---
title: "Direct SECO sanctions screening for a UID"
method: GET
path: "/api/v1/company/{uid}/sanctions"
deprecated: true
---

# Direct SECO sanctions screening for a UID

`GET /api/v1/company/{uid}/sanctions`

## Request

- Base URL: `https://bumit.ai`
- URL: `https://bumit.ai/api/v1/company/{uid}/sanctions`
- Auth: none required

> **Deprecated.**

Screens the BUMIT-held registered company name directly against entity targets in the stored SECO consolidated sanctions dataset.

Scope is DIRECT_SECO_LIST_SCREENING: direct subjects only. SECO's list concerns directly sanctioned subjects and establishes no ownership or control relationships, so `ownership_control_checked` is always false.

A `check_state` of CLEAR means only that no direct candidate match was found in the dataset BUMIT checked. It does NOT mean the company is not sanctioned, that no sanctioned party owns or controls it, that other sanctions regimes are clear, or that it is safe to transact. This endpoint never asserts that a company is not sanctioned.

Matching is deterministic code with no similarity score, no threshold and no LLM. Candidate generation (exact normalized name, equal normalized token set, legal-form-reduced name) is separate from match classification. CONFIRMED_MATCH remains in the contract but is unreachable: SECO publishes no structured company identifier, so no authoritative identity rule exists that could confirm an entity match, and name evidence alone must never confirm.

Current listing state is DERIVED from structured modification history, never from a target's mere presence in the whole list; a de-listed target is still reported as a candidate with `listing_state: DE_LISTED`.

An unavailable, schema-unsupported or stale dataset, or a missing register name, yields UNKNOWN with SANCTIONS_CHECK_INCOMPLETE — never CLEAR. Live and scheduled SECO ingestion is disabled, so coverage is limited to the dataset already ingested.

## Path parameters

- `uid` string, required

## Response `200`

Sanctions check state with scope, coverage, matching ruleset, candidate evidence, claims, freshness and provenance.

- CompanySanctionsResponse
  - `status` 'OK', required
  - `uid` string, required
  - `uid_checksum_valid` boolean
  - `capability` 'SANCTIONS_CHECK'
  - `check_state` 'CLEAR' | 'POSSIBLE_MATCH' | 'CONFIRMED_MATCH' | 'UNKNOWN', required
  - `reason_codes` string[]
  - `scope` object, required
    - `scope` 'DIRECT_SECO_LIST_SCREENING'
    - `direct_subjects_only` unknown
    - `ownership_control_checked` unknown
    - `natural_person_screening` unknown
    - `transaction_screening` unknown
  - `screened_name` string, nullable
  - `normalized_screened_name` string, nullable
  - `coverage` object, required
    - `complete` unknown
    - `confirmed_match_reachable` unknown
    - `live_ingestion_enabled` unknown
    - `ingestion_mode` 'FIXTURE_BASED'
  - `matching` object, required
    - `engine` 'DETERMINISTIC'
    - `ruleset_version` string
    - `name_normalization_ruleset_version` string
    - `candidate_rules` string[]
    - `similarity_scoring_used` unknown
    - `fuzzy_confirmation_possible` unknown
    - `llm_used` unknown
  - `candidate_count` integer
  - `candidates` SanctionsCandidate[], required
    - `target_ssid` string, required: SECO target SSID. SOURCE_FACT.
    - `sanctions_set_ids` string[], required: Every sanctions set the target belongs to. Many-to-many, never collapsed.
    - `program_ssids` string[]
    - `foreign_identifier` string, nullable
    - `listing_state` 'LISTED' | 'DE_LISTED' | 'UNKNOWN', required
    - `listing_state_basis` string
    - `latest_modification_date` string, nullable
    - `matched_name` object, required: The source-published name that matched, with BUMIT normalization keys reported separately from the source value.
    - `match_basis` string[], required: Deterministic rules that fired. No similarity score exists.
    - `supporting_evidence` object
  - `freshness` Freshness: Cached evidence is never reported as LIVE.
    - `observed_at` string, date-time, nullable, required
    - `retrieved_at` string, date-time, nullable: Set only when this response came from a successful upstream call.
    - `source_timestamp` string, nullable
    - `age_seconds` integer, nullable
    - `max_age_hours` integer, nullable
    - `stale` boolean, required
    - `served_from_cache` boolean, required
    - `source_state` 'LIVE' | 'CACHED' | 'STALE' | 'DEGRADED' | 'UNAVAILABLE', required
    - `upstream_status` 'AVAILABLE' | 'NOT_CHECKED' | 'DEGRADED' | 'UNAVAILABLE' | 'NOT_CONFIGURED', required: Current upstream condition. NOT_CHECKED means this request was served cache-first and never contacted the source, so no availability claim is made; it is not a failure. Pair it with upstream_checked: false and source_state: CACHED.
    - `reason_code` 'INVALID_UID' | 'COMPANY_NOT_FOUND' | 'SOURCE_NOT_CONFIGURED' | 'SOURCE_UNAVAILABLE' | 'SOURCE_TIMEOUT' | 'SOURCE_RATE_LIMITED' | 'STALE_EVIDENCE' | 'INSUFFICIENT_EVIDENCE' | 'CAPABILITY_NOT_SUPPORTED' | 'CAPABILITY_NOT_AVAILABLE' | 'AUTHENTICATION_REQUIRED' | 'ACCESS_DENIED' | 'RATE_LIMITED' | 'UPSTREAM_DEGRADED' | 'INTERNAL_ERROR' | 'BAD_REQUEST' | 'PARTIAL_COVERAGE' | 'SANCTIONS_NO_DIRECT_MATCH' | 'SANCTIONS_POSSIBLE_MATCH' | 'SANCTIONS_CONFIRMED_MATCH' | 'SANCTIONS_DATA_UNAVAILABLE' | 'SANCTIONS_DATA_STALE' | 'SANCTIONS_SCHEMA_UNSUPPORTED' | 'SANCTIONS_CHECK_INCOMPLETE' | 'FINMA_LIST_UID_MATCH' | 'FINMA_LIST_UID_NOT_FOUND' | 'FINMA_LIST_UID_UNUSABLE' | 'FINMA_AUTHORISATION_DATA_UNAVAILABLE' | 'FINMA_AUTHORISATION_DATA_STALE' | 'FINMA_AUTHORISATION_DATA_INVALID' | 'FINMA_AUTHORISATION_CHECK_INCOMPLETE' | 'FINMA_WARNING_NO_DIRECT_MATCH' | 'FINMA_WARNING_POSSIBLE_MATCH' | 'FINMA_WARNING_DATA_UNAVAILABLE' | 'FINMA_WARNING_DATA_STALE' | 'FINMA_WARNING_DATA_INVALID' | 'FINMA_WARNING_CHECK_INCOMPLETE' | 'LEI_RECORD_FOUND' | 'LEI_RECORD_NOT_FOUND' | 'LEI_MULTIPLE_RECORDS' | 'LEI_LINKAGE_IDENTIFIER_UNUSABLE' | 'LEI_DATA_UNAVAILABLE' | 'LEI_DATA_INVALID' | 'LEI_DATA_STALE' | 'LEI_LOOKUP_INCOMPLETE' | 'VAT_ACTIVE_REGISTRATION' | 'VAT_INACTIVE_REGISTRATION' | 'VAT_NO_REGISTRATION' | 'VAT_STATUS_UNRECOGNISED' | 'VAT_EVIDENCE_CONTRADICTORY' | 'VAT_RECORD_NOT_FOUND' | 'VAT_MULTIPLE_SOURCE_RECORDS' | 'VAT_SUBJECT_UID_UNUSABLE' | 'VAT_DATA_UNAVAILABLE' | 'VAT_DATA_INVALID' | 'VAT_DATA_STALE' | 'VAT_CHECK_INCOMPLETE' | 'ADDRESS_OFFICIAL_MATCH' | 'ADDRESS_PLANNED_MATCH' | 'ADDRESS_OUTDATED_MATCH' | 'ADDRESS_NOT_FOUND' | 'ADDRESS_MULTIPLE_MATCHES' | 'ADDRESS_QUERY_UNUSABLE' | 'ADDRESS_STATUS_MISSING' | 'ADDRESS_STATUS_UNRECOGNISED' | 'ADDRESS_OFFICIAL_FLAG_NOT_SET' | 'ADDRESS_EVIDENCE_CONTRADICTORY' | 'ADDRESS_DATA_UNAVAILABLE' | 'ADDRESS_DATA_INVALID' | 'ADDRESS_DATA_STALE' | 'ADDRESS_CHECK_INCOMPLETE' | 'MANDATORY_CHECK_FAILED' | 'MANDATORY_CHECK_REVIEW' | 'MANDATORY_CHECK_UNKNOWN' | 'VERIFICATION_PROFILE_SATISFIED': Stable machine-readable reason identifier.
  - `claims` Claim[]
    - `attribute` string, required
    - `value` unknown, required
    - `claim_type` 'SOURCE_FACT' | 'NORMALIZED' | 'DERIVED' | 'INFERRED' | 'UNAVAILABLE', required: SOURCE_FACT published by the source; NORMALIZED deterministic transformation; DERIVED deterministic BUMIT conclusion; INFERRED probabilistic and not stated by the source; UNAVAILABLE required evidence missing.
    - `inference_used` boolean, required
    - `source` string, nullable
    - `source_record_id` string, nullable
    - `source_url` string, nullable
    - `observed_at` string, date-time, nullable
    - `valid_from` string, nullable
    - `valid_to` string, nullable
    - `source_hash` string, nullable
    - `confidence` number
    - `reason_code` 'INVALID_UID' | 'COMPANY_NOT_FOUND' | 'SOURCE_NOT_CONFIGURED' | 'SOURCE_UNAVAILABLE' | 'SOURCE_TIMEOUT' | 'SOURCE_RATE_LIMITED' | 'STALE_EVIDENCE' | 'INSUFFICIENT_EVIDENCE' | 'CAPABILITY_NOT_SUPPORTED' | 'CAPABILITY_NOT_AVAILABLE' | 'AUTHENTICATION_REQUIRED' | 'ACCESS_DENIED' | 'RATE_LIMITED' | 'UPSTREAM_DEGRADED' | 'INTERNAL_ERROR' | 'BAD_REQUEST' | 'PARTIAL_COVERAGE' | 'SANCTIONS_NO_DIRECT_MATCH' | 'SANCTIONS_POSSIBLE_MATCH' | 'SANCTIONS_CONFIRMED_MATCH' | 'SANCTIONS_DATA_UNAVAILABLE' | 'SANCTIONS_DATA_STALE' | 'SANCTIONS_SCHEMA_UNSUPPORTED' | 'SANCTIONS_CHECK_INCOMPLETE' | 'FINMA_LIST_UID_MATCH' | 'FINMA_LIST_UID_NOT_FOUND' | 'FINMA_LIST_UID_UNUSABLE' | 'FINMA_AUTHORISATION_DATA_UNAVAILABLE' | 'FINMA_AUTHORISATION_DATA_STALE' | 'FINMA_AUTHORISATION_DATA_INVALID' | 'FINMA_AUTHORISATION_CHECK_INCOMPLETE' | 'FINMA_WARNING_NO_DIRECT_MATCH' | 'FINMA_WARNING_POSSIBLE_MATCH' | 'FINMA_WARNING_DATA_UNAVAILABLE' | 'FINMA_WARNING_DATA_STALE' | 'FINMA_WARNING_DATA_INVALID' | 'FINMA_WARNING_CHECK_INCOMPLETE' | 'LEI_RECORD_FOUND' | 'LEI_RECORD_NOT_FOUND' | 'LEI_MULTIPLE_RECORDS' | 'LEI_LINKAGE_IDENTIFIER_UNUSABLE' | 'LEI_DATA_UNAVAILABLE' | 'LEI_DATA_INVALID' | 'LEI_DATA_STALE' | 'LEI_LOOKUP_INCOMPLETE' | 'VAT_ACTIVE_REGISTRATION' | 'VAT_INACTIVE_REGISTRATION' | 'VAT_NO_REGISTRATION' | 'VAT_STATUS_UNRECOGNISED' | 'VAT_EVIDENCE_CONTRADICTORY' | 'VAT_RECORD_NOT_FOUND' | 'VAT_MULTIPLE_SOURCE_RECORDS' | 'VAT_SUBJECT_UID_UNUSABLE' | 'VAT_DATA_UNAVAILABLE' | 'VAT_DATA_INVALID' | 'VAT_DATA_STALE' | 'VAT_CHECK_INCOMPLETE' | 'ADDRESS_OFFICIAL_MATCH' | 'ADDRESS_PLANNED_MATCH' | 'ADDRESS_OUTDATED_MATCH' | 'ADDRESS_NOT_FOUND' | 'ADDRESS_MULTIPLE_MATCHES' | 'ADDRESS_QUERY_UNUSABLE' | 'ADDRESS_STATUS_MISSING' | 'ADDRESS_STATUS_UNRECOGNISED' | 'ADDRESS_OFFICIAL_FLAG_NOT_SET' | 'ADDRESS_EVIDENCE_CONTRADICTORY' | 'ADDRESS_DATA_UNAVAILABLE' | 'ADDRESS_DATA_INVALID' | 'ADDRESS_DATA_STALE' | 'ADDRESS_CHECK_INCOMPLETE' | 'MANDATORY_CHECK_FAILED' | 'MANDATORY_CHECK_REVIEW' | 'MANDATORY_CHECK_UNKNOWN' | 'VERIFICATION_PROFILE_SATISFIED': Stable machine-readable reason identifier.
  - `sources` string[]
  - `provenance` object, nullable
  - `attribution` object, nullable
  - `inference_used` unknown
  - `ruleset_version` string
  - `legal_effect` unknown
  - `semantic_boundary` string
  - `disclaimer` object
  - `meta` Meta
    - `service` string, required
    - `api_version` string, required
    - `trace_id` string, uuid, required
    - `generated_at` string, date-time, required

## Other responses

- `404`: No legal entity is registered for this UID.
- `422`: Structurally invalid UID.
- `501`: No authoritative source is configured in this deployment; the capability is supported but unavailable.

---

[API](https://skmtc.dev/bumit/apis/bumit-api.md) · [All operations](https://skmtc.dev/bumit/apis/bumit-api/llms.txt) · [OpenAPI document](https://skmtc.dev/bumit/apis/bumit-api/revisions/913e5d3654f8?raw)