Supplier Corporate Group Concentration Analyzer

API26 — independent Apify Actor | Publisher: AFK Digital (independent software publisher; not affiliated with, endorsed by, or authorized by GLEIF).

What this Actor does

Upload your own, authorized supplier-spend CSV or JSON file. For files held in a private Apify Key-Value Store, choose the same supplierStoreId in the READ-only storage picker so this limited-permissions Actor can access that store, or use an authorized signed Apify read-only file URL. Never paste an account API token into an upload URL. The Actor resolves a supplier LEI only when provided and validated or when a unique, exact legal name is found, then verifies the currently published GLEIF Level 2 direct and ultimate accounting-consolidation relationship records. It produces source links, exceptions, an auditable review queue, and (only if spend exists) supplier-spend concentration at the evidenced parent-group level.

It does not repeat CRM data enrichment. It is not a sanctions, credit, beneficial-ownership, procurement exclusion, or supplier risk-decision tool. A missing parent link never proves independence.

Input — choose exactly one source

• Supplier file: Apify input's file upload field (UTF-8 CSV or JSON file, up to 4 MB), uploaded to your own Apify Key-Value Store.
• suppliers: JSON array of supplier objects. The input form starts with one public Apple Inc. LEI example so the default Store test produces a real supplier record. A charge is possible if GLEIF later publishes a qualifying parent link. Clear that example before using supplierFile or csvText.
• csvText: CSV content string.

Each row uses these column names (some common snake_case aliases are supported):

Field	Required	Meaning
rowId	Recommended	Client row key; duplicate keys are explicitly excluded from spend and billable links
supplierName	Unless LEI present	Name of legal supplier; exact normalized GLEIF name required
lei	Optional	ISO 17442 LEI; checksum is validated before use
spend	Optional	Nonnegative amount, dot decimal, maximum 4 fractional digits; no FX conversion
currency	With spend (defaults USD)	Three-letter currency, used as a separate concentration bucket
period	With spend (defaults unspecified)	Spend reporting period; never combined across periods
country	Optional	Two-letter country narrowing exact-name matching

Run limits: 250 input rows by default; 1–1000 configurable. Input above limit fails before any GLEIF lookup. No silent truncation. No personal names, bank details, emails, addresses, employee data, vendor contracts, or customer PII needed. Unrecognized columns are not included in output.

Downloadable output

• Dataset — one record for every uploaded row: matched supplier LEI, parent LEI, relationship scope, verified source URL, reporting exception and reason, method/confidence, spend status, duplicate/ambiguity/error marker.
• GROUPS — evidenced ultimate parent clusters and separately flagged direct-parent-only clusters, with supplier membership and eligible spend per period/currency.
• CONCENTRATION — grouped spend, known total spend including unmatched rows, unresolved spend, coverage %, top 1/top 3 share, and descriptive observed HHI. Metrics do not represent all corporate relationships.
• REVIEW_QUEUE — ambiguous / invalid / technical-failure rows. Not charged.
• SUMMARY — counts, API usage, event eligibility, executed billings and gaps.

Output data are written only to the requesting run's own Apify storage. No shared vendor database; no cross-customer file caching. Apify's own data retention and privacy settings apply. Source GLEIF public records are fetched live per run, with a per-run in-memory cache. Do not publish the input file or run storage yourself if it contains confidential spend.

GLEIF relationship meaning & exceptions

Parent = a published accounting consolidation relationship, not proof of economic ownership or voting control. The Actor checks relationship status ACTIVE, registration status PUBLISHED, exact link type and child ID, parent LEI checksum, current validity window, and GLEIF-published relationship-record URL. A successfully verified ultimate parent is preferred; otherwise a verified direct parent forms a partial, separately marked group. Different confidence scopes never silently merge. Direct/ultimate reporting-exception reasons are shown from their official GLEIF record link. Absence of a GLEIF relationship, exceptions, LEI gaps, fuzzy/ambiguous names or an API outage must not be interpreted as proof of independence.

Pricing (PPE)

Active Apify PPE event name: verified_supplier_group

Configured Apify rate: $0.015 USD per event ($1.50 per 100 distinct source-proven supplier↔group links), configured through the authenticated Apify API; as shown in the Actor pricing section on Apify Store.

The Actor emits at most one billable event per unique (supplier LEI, proven parent LEI, group basis) per run. The same supplier repeated on separate spend rows is free after the first valid group link; duplicate row IDs are explicitly free and excluded from totals. Rows without a source-valid and active accounting-consolidation parent, ambiguous names, reporting exceptions without a verified link, absent or invalid LEIs, API errors and review rows are free. Important nuance: Missing spend alone does not prevent a proven relationship from being billable; a proven group link is useful even without spend. No run-start charge, no general lookups charge, no summary charge. Configured Apify maximum-charge budgets may reduce actual charges. Events are sent through Apify's official Actor.charge once, after the corresponding dataset row is pushed; failed charge calls are not blindly retried.

GLEIF data access is free (CC0). Costs for the publisher are Apify compute/storage/network and development; for a PPE Actor the publisher normally pays underlying platform run usage. Estimate, not a rate guarantee: a new supplier may require 1 name/LEI lookup plus up to 2 parent or exception calls, with 1.25 s pacing and retry/backoff. 100 distinct suppliers may take several minutes. Public API may rate limit or fail; no guaranteed latency or response volume. Actual cost/profit must be checked in Apify Billing after test runs. Apify's documented profit model: 80% × event revenue − platform costs on eligible paid-tier runs.

Example input

{
  "suppliers": [
    {"rowId":"sup-001","supplierName":"Bloomberg Finance L.P.","lei":"5493001KJTIIGC8Y1R12","spend":"25000.00","currency":"USD","period":"2026-Q3"},
    {"rowId":"sup-002","supplierName":"Apple Inc.","lei":"HWUPKR0MPOU8FGXBT394","spend":"12500","currency":"USD","period":"2026-Q3"}
  ],
  "maxSuppliers":250,
  "includeConcentration":true
}

Bloomberg Finance L.P. is a real public-data test for the relationship-record branch; Apple Inc. is a real public-data test of GLEIF's reporting-exception branch. Exact relationship contents may change over time.

Security and limits

• File upload URLs must use https://api.apify.com/v2/key-value-stores/{id}/records/{key}; arbitrary addresses, redirects and non-Apify hosts are rejected (SSRF prevention). An Apify run token is sent only to that precise Apify host via an authorization header.
• Uploads are size-limited, UTF-8 checked, bounded row counts. The Actor never logs supplier spend, account tokens or signed URL secrets. For private file uploads, choose the same supplierStoreId with READ-only permission; all other storage remains inaccessible. Unknown input fields and extra CSV columns are discarded.
• GLEIF HTTPS only, no CAPTCHA, logins, bulk extraction or API circumvention, conservative self-throttle (≤48 requests/minute) and retries honoring 429.
• API/API Store is third-party service. Users must have authorization for any private supplier/spend files and comply with applicable privacy/commercial rules.
• GLEIF makes no warranty of completeness, timeliness or correctness; public entities not reporting a parent may still be part of a wider company group.

Sources checked October 14, 2026

• GLEIF API
• GLEIF LEI Data Terms of Use (CC0)
• GLEIF Level 2 reporting exceptions
• GLEIF Level 2 relationship records
• Apify PPE

Maintenance and tests

Run python3 -m unittest discover -s tests -v; actual public-GLEIF smoke tests: python3 tests/live_checks.py (uses public company data only). For Apify deployment, the Actor includes .actor/actor.json, input, output and dataset schemas, and a Dockerfile. For release verification see the project test reports; the current cloud build must pass sample data and billing checks.

Apify limited-permissions file access

Fileupload provides an Apify record URL, but limited-permissions Actors cannot read arbitrary other storages. For private uploaded CSV/JSON, choose the same supplierStoreId using the read-only resourcePicker input field. Alternatively use a valid Apify-signed record URL containing only the official signature parameter. The Actor validates the exact host/store identity, and never logs the signature or access token. The 2026-10-14 live cloud test used a private KVS selected via resourcePicker. No generic full-account permission requested.

Sample output (abbreviated)

A source-confirmed record includes a status, verified supplier LEI, parent-group LEI and the URL of the GLEIF relationship record. Unconfirmed or excluded records include an explicit reason and are not charged.

{
  "recordType": "supplier",
  "rowId": "sup-001",
  "supplierName": "Bloomberg Finance L.P.",
  "supplierLEI": "5493001KJTIIGC8Y1R12",
  "status": "group_verified",
  "groupLEI": "549300RMUDWPHCUQNE66",
  "groupBasis": "ultimate_parent",
  "confidence": "high",
  "evidenceUrls": [
    "https://api.gleif.org/api/v1/lei-records/5493001KJTIIGC8Y1R12/direct-parent-relationship",
    "https://api.gleif.org/api/v1/lei-records/5493001KJTIIGC8Y1R12/ultimate-parent-relationship"
  ],
  "spend": "25000.00",
  "currency": "USD",
  "period": "2026-Q3",
  "billableEvent": true
}

Billing notice: The event charge is for a unique verified supplier-to-parent relationship, even when no spend is provided. No financial concentration is calculated without valid spend. The same verified supplier-to-parent link is charged once per run, not once per spend row.

Data caveat: Public LEI relations do not cover every supplier. The Actor does not make legal, compliance, credit, sanctions or investment decisions.