--- title: "Generate SAR narrative (BSA officer / admin session required)" method: GET path: "/api/v1/sar/{screening_id}" tags: ["sar-browser"] --- # Generate SAR narrative (BSA officer / admin session required) `GET /api/v1/sar/{screening_id}` ## Request - Base URL: `https://kyt.infinihash.com` - URL: `https://kyt.infinihash.com/api/v1/sar/{screening_id}` - Auth: API key in header `X-API-Key` Generate a FinCEN-style SAR narrative for a completed screening. Auth: requires BOTH an org API key (`X-API-Key`, resolved via `get_current_org`) AND an authenticated `bsa_officer`/`admin` dashboard session (`require_bsa_officer`) — a `kyt_token`/`ih_token` cookie or an `Authorization: Bearer `. The API key alone is never sufficient: `require_bsa_officer` resolves through `get_current_user`, which only reads the session cookie/bearer JWT and does not accept `X-API-Key`. The served OpenAPI `security` block below only lists `APIKeyHeader` because FastAPI can't auto-document `require_bsa_officer` (it reads the cookie/JWT straight off the request instead of going through a `fastapi.security` dependency) — that omission previously made this look like a plain API-key-only endpoint in the published spec. A customer integration authenticating with only an API key will get a 401 from this endpoint even with a valid key. ## Path parameters - `screening_id` string, uuid, required ## Response `200` Successful Response ## Other responses - `404`: Screening not found, or not yet complete - `422`: Validation Error --- [API](https://skmtc.dev/infinihash/apis/infinihash-kyt.md) · [All operations](https://skmtc.dev/infinihash/apis/infinihash-kyt/llms.txt) · [OpenAPI document](https://skmtc.dev/infinihash/apis/infinihash-kyt/revisions/e575fa9c63fd?raw)