# Federal Sanctions & Exclusion Audit Record — SAM + LEIE + OFAC (`querymill/federal-exclusions-audit-record`) Actor

One timestamped audit record checking a name against SAM.gov Exclusions, HHS OIG LEIE and OFAC SDN from the current public bulk extracts — exact query, per-source SHA-256 vintage, and all possible/partial matches. No-match is not a legal clearance.

- **URL**: https://apify.com/querymill/federal-exclusions-audit-record.md
- **Developed by:** [Eric Trammell](https://apify.com/querymill) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$150.00 / 1,000 completed exclusion checks

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Federal Sanctions & Exclusion Audit Record — SAM + LEIE + OFAC in one check

One timestamped audit record that checks a name against three U.S. federal lists at once:

- **SAM.gov Exclusions** — parties excluded from federal awards and subawards (the check 2 CFR 180.300 describes before awarding federal funds)
- **HHS OIG LEIE** — individuals and entities excluded from federally funded health care programs
- **Treasury OFAC SDN** — Specially Designated Nationals and Blocked Persons, including alternate (a.k.a.) names

**Price: $0.15 per completed check** (event: `check`). A failed check — where no source could be downloaded — charges nothing.

### How it works: bulk extracts, not live API calls

This actor never makes live per-query API calls. For every check it downloads the current **public bulk files**, records each file's **SHA-256 hash, size, record count and retrieval timestamp** in the output, normalizes them locally, and matches against that exact vintage. The output therefore proves *which data* your check ran against, not just when it ran.

- LEIE: the full downloadable database CSV published by HHS OIG (replaced monthly).
- OFAC: `sdn.csv` (primary names) + `alt.csv` (aliases) published by the U.S. Treasury.
- SAM: the daily SAM Exclusions Public Extract V2 (ZIP of all active exclusions), via GSA's official Extracts Download API — see the SAM key note below.

### The SAM key note (read before your first check)

LEIE and OFAC files download with no account. GSA serves the SAM exclusions extract only through its Extracts Download API, which requires a **free SAM.gov Public API Key tied to a personal SAM.gov account**. Paste your own key into the optional `samApiKey` input and the SAM leg runs in the same record. Without a key, the check still completes against LEIE and OFAC, and the record states in plain language that **SAM was NOT checked** — it never silently treats a missing SAM leg as a pass, and it never uses any unauthenticated backend endpoint.

### What the record contains

- The **exact search terms and identifiers you queried** (name, UEI, CAGE, NPI, DOB — as supplied)
- **Retrieval timestamp** and, per source, the **source-file vintage with its SHA-256**
- **Every possible/partial match** at or above the matching threshold, each labeled `EXACT_NAME`, `CONTAINED_NAME`, `PARTIAL_NAME` or `IDENTIFIER_MATCH`, with its match score, the listed name, program/type, dates and address details as published
- An **ambiguity warning** whenever matches exist: a possible match is a lead for human identity resolution, not a finding
- **Re-check mode**: store a check as a baseline, then re-check the same query later — the record reports whether the result signature changed since the baseline and stores the new baseline

### What a result does — and does not — mean

**A no-match result is a documented search result only. It is NOT a definitive legal clearance, NOT a compliance determination, and NOT legal advice.**

- Name-only matching can produce false positives and false negatives. Listed parties use aliases, alternate spellings and transliterations, and names change. That is why every possible/partial match is returned for human review instead of being hidden behind a single yes/no.
- **OFAC's 50 Percent Rule** can block an entity owned 50% or more by one or more listed persons even when the entity itself appears on no list — so a no-match can never be read as "clean" or "clear."
- 2 CFR 180.300 permits multiple verification methods, and **SAM.gov itself is the system of record** for SAM exclusions (likewise the OIG online search for LEIE identity verification and OFAC Sanctions List Search for SDN identity). A third-party check adds a timestamped, source-vintaged evidence record of a check you performed; it adds no legal standing of its own, and this listing does not claim otherwise. Verify any consequential decision in the official systems.

### Inputs

| Input | Notes |
|---|---|
| `mode` | `check` (default), `recheck` (compare + update baseline), `harvest` (internal daily vintage job, free) |
| `name` | Required for check/recheck. Entity or individual name, recorded verbatim in the audit record |
| `uei`, `cageCode`, `npi`, `dob` | Optional identifiers. An identifier match is decisive and labeled `IDENTIFIER_MATCH` |
| `country`, `state` | Optional; recorded as part of the exact query |
| `samApiKey` | Optional secret. Your own free SAM.gov Public API Key; enables the SAM leg |
| `storeBaseline` | Store this check as the baseline for later re-checks |

### Freshness

Checks download the current files at check time, so there is no stale local database behind a result. A scheduled daily harvest additionally records source vintages and counts as a heartbeat; if a source is unreachable, that source is reported as a source error in the record rather than being quietly skipped — and if no source can be downloaded, the check fails and charges nothing.

### Sources

- SAM.gov Exclusions Public Extract V2 (GSA, daily) — via the official Extracts Download API
- HHS OIG List of Excluded Individuals/Entities (LEIE) downloadable database
- U.S. Treasury OFAC Specially Designated Nationals List (`sdn.csv` + `alt.csv`)

# Actor input Schema

## `cageCode` (type: `string`):

CAGE/NCAGE code, matched against SAM records when the SAM leg is enabled.

## `country` (type: `string`):

Recorded in the audit record as part of the exact query; name/identifier matching is primary.

## `dob` (type: `string`):

Present in LEIE records; used only as a matching identifier you supply.

## `mode` (type: `string`):

check = one 3-source audit record ($0.15 per completed check; no charge on a failed check). recheck = same check compared against the stored baseline for this exact query, reporting whether the result changed. harvest = internal daily vintage job (free).

## `name` (type: `string`):

Entity or individual name exactly as you want it recorded in the audit record. Matching also tries contained and token-overlap forms and reports every possible/partial match.

## `npi` (type: `string`):

National Provider Identifier, present in LEIE records.

## `samApiKey` (type: `string`):

Enables the SAM.gov exclusions leg. The official SAM exclusions extract is served by GSA's Extracts Download API, which requires a free SAM.gov Public API Key from a personal SAM.gov account. Your key is used only to download the current daily public exclusions extract for this run. Without a key, LEIE and OFAC are still checked and the record states explicitly that SAM was NOT checked.

## `state` (type: `string`):

Recorded in the audit record as part of the exact query.

## `storeBaseline` (type: `boolean`):

Stores this query's result signature so a later recheck can report whether the status changed.

## `uei` (type: `string`):

Unique Entity ID. An identifier match is decisive and is reported as IDENTIFIER_MATCH.

## Actor input object example

```json
{
  "mode": "check",
  "storeBaseline": false
}
```

# Actor output Schema

## `itemCount` (type: `string`):

No description

## `items` (type: `string`):

No description

## `overview` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("querymill/federal-exclusions-audit-record").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("querymill/federal-exclusions-audit-record").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call querymill/federal-exclusions-audit-record --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,querymill/federal-exclusions-audit-record"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/IdhETak5v1ntPvPPH/builds/ct3dgY7HtLPrkOnuP/openapi.json