Screen your first entity in minutes

1. 1Open API Keys in the dashboard

   Sign in and go to API Keys (also linked from the Screen and Overview pages as “Manage API keys”). Programmatic access needs a plan that includes the API — it is not part of the Trial or Free plans.

2. 2Generate the key and store it now

   Name the key after what will use it, generate it, and copy it immediately: the full key is shown only once and Sanctix cannot display it again. Save it as an environment variable, for example SANCTIX_API_KEY, and never commit it to source control.

X-API-Key: $SANCTIX_API_KEY

The header name is X-API-Key exactly as documented in the API reference. Requests may also carry a session token as a Bearer token; the dashboard’s API Keys page authenticates programmatic screening “via Bearer or X-API-Key header”. The examples below call the public API host (https://api.sanctix.com) with proxy-shaped paths: the host routes /screen/… to the backend’s /api/v1/screen/…. Call the backend service URL directly and the reference’s /api/v1/… paths apply verbatim instead.

curl -X POST "https://api.sanctix.com/screen/entity" \
  -H "X-API-Key: $SANCTIX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Example Trading LLC",
    "entity_type": "company",
    "country": "AE",
    "threshold": 45,
    "limit": 10
  }'

The response carries the screening verdict (CLEAR, POSSIBLE_MATCH, FLAG_FOR_REVIEW or DO_NOT_TRANSACT), the confidence tier, the final_score out of 100, and the per-record all_hits list. Read the verdicts in how to read the response.

curl -X POST "https://api.sanctix.com/screen/full" \
  -H "X-API-Key: $SANCTIX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Example Trading LLC",
    "entity_type": "company",
    "country": "AE",
    "generate_ai_report": true
  }'

The response includes ref, verdict, confidence, final_score, the entity_screen detail, the ai_report summary when generation is enabled, and an integrity stamp with the report’s SHA-256 fingerprint. Fetch the sealed report later with GET /reports/{ref}, and let anyone holding it check the fingerprint on the public verify page.

curl -X POST "https://api.sanctix.com/screen/batch" \
  -H "X-API-Key: $SANCTIX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "queries": [
      { "name": "Example Trading LLC", "entity_type": "company", "country": "AE" },
      { "name": "Jane Example Doe", "entity_type": "person", "country": "GB", "dob": "1975-06-01" }
    ],
    "limit": 10
  }'

The response returns the batch’s own ref (fetch it with GET /api/v1/reports/batches/{ref}) plus one stored report per row, each with its own ref. Prefer files over JSON? The dashboard’s Screen page accepts the same rows as a CSV — the batch CSV article lists every accepted column header.

A match score reflects screening similarity out of 100 — it does not by itself establish that the screened subject is the listed party, and a no-match covers the screened lists above the review threshold, nothing more. The verdicts article explains each tier in operational detail.

• Passport numbers
• National ID numbers
• Tax ID numbers
• Company registration numbers
• IMO numbers
• SWIFT/BIC codes
• LEI codes
• Crypto wallet addresses

When the name also matches the listed record, a match on an ID number or wallet address makes that hit DO_NOT_TRANSACT, and a match on a listed website, email address or phone number holds it at FLAG_FOR_REVIEW.

The ID also finds a record whatever name you enter. A globally unique ID (wallet address, IMO number, LEI, SWIFT/BIC, ISIN, aircraft serial number) gives DO_NOT_TRANSACT. An ID issued within one country (passport, national ID, tax or registration number) gives FLAG_FOR_REVIEW, or DO_NOT_TRANSACT when the country or nationality you send is the ID’s issuing country. A vessel MMSI or call sign, or an aircraft tail number, can be reassigned and gives FLAG_FOR_REVIEW, as does an ID with no issuing country that is not known to be unique (a company’s IMO number). Contact details, and numbers too short to identify anyone (fewer than 6 characters, or fewer than 7 digits), only count when the name matches. Wallet addresses are matched against those published on the lists (mainly OFAC SDN); there is no transaction tracing.

Every error arrives in the same envelope: an error object with a code, a human-readable detail, and a request_id to quote when asking for help. The full-screen and batch endpoints also accept an optional Idempotency-Key header for safe retries.