Investigate unusual finance transactions and build audit reports via webhooks and HTTP APIs

Quick overview This workflow receives an unusual transaction alert via webhook, builds a risk-scored investigation context, calls external HTTP endpoints to fetch related account history, run AI anomaly analysis, and enrich evidence sources, then compiles an audit-ready investigation package and returns it in the webhook response.

How it works Receives an unusual transaction investigation request via a POST webhook. Validates required fields (transaction, account, amount) and builds an investigation context with a basic risk score and severity. Calls an external HTTP endpoint to fetch related transaction history and prior flags for the account. Sends the investigation context to an external AI analysis HTTP endpoint to generate anomaly findings and recommended actions. Calls an external enrichment HTTP endpoint to gather additional evidence signals such as merchant context and device/IP risk. Posts a summary payload to an external audit/compliance HTTP endpoint to create or store an audit evidence package. Aggregates statuses and findings into a final audit-ready report and returns it to the webhook caller with an investigation ID header.

Setup Configure the source system to send a POST request to this workflow’s webhook URL at the /unusual-transaction path. Replace the placeholder httpbin.org URLs with your real endpoints for transaction history, AI analysis, evidence enrichment, and audit/compliance storage. If your endpoints require authentication, add the necessary HTTP headers or credentials to the HTTP Request steps. Ensure the webhook payload includes transactionId, accountId, amount (and optionally currency, merchant, timestamp, flags, ipAddress, and deviceId) in the expected fields.