---
title: "SECOP Sanctions by Provider"
method: POST
path: "/co/secop/sanctions-by-provider/v1"
tags: ["Colombia", "SECOP"]
deprecated: true
---

# SECOP Sanctions by Provider

`POST /co/secop/sanctions-by-provider/v1`

## Request

- Base URL: `https://api.croma.run`
- URL: `https://api.croma.run/co/secop/sanctions-by-provider/v1`
- Auth: HTTP bearer

> **Deprecated.**

Deprecated since 2026-08-30; stops answering on 2026-12-01. Use `POST /co/secop/sanctions-search/v1` instead.

List the fines and sanctions (multas y sanciones) recorded against one state contractor by cédula or NIT: sanctioning entity, resolution number, value, and the dates the sanction was published and became final. A direct adverse signal for counterparty screening, from Colombia Compra Eficiente's open data.

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `document_number` string, required: Provider cédula or NIT. Dots and a trailing verification digit are optional: `900195855`, `900195855-1` and `900.195.855-1` all match the same contractor.

## Response `200`

Successful response

- SecopSanctionSearchResponse
  - `data` SecopSanctionSearchData, required
    - `document_number` string, required: Echoes the request's `document_number` (the contractor cédula/NIT).
    - `count` number, required: Returned count (capped, not the true total).
    - `capped` boolean, required: True when the result cap was hit; results are then incomplete.
    - `sanctions` object[], required
      - `entity` string, nullable, required
      - `entity_nit` string, nullable, required
      - `entity_level` string, nullable, required
      - `entity_order` string, nullable, required
      - `municipality` string, nullable, required
      - `resolution_number` string, nullable, required
      - `provider` string, nullable, required
      - `contract_number` string, nullable, required
      - `sanction_value` number, nullable, required
      - `published_date` string, nullable, required
      - `final_date` string, nullable, required: Date the sanction became final (fecha de firmeza).
      - `url` string, nullable, required
  - `deprecation` object: Present only while this endpoint is being retired. Mirrors the Deprecation, Sunset and Link response headers.
    - `since` string, date, required
    - `sunset` string, date, required
    - `successor` string, required: Path of the endpoint to use instead.
    - `message` string, required

## Other responses

- `400`: Invalid request body
- `401`: Missing or invalid API key
- `429`: Rate limit exceeded
- `500`: Internal error
- `502`: Upstream source returned an error

---

[API](https://skmtc.dev/usecroma/apis/croma-marketplace-api.md) · [All operations](https://skmtc.dev/usecroma/apis/croma-marketplace-api/llms.txt) · [OpenAPI document](https://skmtc.dev/usecroma/apis/croma-marketplace-api/revisions/df016cdb29d7?raw)