Screen an individual or entity name against the US OFAC SDN list
Screen an individual or entity name against the US OFAC SDN list, the UN Security Council Consolidated List and the UK OFSI Consolidated List using Jaro-Winkler fuzzy matching The lists are downloaded from their publishers and refreshed every 24 hours;…
Request
- x-api-key: <your-api-key>
- Content-Type: application/json
Response
{
"dataset": {
"failedSources": [
{
"at": "<at>",
"error": "<error>",
"name": "Ada Lovelace"
}
],
"loadedAt": "<loaded at>",
"sources": [
{
"entries": 10,
"fetchedAt": "<fetched at>",
"name": "Ada Lovelace"
}
],
"totalEntries": 3
},
"matches": [
{
"country": "PL",
"countryName": "Poland",
"dob": "<dob>",
"id": "evt_723426",
"matchScore": 0.87,
"matchedName": "Ada Lovelace",
"primaryName": "Ada Lovelace",
"programs": [
"<program>"
],
"remarks": "<remarks>",
"sourceList": "castomapi",
"type": "standard"
}
],
"screeningResult": {
"highestScore": 0.87,
"matchStatus": "CLEARED",
"recommendation": "<recommendation>",
"totalMatchesFound": 2
},
"searchQuery": {
"country": "PL",
"name": "Ada Lovelace",
"normalizedName": "Ada Lovelace",
"threshold": 30,
"type": "standard"
},
"status": "success",
"tokensDeducted": 3
}What it does
Screen an individual or entity name against the US OFAC SDN list, the UN Security Council Consolidated List and the UK OFSI Consolidated List using Jaro-Winkler fuzzy matching The lists are downloaded from their publishers and refreshed every 24 hours; `dataset` in the response says exactly which lists, how many listings, and when. Not covered: the EU consolidated list (requires a registered token) and PEP lists (no free licensed source exists). Answers 503, unbilled, if no list has loaded yet.
Request
Body
| Field | Type | Required | Description |
|---|---|---|---|
country | string | no | Optional ISO 3166-1 Alpha-2 country code to refine match score (e.g. "RU", "DE", "US"). Only applied to listings that carry a nationality or address country. |
dob | string | no | Optional Date of Birth (YYYY-MM-DD or YYYY) to refine match score |
name | string | yes | Individual or company name to screen |
threshold | integer | no | Minimum match percentage threshold to report (50-100) |
type | enum | no | Filter screening by subject entity type (vessels and aircraft are ENTITY) One of: ALL, INDIVIDUAL, ENTITY. |
Example request
{
"country": "PL",
"dob": "<dob>",
"name": "Ada Lovelace",
"threshold": 75,
"type": "ALL"
}Response
| Field | Type | Description |
|---|---|---|
dataset | object | Which lists this verdict was measured against. A CLEARED with a non-empty failedSources is a partial screen. |
↳ failedSources | array<object> | |
↳ loadedAt | string | |
↳ sources | array<object> | |
↳ totalEntries | integer | |
matches | array<object> | |
↳ country | string | |
↳ countryName | string | |
↳ dob | string | |
↳ id | string | |
↳ matchScore | number | |
↳ matchedName | string | |
↳ primaryName | string | |
↳ programs | array<string> | |
↳ remarks | string | |
↳ sourceList | string | |
↳ type | string | |
screeningResult | object | |
↳ highestScore | number | |
↳ matchStatus | enum | One of: CLEARED, POSSIBLE_MATCH, CONFIRMED_MATCH. |
↳ recommendation | string | |
↳ totalMatchesFound | integer | |
searchQuery | object | |
↳ country | string | |
↳ name | string | |
↳ normalizedName | string | |
↳ threshold | integer | |
↳ type | string | |
status | string | |
tokensDeducted | integer |
Example response
{
"dataset": {
"failedSources": [
{
"at": "<at>",
"error": "<error>",
"name": "Ada Lovelace"
}
],
"loadedAt": "<loaded at>",
"sources": [
{
"entries": 10,
"fetchedAt": "<fetched at>",
"name": "Ada Lovelace"
}
],
"totalEntries": 3
},
"matches": [
{
"country": "PL",
"countryName": "Poland",
"dob": "<dob>",
"id": "evt_723426",
"matchScore": 0.87,
"matchedName": "Ada Lovelace",
"primaryName": "Ada Lovelace",
"programs": [
"<program>"
],
"remarks": "<remarks>",
"sourceList": "castomapi",
"type": "standard"
}
],
"screeningResult": {
"highestScore": 0.87,
"matchStatus": "CLEARED",
"recommendation": "<recommendation>",
"totalMatchesFound": 2
},
"searchQuery": {
"country": "PL",
"name": "Ada Lovelace",
"normalizedName": "Ada Lovelace",
"threshold": 30,
"type": "standard"
},
"status": "success",
"tokensDeducted": 3
}Errors
Every error answers with the same envelope: an HTTP status, a machine code and a sentence.
400 | The body or a parameter failed validation. The details array names the field. |
401 | No key, a revoked key or a wrong header. Send x-api-key. |
402 | The wallet cannot cover this call. Top up or wait for the monthly grant. |
404 | The resource does not exist, or it is not yours. Both answer identically and cost nothing. |
429 | Over the per-minute quota of your tier. Back off and retry. |
5xx | Upstream refused or timed out. The call is not billed. |
Code
curl -X POST 'https://app.castomapi.com/v1/verify/sanctions' \
-H 'x-api-key: <your-api-key>' \
-H 'Content-Type: application/json' \
-d '{"country": "PL", "dob": "<dob>", "name": "Ada Lovelace", "threshold": 75, "type": "ALL"}'const res = await fetch('https://app.castomapi.com/v1/verify/sanctions', {
method: 'POST',
headers: { 'x-api-key': '<your-api-key>', 'Content-Type': 'application/json' },
body: JSON.stringify({"country": "PL", "dob": "<dob>", "name": "Ada Lovelace", "threshold": 75, "type": "ALL"})
});
const data = await res.json();
console.log(data);import { request } from 'node:https';
// Node 18+ has fetch built in
const res = await fetch('https://app.castomapi.com/v1/verify/sanctions', {
method: 'POST',
headers: { 'x-api-key': '<your-api-key>', 'Content-Type': 'application/json' },
body: JSON.stringify({"country": "PL", "dob": "<dob>", "name": "Ada Lovelace", "threshold": 75, "type": "ALL"})
});
const data = await res.json();
console.log(data);import requests
res = requests.post(
'https://app.castomapi.com/v1/verify/sanctions',
headers={'x-api-key': '<your-api-key>'},
json={"country": "PL", "dob": "<dob>", "name": "Ada Lovelace", "threshold": 75, "type": "ALL"},
timeout=30,
)
print(res.json())<?php
$ch = curl_init('https://app.castomapi.com/v1/verify/sanctions');
curl_setopt_array($ch, [
CURLOPT_CUSTOMREQUEST => 'POST',
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => ['x-api-key: <your-api-key>', 'Content-Type: application/json'],
CURLOPT_POSTFIELDS => json_encode(['country' => 'PL', 'dob' => '<dob>', 'name' => 'Ada Lovelace', 'threshold' => 75, 'type' => 'ALL']),
]);
$data = json_decode(curl_exec($ch), true);
print_r($data);Cost and limits
This operation costs 3 tokens. A call that fails is never billed. Every account gets 1000 free tokens a month; paid balances never expire.
Rate limits per minute
| No key | 10 |
| Free | 60 |
| Pro | 300 |
| Enterprise | 1200 |
Questions
What does Screen an individual or entity name against the US OFAC SDN list cost?
3 tokens per successful call, debited from your wallet after the response. Failed calls are free. Every account receives 1000 free tokens a month.
How do I authenticate?
Send your key in the x-api-key header. One key covers every metered endpoint; there is nothing to enable per endpoint.
Can I send an Authorization: Bearer token instead?
Not for a metered endpoint — those take the x-api-key header and nothing else. Bearer tokens belong to the account side: the dashboard and account APIs accept a JWT session, and castomapi-auth issues those through a standard OAuth2 handshake, with authorization code, client credentials and refresh grants. The auth service page covers it.
What are the limits?
10 requests a minute per IP with no key at all, 60 a minute on the free tier, 300 on Pro, 1200 on Enterprise. Above the no-key tier the quota is per account, across every endpoint.
OpenAPI: https://app.castomapi.com/docs/json