Look up a provider by NPI or by name+state.

NPI mode: returns active, deactivated (with name+state search candidates seeded from the deactivated record's name), not_found, or registry_error. Sandbox organizations may receive an active mock identity when the NPI is absent from the registry. Deactivated records with no name on file return an empty candidate list — the FE prompts for manual name+state entry.

Name mode: last_name is required, first_name and state are optional. Always returns search_results (the candidate list may be empty when no match is found).

For a self-signup account, each returned provider has provider_verification: verified when the account can add it now, required when the account must verify it first. Other accounts do not get the field.