# Submit a message to a case

See the [Case submission type](/guides/product/partner/submission-types.md) guide for details on each submission type along with an example.

Endpoint: POST /cases/{caseId}/messages
Version: 2027Q1
Security: ClientCredentialsToken

## Security:

  - `ClientCredentialsToken` (unknown)
    http bearer JWT

## Path parameters:

  - `caseId` (integer, required)
    The unique identifier of the case.

## Header parameters:

  - `X-External-Correlation-Id` (string)
    Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. [Learn more](/guides/developer/headers/correlation-id).

## Request fields (application/json):

  - `type` (string, required)
    The type of message submission.
    Enum: "FREEFORM", "DEPOSIT_SANCTION_HIT_SUBMISSION", "REFERENCE_SANCTION_HIT_SUBMISSION", "RECIPIENT_SANCTION_HIT_SUBMISSION", "REFERENCE_LOCATION_HIT_SUBMISSION", "RECIPIENT_LOCATION_HIT_SUBMISSION", "FILE_SUBMISSION"

  - `submissionData` (object, required)
    The data for the message submission. Structure varies based on submission type.

  - `submissionData.freeText` (string, required)
    The free-form text message to submit.
Can include additional context, questions, or documentation references.
    Example: The transfer has been verified and approved by our compliance team.

  - `submissionData.individual` (object, required)

  - `submissionData.individual.name` (string, required)
    Full name of the individual.
    Example: John Doe

  - `submissionData.individual.countryOfResidenceIso3` (string)
    ISO 3166-1 alpha-3 country code for country of residence.
REQUIRED for RECIPIENT and REFERENCE sanction hit submissions.
    Example: GBR

  - `submissionData.individual.dob` (string)
    Date of birth.
Accepted formats: DD/MM/YYYY or YYYY-MM-DD
    Example: 15/03/1985

  - `submissionData.individual.nationality` (string)
    Nationality of the individual.
    Example: British

  - `submissionData.organisation` (object, required)

  - `submissionData.organisation.name` (string, required)
    Name of the organisation.
    Example: Acme Corporation Ltd

  - `submissionData.organisation.streetAddress` (string, required)
    Street address of the organisation.
    Example: 123 Business Park

  - `submissionData.organisation.city` (string, required)
    City where the organisation is located.
    Example: London

  - `submissionData.organisation.postCode` (string, required)
    Postal code of the organisation's address.
    Example: EC1A 1BB

  - `submissionData.organisation.countryIso3` (string, required)
    ISO 3166-1 alpha-3 country code.
    Example: GBR

  - `submissionData.organisation.natureOfBusiness` (string)
    Description of the organisation's business activities.
    Example: Financial Services

  - `submissionData.organisation.website` (string)
    Organisation's website URL.
    Example: https://www.acme-corp.com

  - `submissionData.vessel` (object, required)

  - `submissionData.vessel.vesselImoNumber` (string, required)
    International Maritime Organization (IMO) number of the vessel.
IMO numbers are 7 digits, sometimes prefixed with "IMO".
    Example: 9074729

  - `submissionData.multiple` (object, required)

  - `submissionData.multiple.explanation` (string, required)
    Explanation describing the multiple entities involved.
Should include details about all parties and their relationship.
    Example: Transfer involves multiple beneficiaries as part of a group payment arrangement.

  - `submissionData.other` (object, required)

  - `submissionData.other.explanation` (string, required)
    Free-form explanation for the entity.
Describe the entity type and relevant details.
    Example: This is a government entity that does not fit standard categories.

  - `submissionData.profileId` (integer, required)
    The profile ID that the files belong to.
Must match the profile associated with the uploaded files.
    Example: 14556049

  - `submissionData.fileIds` (array, required)
    List of file IDs to attach to the case.
Files must have been previously uploaded via the file upload endpoint.
    Example: ["a1b2c3d4-e5f6-7890-abcd-ef1234567890","b2c3d4e5-f6a7-8901-bcde-f12345678901"]

## Request examples:

  - `FREEFORM` (unknown)
    Free text message submission

  - `FILE_SUBMISSION` (unknown)
    File submission - attach previously uploaded files to a case.
Files must be uploaded via the file upload endpoint before submitting.

  - `DEPOSIT_SANCTION_HIT_SUBMISSION (individual)` (unknown)
    Submit individual depositor information for a deposit sanction hit case.

  - `DEPOSIT_SANCTION_HIT_SUBMISSION (organisation)` (unknown)
    Submit organisation depositor information for a deposit sanction hit case.

  - `RECIPIENT_SANCTION_HIT_SUBMISSION (individual)` (unknown)
    Submit individual recipient information for a recipient sanction hit case.

  - `RECIPIENT_SANCTION_HIT_SUBMISSION (organisation)` (unknown)
    Submit organisation recipient information for a recipient sanction hit case.

  - `REFERENCE_SANCTION_HIT_SUBMISSION (individual)` (unknown)
    Submit individual information for a reference sanction hit case.

  - `REFERENCE_SANCTION_HIT_SUBMISSION (organisation)` (unknown)
    Submit organisation information for a reference sanction hit case.

  - `REFERENCE_SANCTION_HIT_SUBMISSION (vessel)` (unknown)
    Submit vessel information for a reference sanction hit case.

  - `REFERENCE_SANCTION_HIT_SUBMISSION (multiple)` (unknown)
    Submit information when multiple entities are involved in a reference sanction hit case.

  - `REFERENCE_SANCTION_HIT_SUBMISSION (other)` (unknown)
    Submit information for entity types not covered by standard categories.

  - `REFERENCE_LOCATION_HIT_SUBMISSION` (unknown)
    Submit location-related information for a reference location hit case.

  - `RECIPIENT_LOCATION_HIT_SUBMISSION` (unknown)
    Submit location-related information for a recipient location hit case.

## Response 201:

  - `201` (unknown)
    Message submitted successfully

## Response 201 fields (application/json):

  - `id` (string, required)
    Unique identifier of the created message (UUID v4).
    Example: 660e8400-e29b-41d4-a716-446655440001

  - `caseId` (integer, required)
    The ID of the case this message belongs to.
    Example: 12345678

  - `createdAt` (string, required)
    Timestamp when the message was created.
Format: ISO 8601 datetime without timezone (server timezone is UTC).
    Example: 2026-07-27T15:00:00.000

  - `content` (object, required)
    The content of the created message.
- For FREEFORM: contains `text.freeText`
- For SUBMISSION types: contains `submissionData`
- For FILE_SUBMISSION: contains `submissionData` with `profileId` and `fileIds`

  - `type` (string, required)
    The type of the created message.
    Enum: "FREEFORM", "DEPOSIT_SANCTION_HIT_SUBMISSION", "REFERENCE_SANCTION_HIT_SUBMISSION", "RECIPIENT_SANCTION_HIT_SUBMISSION", "REFERENCE_LOCATION_HIT_SUBMISSION", "RECIPIENT_LOCATION_HIT_SUBMISSION", "FILE_SUBMISSION"

  - `author` (string, required)
    The author of the message (always PARTNER for submitted messages).
    Enum: "PARTNER"

## Response 201 headers (application/json):

  - `X-External-Correlation-Id` (string)
    Echoed back when `X-External-Correlation-Id` was included in the request. [Learn more](/guides/developer/headers/correlation-id).
    Example: f47ac10b-58cc-4372-a567-0e02b2c3d479

  - `x-trace-id` (string)
    Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.
    Example: fba501b6d453b96789f52338f019341f

## Response 400:

  - `400` (unknown)
    Bad request - validation failed or business rule violation

## Response 400 fields (application/json):

  - `type` (string, required)
    URI reference identifying the error category.
Values:
- `/errors/types/validation` - Request validation failed
- `/errors/types/domain` - Business rule violation
- `/errors/types/access` - Authentication or authorization failure
- `/errors/types/internal` - Unexpected server error
    Example: /errors/types/validation

  - `title` (string, required)
    Short human-readable summary of the error category.
    Example: Validation Error

  - `status` (integer, required)
    HTTP status code.
    Example: 400

  - `detail` (string)
    Human-readable explanation of this specific error occurrence.
    Example: Cannot submit message for case in final state: RESOLVED

  - `instance` (string)
    The request path that caused the error.
    Example: /public/v2/cases/12345678

  - `code` (string)
    Machine-readable error code. Present on domain and access errors.
Common codes:
- `operation_not_supported` - Business rule prevents this action
- `resource_not_found` - Requested resource does not exist
- `forbidden` - Insufficient permissions
- `rate_limit_exceeded` - Too many requests
    Example: operation_not_supported

  - `errors` (array)
    List of field-level validation errors.
Only present for validation errors (type `/errors/types/validation`).

  - `errors.code` (string, required)
    Machine-readable validation error code.
Values:
- `parameter_missing` - A required field is null, empty, or blank
- `parameter_invalid` - A field value is present but not acceptable
- `invalid_value` - A field value fails a business validation rule
- `invalid_request` - The request structure is malformed or invalid
    Example: parameter_missing

  - `errors.ref` (string, required)
    The field that caused the validation error.
For nested fields, only the leaf property name is used (e.g., `name` not `submissionData.individual.name`).
    Example: type

  - `errors.detail` (string | null)
    Human-readable description of the validation error. May be null.
    Example: profileId is required

## Response 400 headers (application/json):

  - `X-External-Correlation-Id` (string)
    Echoed back when `X-External-Correlation-Id` was included in the request. [Learn more](/guides/developer/headers/correlation-id).
    Example: f47ac10b-58cc-4372-a567-0e02b2c3d479

  - `x-trace-id` (string)
    Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.
    Example: fba501b6d453b96789f52338f019341f

## Response 401:

  - `401` (unknown)
    Unauthorized - missing or invalid authentication

## Response 401 fields (application/json):

  - `type` (string, required)
    URI reference identifying the error category.
Values:
- `/errors/types/validation` - Request validation failed
- `/errors/types/domain` - Business rule violation
- `/errors/types/access` - Authentication or authorization failure
- `/errors/types/internal` - Unexpected server error
    Example: /errors/types/validation

  - `title` (string, required)
    Short human-readable summary of the error category.
    Example: Validation Error

  - `status` (integer, required)
    HTTP status code.
    Example: 400

  - `detail` (string)
    Human-readable explanation of this specific error occurrence.
    Example: Cannot submit message for case in final state: RESOLVED

  - `instance` (string)
    The request path that caused the error.
    Example: /public/v2/cases/12345678

  - `code` (string)
    Machine-readable error code. Present on domain and access errors.
Common codes:
- `operation_not_supported` - Business rule prevents this action
- `resource_not_found` - Requested resource does not exist
- `forbidden` - Insufficient permissions
- `rate_limit_exceeded` - Too many requests
    Example: operation_not_supported

  - `errors` (array)
    List of field-level validation errors.
Only present for validation errors (type `/errors/types/validation`).

  - `errors.code` (string, required)
    Machine-readable validation error code.
Values:
- `parameter_missing` - A required field is null, empty, or blank
- `parameter_invalid` - A field value is present but not acceptable
- `invalid_value` - A field value fails a business validation rule
- `invalid_request` - The request structure is malformed or invalid
    Example: parameter_missing

  - `errors.ref` (string, required)
    The field that caused the validation error.
For nested fields, only the leaf property name is used (e.g., `name` not `submissionData.individual.name`).
    Example: type

  - `errors.detail` (string | null)
    Human-readable description of the validation error. May be null.
    Example: profileId is required

## Response 401 headers (application/json):

  - `X-External-Correlation-Id` (string)
    Echoed back when `X-External-Correlation-Id` was included in the request. [Learn more](/guides/developer/headers/correlation-id).
    Example: f47ac10b-58cc-4372-a567-0e02b2c3d479

  - `x-trace-id` (string)
    Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.
    Example: fba501b6d453b96789f52338f019341f

## Response 403:

  - `403` (unknown)
    Forbidden - insufficient permissions

## Response 403 fields (application/json):

  - `type` (string, required)
    URI reference identifying the error category.
Values:
- `/errors/types/validation` - Request validation failed
- `/errors/types/domain` - Business rule violation
- `/errors/types/access` - Authentication or authorization failure
- `/errors/types/internal` - Unexpected server error
    Example: /errors/types/validation

  - `title` (string, required)
    Short human-readable summary of the error category.
    Example: Validation Error

  - `status` (integer, required)
    HTTP status code.
    Example: 400

  - `detail` (string)
    Human-readable explanation of this specific error occurrence.
    Example: Cannot submit message for case in final state: RESOLVED

  - `instance` (string)
    The request path that caused the error.
    Example: /public/v2/cases/12345678

  - `code` (string)
    Machine-readable error code. Present on domain and access errors.
Common codes:
- `operation_not_supported` - Business rule prevents this action
- `resource_not_found` - Requested resource does not exist
- `forbidden` - Insufficient permissions
- `rate_limit_exceeded` - Too many requests
    Example: operation_not_supported

  - `errors` (array)
    List of field-level validation errors.
Only present for validation errors (type `/errors/types/validation`).

  - `errors.code` (string, required)
    Machine-readable validation error code.
Values:
- `parameter_missing` - A required field is null, empty, or blank
- `parameter_invalid` - A field value is present but not acceptable
- `invalid_value` - A field value fails a business validation rule
- `invalid_request` - The request structure is malformed or invalid
    Example: parameter_missing

  - `errors.ref` (string, required)
    The field that caused the validation error.
For nested fields, only the leaf property name is used (e.g., `name` not `submissionData.individual.name`).
    Example: type

  - `errors.detail` (string | null)
    Human-readable description of the validation error. May be null.
    Example: profileId is required

## Response 403 headers (application/json):

  - `X-External-Correlation-Id` (string)
    Echoed back when `X-External-Correlation-Id` was included in the request. [Learn more](/guides/developer/headers/correlation-id).
    Example: f47ac10b-58cc-4372-a567-0e02b2c3d479

  - `x-trace-id` (string)
    Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.
    Example: fba501b6d453b96789f52338f019341f

## Response 404:

  - `404` (unknown)
    Not found - case does not exist

## Response 404 fields (application/json):

  - `type` (string, required)
    URI reference identifying the error category.
Values:
- `/errors/types/validation` - Request validation failed
- `/errors/types/domain` - Business rule violation
- `/errors/types/access` - Authentication or authorization failure
- `/errors/types/internal` - Unexpected server error
    Example: /errors/types/validation

  - `title` (string, required)
    Short human-readable summary of the error category.
    Example: Validation Error

  - `status` (integer, required)
    HTTP status code.
    Example: 400

  - `detail` (string)
    Human-readable explanation of this specific error occurrence.
    Example: Cannot submit message for case in final state: RESOLVED

  - `instance` (string)
    The request path that caused the error.
    Example: /public/v2/cases/12345678

  - `code` (string)
    Machine-readable error code. Present on domain and access errors.
Common codes:
- `operation_not_supported` - Business rule prevents this action
- `resource_not_found` - Requested resource does not exist
- `forbidden` - Insufficient permissions
- `rate_limit_exceeded` - Too many requests
    Example: operation_not_supported

  - `errors` (array)
    List of field-level validation errors.
Only present for validation errors (type `/errors/types/validation`).

  - `errors.code` (string, required)
    Machine-readable validation error code.
Values:
- `parameter_missing` - A required field is null, empty, or blank
- `parameter_invalid` - A field value is present but not acceptable
- `invalid_value` - A field value fails a business validation rule
- `invalid_request` - The request structure is malformed or invalid
    Example: parameter_missing

  - `errors.ref` (string, required)
    The field that caused the validation error.
For nested fields, only the leaf property name is used (e.g., `name` not `submissionData.individual.name`).
    Example: type

  - `errors.detail` (string | null)
    Human-readable description of the validation error. May be null.
    Example: profileId is required

## Response 404 headers (application/json):

  - `X-External-Correlation-Id` (string)
    Echoed back when `X-External-Correlation-Id` was included in the request. [Learn more](/guides/developer/headers/correlation-id).
    Example: f47ac10b-58cc-4372-a567-0e02b2c3d479

  - `x-trace-id` (string)
    Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.
    Example: fba501b6d453b96789f52338f019341f

## Response 409:

  - `409` (unknown)
    Conflict - operation not supported for the current case state

## Response 409 fields (application/json):

  - `type` (string, required)
    URI reference identifying the error category.
Values:
- `/errors/types/validation` - Request validation failed
- `/errors/types/domain` - Business rule violation
- `/errors/types/access` - Authentication or authorization failure
- `/errors/types/internal` - Unexpected server error
    Example: /errors/types/validation

  - `title` (string, required)
    Short human-readable summary of the error category.
    Example: Validation Error

  - `status` (integer, required)
    HTTP status code.
    Example: 400

  - `detail` (string)
    Human-readable explanation of this specific error occurrence.
    Example: Cannot submit message for case in final state: RESOLVED

  - `instance` (string)
    The request path that caused the error.
    Example: /public/v2/cases/12345678

  - `code` (string)
    Machine-readable error code. Present on domain and access errors.
Common codes:
- `operation_not_supported` - Business rule prevents this action
- `resource_not_found` - Requested resource does not exist
- `forbidden` - Insufficient permissions
- `rate_limit_exceeded` - Too many requests
    Example: operation_not_supported

  - `errors` (array)
    List of field-level validation errors.
Only present for validation errors (type `/errors/types/validation`).

  - `errors.code` (string, required)
    Machine-readable validation error code.
Values:
- `parameter_missing` - A required field is null, empty, or blank
- `parameter_invalid` - A field value is present but not acceptable
- `invalid_value` - A field value fails a business validation rule
- `invalid_request` - The request structure is malformed or invalid
    Example: parameter_missing

  - `errors.ref` (string, required)
    The field that caused the validation error.
For nested fields, only the leaf property name is used (e.g., `name` not `submissionData.individual.name`).
    Example: type

  - `errors.detail` (string | null)
    Human-readable description of the validation error. May be null.
    Example: profileId is required

## Response 409 headers (application/json):

  - `X-External-Correlation-Id` (string)
    Echoed back when `X-External-Correlation-Id` was included in the request. [Learn more](/guides/developer/headers/correlation-id).
    Example: f47ac10b-58cc-4372-a567-0e02b2c3d479

  - `x-trace-id` (string)
    Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.
    Example: fba501b6d453b96789f52338f019341f

## Response 429:

  - `429` (unknown)
    Rate limit exceeded. Retry after the number of seconds specified in the `Retry-After` header.

## Response 429 headers (application/json):

  - `Retry-After` (integer)
    Number of seconds to wait before retrying the request.
    Example: 5

  - `X-Rate-Limited-By` (string)
    Identifies the rate limiter that triggered the 429 response.
    Example: wise-public-api

  - `X-External-Correlation-Id` (string)
    Echoed back when `X-External-Correlation-Id` was included in the request. [Learn more](/guides/developer/headers/correlation-id).
    Example: f47ac10b-58cc-4372-a567-0e02b2c3d479

  - `x-trace-id` (string)
    Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.
    Example: fba501b6d453b96789f52338f019341f

## Response 201 examples:

  - `FREEFORM message created` (unknown)

  - `Sanction hit submission created` (unknown)

  - `FILE_SUBMISSION message created` (unknown)

## Response 400 examples:

  - `Missing type` (unknown)

  - `Invalid type value` (unknown)

  - `Missing submissionData` (unknown)

  - `Malformed submissionData structure` (unknown)

  - `Missing freeText for FREEFORM submission` (unknown)

  - `Missing profileId for FILE_SUBMISSION` (unknown)

  - `Empty fileIds for FILE_SUBMISSION` (unknown)

  - `Duplicate file IDs in FILE_SUBMISSION` (unknown)

  - `One or more file IDs not found` (unknown)

  - `Files do not belong to the specified profile` (unknown)

  - `Invalid sanction hit submission structure` (unknown)

  - `Missing countryOfResidenceIso3 for recipient/reference individual` (unknown)

## Response 409 examples:

  - `Case is in a final state (RESOLVED or FAILED)` (unknown)

  - `Wise Agent not assigned (FREEFORM or FILE_SUBMISSION)` (unknown)

  - `Case not generated by Wise (structured submission types)` (unknown)