set to true if this is a test transaction suspicious activity
  - `related_alert_id` string — Unique identifier for a transaction alert for which the suspicious activity relates to.
  - `related_tx_ids` string[] — Unique identifiers for transactions for which the suspicious activity relates to.
  - `report_filed_at` string, date-time — The time the transaction suspicious activity report was filed in ISO 8601 format. Use the actual filing time, not the current timestamp.
  - `report_id` string — Unique identifier for a transaction suspicious activity report for which the suspicious activity belongs to.
  - `suspicious_activity_id` string, required — Unique identifier for a suspicious activity belonging to a transaction. This is the primary key for a transaction suspicious activity and should be unique across all transaction suspicious activities. Updates to a transaction suspicious activity should be made using this identifier.
  - `timestamp` string, date-time, required — When the suspicious activity was detected in your system, in ISO 8601 format.

## Response `201`

Transaction suspicious activity added successfully

- WriteOperationResponse
  - `message` string, required — Provides additional information about the operation result.
  - `organization_id` string, required — The organization ID for which the operation was performed.
  - `success` boolean, required — Indicates if the write operation was successful.
  - `write_count` integer, required — The number of records written to the database.

## Other responses

- `400` — Invalid transaction suspicious activity data
- `401` — Unauthorized request
- `409` — Transaction suspicious activity already exists
- `429` — Rate limit exceeded
- `500` — Server error
- `default` — General error

---

[API](https://skmtc.dev/cable/apis/cable-api.md) · [All operations](https://skmtc.dev/cable/apis/cable-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cable/cable-api/revisions/3222cd28dba5/schema)