### API Evaluation Update

This document outlines the API request for updating the evaluation state in Socure's RiskOS™ environment.

#### Required Fields

- **eval_id (uuid)**: The system-generated unique ID for the evaluation. Capture this value from the initial `POST /api/evaluation` response.

- **X-API-Version (string)**: Specifies the API version used for the request. If omitted, the default version is used. Socure recommends pinning a version to avoid unexpected behavioral changes when new versions are released.

- **Update DecisionUpdate Status (workflow) (string)**: Your environment-specific workflow identifier. Note: The workflow name must be unique within your RiskOS™ environment. It is not scoped by use case and must identify a single active workflow for each Evaluation API request.

#### Decision Options

- **decision (string, enum)**: Your new decision value to apply. Allowed values are:
  - `ACCEPT`
  - `REJECT`
  - `REVIEW`
  - `RESUBMIT`
  - `CANCEL`

- **tags (string)**: Comma-separated list of tags to apply to the evaluation.

- **queue (string)**: The review queue to assign the evaluation to.

- **notes (string)**: Optional notes to add context to the evaluation.

- **attachments (array of objects)**: An array of base64-encoded attachment files.

#### Attachment Object

- **file_name (string)**: Name of the attachment file.
- **file_data (string)**: Base64-encoded content of the attachment.

#### Example Request

```
curl --request PUT \
     --url https://riskos.socure.com/api/evaluation/eval_id/state \
     --header 'content-type: application/json' \
     --data '{
       "workflow": "consumer_onboarding",
       "decision": "REVIEW",
       "tags": "high_risk,email_risk",
       "queue": "Default Queue",
       "notes": "Verification documents pending re-check",
       "attachments": [
         {
           "file_name": "case.jpeg",
           "file_data": "ZmlsZWRhdGE="
         }
       ]
     }'
```

This API allows you to transition the status of an evaluation through a PUT request to the specified endpoint. No response body is returned on a successful update.