CBP WRO & Findings Supplier Screening Monitor

Screen and monitor supplier, country, industry and merchandise watch criteria against the current U.S. Customs and Border Protection Withhold Release Orders (WROs) and Findings.

Give it a watchlist of up to 5,000 items. It downloads one validated snapshot of the official CBP dataset, screens every item against it, and in monitor mode returns deterministic change events since your last successful run.

Independent service. Not affiliated with, endorsed by, or operated by CBP or DHS.

Use from AI agents with MCP

After deployment, connect this Actor directly at https://mcp.apify.com?tools=automa-flow/cbp-wro-findings-supplier-monitor. Ask your agent to screen a supplier watchlist, explain every match, and retain the explicit per-item status instead of treating an unavailable source as a clear result.

Why this matters

A WRO lets CBP detain covered merchandise at every U.S. port of entry. A Finding goes further: covered merchandise can be seized unless admissibility is established. CBP expects importers to exercise reasonable care over their supply chains, and identifies its current WRO/Finding list as information importers can monitor.

The dataset changes when actions are issued, modified or removed, on no fixed schedule.

What you get

One output row per watch item, always. Each row carries the matched CBP actions, the exact snapshot it was screened against, and, in monitor mode, what changed.

{
  "input_index": 0,
  "reference": "supplier-001",
  "criteria": {"entity_name": "Hoshine Silicon Industry Co. Ltd.", "country": null,
               "industry": null, "merchandise_keywords": []},
  "status": "SUCCESS",
  "match_status": "DIRECT_MATCH",
  "match_count": 1,
  "matches": [
    {
      "action_source_id": "cbp-c7f842ccb552140ea694054ede5b8c2d",
      "action_source_url": "https://www.cbp.gov/newsroom/national-media-release/...",
      "action_type": "WRO",
      "action_status": "Partially Modified",
      "effective_date": "2021-06-23",
      "country_code": "CN",
      "country": "China",
      "industry": "Industrial and Manufacturing Materials",
      "merchandise": "Silica-based products",
      "entity_name": "Hoshine Silicon Industry Co. Ltd. and Subsidiaries",
      "entity_names": ["Hoshine Silicon Industry Co. Ltd. and Subsidiaries",
                       "Hoshine Silicon Industry Co. Ltd"],
      "match_basis": "ENTITY"
    }
  ],
  "changed": false,
  "source_snapshot": {
    "source_retrieved_at": "2026-09-04T10:00:00Z",
    "source_row_count": 67,
    "source_last_modified": "Mon, 31 Aug 2026 19:05:06 GMT"
  }
}

What NO_DIRECT_MATCH does and does not mean

NO_DIRECT_MATCH means exactly one thing: the successfully validated current CBP dataset does not name your watch item.

It is not a determination that:

• the supplier is free of forced-labour risk;
• the goods are admissible into the United States;
• no country-wide or commodity-wide CBP action covers the shipment;
• the UFLPA Entity List does not apply, which is a separate list this Actor deliberately does not merge into WRO/Finding semantics;
• DOL ILAB, OFAC, BIS or any other authority does not apply.

There is no clear, safe, compliant or admissible field anywhere in the output, and there never will be. Screening WROs and Findings is one component of import due diligence. This Actor produces informational workflow data. It is not legal advice, and you remain responsible for reasonable care and for your own legal review.

Several current CBP actions name a region or a commodity rather than a company, for example

All Turkmenistan Cotton or products produced in whole or in part with Turkmenistan cotton

Match statuses

Matching is exact, never fuzzy

Names are matched after normalizing case, punctuation and whitespace, and nothing else. CBP writes several names into one subject cell, so the Actor also matches the names CBP itself publishes there: a/k/a aliases, semicolon- separated names, the company name inside a ... and Subsidiaries subject, and the individually named companies in the compound subject forms observed in the current dataset. Location qualifiers such as Kathmandu are not turned into entity names.

subject:  "Wulin (or Wuling) Machinery Works, a/k/a Hangzhou Wulin Machinery Plant, a/k/a ..."
matches:  "Wulin (or Wuling) Machinery Works"
          "Hangzhou Wulin Machinery Plant"
          "Hangzhou Wulin Machinery Works"
          "Zhejiang Province No. 4 Prison"

Hoshine Silicon does not match Hoshine Silicon Industry Co. Ltd.. Read entity_names on any matched action to see the exact spellings CBP publishes.

A source failure is never a non-match

If the CBP dataset cannot be downloaded, is truncated, arrives with a changed schema, or collapses to a suspiciously small number of actions, the run fails loudly. Every item returns status: FAILED with match_status: UNKNOWN, no item is charged, and in monitor mode the last good state is preserved, so a bad run can never manufacture a wave of "action removed" events.

Monitoring

Set mode: "monitor" and a stable monitorId. The first successful run is a silent baseline. Later runs return only real changes.

Monitor state is schema-versioned. After this release, an older stored state is ignored once and the next successful check becomes a fresh baseline; failed or ambiguous checks still never replace it. Writes also carry the source retrieval time, so a normally completing older overlapping run is refused when newer state is already present.

Schedule it

Run daily or weekly from the Apify Schedules tab, or via the API:

curl -X POST "https://api.apify.com/v2/acts/<username>~cbp-wro-findings-supplier-monitor/runs?token=$APIFY_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
        "watchItems": [
          {"entityName": "Hoshine Silicon Industry Co. Ltd.", "reference": "supplier-001"},
          {"country": "CN", "industry": "Apparel, Footwear and Textiles", "reference": "cn-apparel"}
        ],
        "mode": "monitor",
        "monitorId": "vendor-master",
        "onlyChanges": true
      }'

Get the changes only

$curl "https://api.apify.com/v2/datasets/<datasetId>/items?view=changes&clean=true&token=$APIFY_TOKEN"

Webhook

Add a webhook on Run succeeded pointing at your compliance system. Each row is already a usable alert payload: it carries a stable source_id, a fingerprint, scraped_at, the matched actions and their CBP source links.

Input

Entity matching and context screening are independent result sets. A direct entity hit is always returned even when a supplied context field disagrees; matching context actions are returned alongside it. Country, industry and merchandise criteria combine with AND. Keywords inside merchandiseKeywords combine with OR.

Pricing

Pay per event, charged once per decided watch item: a DIRECT_MATCH, a CONTEXT_MATCH, a confirmed NO_DIRECT_MATCH, or a confirmed NO_CONTEXT_MATCH. A confirmed non-match is charged because producing it requires the same validated snapshot as a match.

Never charged: invalid input, source failures, AMBIGUOUS items, retries, the dataset download itself, Dataset writes and Key-Value Store operations.

Every run uses one source download, regardless of watchlist size. Dataset, billing and monitor-state operations are emitted in bounded batches. Hosted tests at 512 MB covered fully paid baskets of 1, 10 and 100 items and the maximum 5,000-item input path. The 100-item run cost $0.003462 in platform usage; at $0.01 per check, that left a 79.7% contribution margin after Apify's 20% share.

If the run's maximum charge cannot fund every decided item, the Actor still returns one row per input: funded items keep their decision, while the remainder become free FAILED / MAX_TOTAL_CHARGE_REACHED rows and never overwrite good monitor state. Increase the run's maximum charge and retry those rows.

Source

• Dataset: https://www.cbp.gov/document/stats/withhold-release-orders-findings
• Dashboard: https://www.cbp.gov/newsroom/stats/trade/withhold-release-orders-findings-dashboard
• Data dictionary: https://www.cbp.gov/sites/default/files/2025-07/wro-finding_dashboard_data_dictionary.pdf

The CSV filename changes with each publication, so the Actor resolves the current file from the stable CBP document page on every run rather than hardcoding a URL. Public data only: no login, no CAPTCHA, no browser, no proxy, and nothing behind an access control. The dataset contains no personal data, and the Actor adds none.