Company & Supplier Check — LEI, Recalls, Food Alerts, SSL

Returns one record per company with its LEI status, U.S. FDA recalls, UK FSA food alerts and domain SSL/DNS health in one call; failed and unchanged rows are never charged.

Give it companies by LEI, by domain or by their exact legal name; get one flat row per company with:

• its GLEIF identity: legal name, country, entity and registration status, next renewal and parents;
• the U.S. FDA food, drug and device recalls and the UK FSA food alerts that name it in the last 12 months;
• its domain's SSL certificate, SPF, DMARC and mail servers;
• plain-words risk flags, and each source's status.

Built for supplier and counterparty checks, KYB screening lists, spreadsheets and AI agents. Not affiliated with or endorsed by GLEIF, the U.S. FDA or the UK FSA.

What it does

• One call, one flat record per company, from four sources read in the same run (no other actor is called):
  • GLEIF, the global LEI system: the company's identity, LEI status, renewal date and parents;
  • openFDA enforcement reports: U.S. FDA food, drug and device recalls;
  • the UK Food Standards Agency's food alerts;
  • the company's own domain: DNS records and one TLS handshake (no web page is fetched).
• Honest matching, never fuzzy:
  • an LEI matches exactly;
  • a typed legal name matches only when exactly one GLEIF record has that legal name. Case, accents, punctuation and how the legal form is written ("Inc." or "Incorporated", "AG" or "Aktiengesellschaft") don't matter; a missing legal form does;
  • none or several matches give a free no_data row with up to 3 candidate LEIs, so you (or your agent) can call again with one LEI. For example, "Deutsche Bank AG" gives two candidates: two GLEIF records, one in Germany and one in France, have that legal name (add "country": "DE" in an object entry to pick one);
  • recalls and alerts count only when the source names the company exactly as GLEIF does (its legal name or one of its other names), or exactly as a name you give with its LEI;
  • every hit says which name it matched on (matchedOn).
• Risk flags in plain words, for example "LEI lapsed", "LEI renewal due in 20 days", "Class I recall in the last 90 days", "UK food alert in the last 90 days", "SSL expires in 12 days", "no DMARC record".
• Supplier watch: give a watch list name (watchListName) and run it daily or weekly:
  • the first run returns every company (baseline);
  • later runs return only the companies with something new or changed: a new recall or alert, an LEI status or renewal change, a new certificate issuer, a new domain problem;
  • a passing day is never a change, and neither is a source that could not be read;
  • a run with nothing new returns exactly one free no_data row that says so.
• People are never returned:
  • a sole proprietor, or a record that names a person, is left out with a free no_data row that never names them;
  • a typed name that looks like a person's is refused;
  • a recall firm or alert business that may be a person is never matched, and is left out of every text.
• You are never charged for failed results: failed, no_data and unchanged rows are free; one charge per identified company, whatever the number of sources.

Quick start

{ "companies": ["5493003NRW7LS2QZRH60", "db.com", "Deutsche WertpapierService Bank AG"] }

A supplier watch list, with domains:

{
  "companies": [
    { "lei": "5493003NRW7LS2QZRH60", "domain": "icumed.com" },
    { "lei": "7LTWFZYICNSX8D621K86", "domain": "db.com" }
  ],
  "watchListName": "suppliers"
}

Input

Field	What it does
companies	Main input. One entry per company: an LEI (20 characters), a domain (icumed.com) or the exact legal name with its legal form (ICU Medical, Inc.). Or an object with lei, name, domain and country (a two-letter code that narrows a name search). A name given with an lei also matches recalls and alerts that use that name (for example a trading name such as "Waitrose"). Never a URL.
checks	Which sources to check; default lei,recalls,foodAlerts,domain. lei: LEI status, renewal, parents and LEI risk flags; recalls: U.S. FDA recalls; foodAlerts: UK FSA food alerts; domain: DNS, SPF, DMARC and SSL. An LEI or a name is always looked up at GLEIF, because it identifies the company.
openFdaApiKey	Optional: your own free openFDA key, for many companies or frequent runs. Without a key openFDA allows 1,000 requests a day per IP address, shared with other users. Sent only in the request header; never logged, stored or returned.
mode	Empty: watch when a watch list name is given, otherwise export. An explicit watch or export wins.
watchListName	Your watch list (kept in your own storage between runs). A name turns on watch mode; watch mode without a name uses the list "default".
maxItems	Most charged companies per run; default 1000. In watch mode the rest come in the next run.

Field names from other tools: leis, names, domains (→ companies); apiKey (→ openFdaApiKey); stateName (→ watchListName).

Output

One row per company. An ok row from the quick start (lists shortened):

{
  "status": "ok",
  "input": "5493003NRW7LS2QZRH60",
  "matchType": "lei",
  "lei": "5493003NRW7LS2QZRH60",
  "legalName": "ICU MEDICAL, INC.",
  "country": "US",
  "entityStatus": "ACTIVE",
  "registrationStatus": "ISSUED",
  "nextRenewalDate": "2027-01-19",
  "recallCount12m": 64,
  "recallLatestDate": "2026-09-23",
  "recallLatestNumber": "Z-3212-2026",
  "recallLatestClass": "Class II",
  "recalls": [{ "recallNumber": "Z-3212-2026", "productType": "device", "reportDate": "2026-09-23", "classification": "Class II", "recallStatus": "Ongoing", "product": "CADD Yellow Medication Cassette Reservoir …", "matchedOn": "legal name (ICU MEDICAL, INC.)" }],
  "foodAlertCount12m": 0,
  "riskFlags": [],
  "sourceStatus": { "lei": "ok", "recalls": "ok", "foodAlerts": "no_data", "domain": "skipped" },
  "url": "https://search.gleif.org/#/record/5493003NRW7LS2QZRH60"
}

A name with no single exact match:

{ "status": "no_data", "input": "ICU Medical", "error": "No LEI record has exactly this legal name; call again with one of the candidate LEIs", "candidates": ["254900891YA8DKEHTV75 ICU Medical B.V. (NL)", "5493003NRW7LS2QZRH60 ICU MEDICAL, INC. (US)", "254900DVR7A372V5E361 ICU MEDICAL INDIA LLP (IN)"] }

Output fields

Field	Type	Description
status	string (or null)	ok = the company was identified (an LEI record, or the domain's data when only a domain was given): charged once in export mode, and in watch mode when it is new or something changed; no_data = not found, no single exact legal-name match (see candidates), left out because the record is or names a person, or nothing new since the last run (free); failed = invalid entry or no source could be read (free)
attempts	integer (or null)	Requests made for the identifying lookup (retries included)
error	string (or null)	Why a row is no_data or failed; null on ok rows
input	string (or null)	The entry that produced this row: an LEI, a domain, a legal name, or an object's fields
mode	string (or null)	watch or export
watchList	string (or null)	Watch list name (watch mode); null in export mode
dropReason	string (or null)	person when the record was left out because it is, may be, or names a person (no personal data is returned); null otherwise
matchType	string (or null)	How the company was identified: lei (its LEI), legal name (one exact legal-name match at GLEIF) or domain (only a domain was given)
candidates	array (or null)	When a legal name matched no record, or several: up to 3 candidate LEIs with their legal name and country, so you can call again with one LEI
lei	string (or null)	The company's Legal Entity Identifier (ISO 17442)
legalName	string (or null)	The company's legal name at GLEIF
country	string (or null)	Country of the legal address (ISO 3166 two-letter code)
entityStatus	string (or null)	GLEIF entity status (ACTIVE or INACTIVE)
registrationStatus	string (or null)	LEI registration status (ISSUED, LAPSED, RETIRED, ANNULLED …)
nextRenewalDate	string (or null)	Next LEI renewal date (YYYY-MM-DD)
parentLei	string (or null)	The direct parent's LEI when GLEIF reports one (the lei check); null when none is reported
ultimateParentLei	string (or null)	The ultimate parent's LEI when GLEIF reports one (the lei check); null when none is reported
recallCount12m	integer (or null)	U.S. FDA food, drug and device recalls reported in the last 12 months whose recalling firm is this company (exact name match); null when recalls were not checked or could not be read
recallLatestDate	string (or null)	Report date of the newest recall (YYYY-MM-DD)
recallLatestNumber	string (or null)	FDA recall number of the newest recall
recallLatestClass	string (or null)	Classification of the newest recall (Class I is the most serious)
recallLatestProduct	string (or null)	Product of the newest recall (one line, at most 200 characters)
recalls	array (or null)	Up to 10 newest recalls, flat, each with the name it matched on (the count covers all of them)
foodAlertCount12m	integer (or null)	UK FSA food alerts created in the last 12 months that name this company (exact name match; an alert and its updates count once); null when alerts were not checked or could not be read
foodAlertLatestDate	string (or null)	Date the newest food alert was created (YYYY-MM-DD)
foodAlertLatestId	string (or null)	FSA id of the newest food alert
foodAlertLatestTitle	string (or null)	Title of the newest food alert (a name that may be a person's is left out, and the title is then neutral)
foodAlerts	array (or null)	Up to 10 newest food alerts, flat, each with the name it matched on (the count covers all of them)
domain	string (or null)	The domain checked (DNS and one TLS handshake, no web page)
sslValidTo	string (or null)	When the domain's certificate expires (ISO 8601)
sslDaysLeft	integer (or null)	Days until the certificate expires (negative when it has expired)
sslIssuer	string (or null)	Who issued the certificate (organisation and issuing CA)
spf	string (or null)	The domain's SPF record
dmarc	string (or null)	The domain's DMARC record (report addresses keep only their domain)
mx	string (or null)	The domain's mail servers, by priority
domainProblems	string (or null)	Domain problems in plain words, separated by "; " (null when there are none)
riskFlags	array (or null)	Risk signals in plain words: LEI lapsed or renewal due, entity inactive, a Class I recall or a UK food alert in the last 90 days, SSL expiring, expired or not trusted, no HTTPS, mail without SPF or DMARC
sourceStatus	object (or null)	Per source: ok (data found), no_data (nothing for this company), failed (could not be read; see notes) or skipped (not asked, or nothing to ask with)
notes	string (or null)	Plain-words notes: a source that could not be read, a name that was not used, an answer that was cut
licences	array (or null)	One licence line per source the row used
url	string (or null)	The company's record on GLEIF's public LEI search; for a company given only by its domain, the domain's address (never fetched)
change	string (or null)	Watch mode: baseline (first run of the list), new (a company the list didn't have) or changed; null in export mode
changedFields	string (or null)	Watch mode: the tracked fields that changed, comma-separated (baseline and new rows: every tracked field the company has)
scrapedAt	string (or null)	When the row was made (ISO 8601)

Pricing

Pay per event, one event per identified company (company-check), whatever the number of sources:

Plan	Price per company	Per 1,000 companies
Free (no discount)	$0.0015	$1.50
Bronze	$0.0013	$1.30
Silver	$0.00115	$1.15
Gold (and Platinum, Diamond)	$0.0010	$1.00

• Charged: ok rows in export mode; baseline, new and changed rows in watch mode.
• Never charged: failed rows, no_data rows (not found, no single exact name match, a person left out, nothing new) and unchanged rows. You are never charged for failed results.
• Pay per event only, with no usage fees, so the actor is eligible for x402 agent payments.

Use it from AI agents

One clear main input, companies; every row has status, error, sourceStatus and scrapedAt, and a name with no single exact match gives the candidates to call again with. Call it through the Apify API, the Apify MCP server (mouadapi/company-check) or x402 agentic payments. Copy-paste call (your Apify token in place of YOUR_APIFY_TOKEN):

$curl -X POST "https://api.apify.com/v2/acts/mouadapi~company-check/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" -H "Content-Type: application/json" -d '{"companies": ["5493003NRW7LS2QZRH60", "icumed.com"], "checks": ["lei", "recalls", "foodAlerts", "domain"]}'

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_APIFY_TOKEN' });
const run = await client.actor('mouadapi/company-check').call({ companies: ['5493003NRW7LS2QZRH60', 'icumed.com'], watchListName: 'suppliers' });
const { items } = await client.dataset(run.defaultDatasetId).listItems();

Limits

• Recalls and alerts cover the last 12 months. Recalls are U.S. FDA enforcement reports (food, drug, device; not USDA meat and poultry recalls); alerts are the UK Food Standards Agency's food alerts.
• Exact names only. A recall filed under a subsidiary's or a trading name counts only when GLEIF lists that name for the company or you give it with the LEI. A legal name typed without its legal form matches nothing (you get candidates).
• GLEIF name searches read the first 50 records that contain every word of the name: for a very common name, use the LEI.
• The domain check reads DNS and makes one TLS handshake to port 443; it never fetches a web page, and never reads WHOIS or RDAP. IP addresses, internal names and URLs are refused.
• openFDA without your key allows 1,000 requests a day per IP address, shared with other users (each company uses 3).
• Parents come from GLEIF's relationship records; a company whose parent is a person is left out whole.
• At most 500 companies per run.

Known issues

• People filter, when in doubt it drops: a record is left out (free) when a name or an address line has a person's name's shape, even when it is a place. For example, the two UK ICU Medical records are left out because of the address line "Lower Pemberton".
• A source that cannot be read (a rate limit that three pauses don't clear, an outage) is marked failed in sourceStatus for the rest of the run, with a note; the company's row is still ok when GLEIF identified it. Another IP or proxy is never tried.

Sources and licences

• GLEIF LEI data: CC0 1.0 (LEI Data Terms of Use).
• openFDA enforcement reports: CC0 1.0 public domain (openFDA terms); not endorsed by the U.S. FDA.
• UK FSA food alerts: contains public sector information licensed under the Open Government Licence v3.0 (Food Standards Agency).
• DNS and TLS: public protocol answers for the domain you give (no data provider).

Each row's licences field lists the sources it used.