Your sanctions and PEP lists, ready to integrate by API

How it works

What you get

Authenica provides ready-to-use compliance data : screening of your customers against public and official lists of sanctions and politically exposed persons (PEPs), consolidated, reloaded regularly and served through a secure API, so that your teams do not have to collect or normalise these lists themselves.

The lists queried

Screening covers public and official lists, published by their issuers and reloaded regularly. New sources are added over time; the up-to-date list is always available through the API (see "List the sources").

Status according to the API source register. The real-time state of each list and the date it was last loaded are given in the fields status and lastLoadedAt of GET /api/v1/lists/sources ; this page shows no date that does not appear there.

Coverage of national freezing lists

Each Union State keeps, through its CENTIF, its own national asset-freezing list. Authenica is integrating them one by one; a list is marked “served” only once it is actually queried by the API.

Get started in two minutes

1. Get a keyApply online: we create your access and give you the key.
2. Call the APIA POST call with the name searched and your key.
3. Read the resultA list of records, each with its list and version.

curl -X POST https://api.authenica.tech/api/v1/screenings \
  -H "X-Api-Key: $AUTHENICA_CLE_API" \
  -H "Content-Type: application/json" \
  -d '{"fullName":"Zorbek Nandrawell","scoreThreshold":0.85}'

Get your key

1. Fill in the evaluation key request form with the name of your organisation and the intended use. We reply within one working day.
2. We create your access and give you the key only once. It is not stored in clear text: we cannot give it to you again, only create a new one.
3. We agree with you on a per-minute quota.

To change or revoke a key, write to it@authenica.tech. Revocation is immediate.

Authentication

Every call carries your key in the header X-Api-Key. The base address is https://api.authenica.tech, HTTPS only: an HTTP call is redirected.

With no key, or an unknown, revoked or expired key: response 401. Knowing the address grants no access.

Query the lists

POST /api/v1/screenings

What you send

Read the response

Response 200 :

{
  "requestId": "63f766c4-9c1c-4adb-ac8e-4e66674b4be0",
  "matches": [
    {
      "listType": "SANCTIONS",
      "listName": "AUTHENICA_TEST_SANCTIONS",
      "listVersion": "a0a0a0a0-0000-4000-8000-000000000001",
      "targetLabel": "Zorbek NANDRAWELL",
      "score": 1.0,
      "confidence": "UNCORROBORATED",
      "evidence": [
        {
          "field": "DOCUMENT_NUMBER",
          "status": "UNKNOWN",
          "customerValue": null,
          "listValue": null
        },
        {
          "field": "DATE_OF_BIRTH",
          "status": "UNKNOWN",
          "customerValue": null,
          "listValue": "15 Jun 1975"
        },
        {
          "field": "NATIONALITY",
          "status": "UNKNOWN",
          "customerValue": null,
          "listValue": "Mali"
        },
        {
          "field": "PLACE_OF_BIRTH",
          "status": "UNKNOWN",
          "customerValue": null,
          "listValue": "Bamako"
        }
      ],
      "details": {
        "entityType": "NATURAL_PERSON",
        "list": {
          "label": "Liste d'essai fictive : sanctions",
          "publisher": "Authenica"
        },
        "sanctionPrograms": [
          "TEST-FICTIF"
        ],
        "title": "Personne fictive de la liste d'essai",
        "description": "Fiche fictive pour tester l'intégration. Aucune personne réelle.",
        "nationalities": [
          "Mali"
        ],
        "datesOfBirth": [
          "15 Jun 1975"
        ],
        "placesOfBirth": [
          "Bamako"
        ]
      }
    }
  ],
  "ignoredFields": []
}

Confidence, in plain terms

It never dismisses a record: a likely namesake remains an alert to be reviewed by a person.

Record details

The block details repeats what the list issuer publishes about the record. It helps tell two namesakes apart, for example two people with the same name but different functions.

The detail of the comparison

Each line of evidence has field (DATE_OF_BIRTH, NATIONALITY, PLACE_OF_BIRTH or DOCUMENT_NUMBER), customerValue (what you sent), listValue (what the record says) and status :

• MATCH : the two match.
• CONFLICT : the two contradict each other.
• UNKNOWN : one of the two sides does not provide the element, so neither confirmation nor contradiction.

Try it with test cases

Authenica maintains a fictitious test list to test your integration end to end, with reproducible results. It contains no real person or company : the names below do not exist. You can replay each request with your key and get the same response.

curl -X POST https://api.authenica.tech/api/v1/screenings \
  -H "X-Api-Key: $AUTHENICA_CLE_API" \
  -H "Content-Type: application/json" \
  -d '{"fullName":"Zorbek Nandrawell","dateOfBirth":"1975-06-15","nationality":"ML","scoreThreshold":0.85}'

{
  "requestId": "b0fa0a4d-8236-44bc-9979-2a0a41fc95f2",
  "matches": [
    {
      "listType": "SANCTIONS",
      "listName": "AUTHENICA_TEST_SANCTIONS",
      "listVersion": "a0a0a0a0-0000-4000-8000-000000000001",
      "targetLabel": "Zorbek NANDRAWELL",
      "score": 1.0,
      "confidence": "CORROBORATED",
      "evidence": [
        {
          "field": "DOCUMENT_NUMBER",
          "status": "UNKNOWN",
          "customerValue": null,
          "listValue": null
        },
        {
          "field": "DATE_OF_BIRTH",
          "status": "MATCH",
          "customerValue": "1975-06-15",
          "listValue": "15 Jun 1975"
        },
        {
          "field": "NATIONALITY",
          "status": "MATCH",
          "customerValue": "ML",
          "listValue": "Mali"
        },
        {
          "field": "PLACE_OF_BIRTH",
          "status": "UNKNOWN",
          "customerValue": null,
          "listValue": "Bamako"
        }
      ],
      "details": {
        "entityType": "NATURAL_PERSON",
        "list": {
          "label": "Liste d'essai fictive : sanctions",
          "publisher": "Authenica"
        },
        "sanctionPrograms": [
          "TEST-FICTIF"
        ],
        "title": "Personne fictive de la liste d'essai",
        "description": "Fiche fictive pour tester l'intégration. Aucune personne réelle.",
        "nationalities": [
          "Mali"
        ],
        "datesOfBirth": [
          "15 Jun 1975"
        ],
        "placesOfBirth": [
          "Bamako"
        ]
      }
    }
  ],
  "ignoredFields": []
}

curl -X POST https://api.authenica.tech/api/v1/screenings \
  -H "X-Api-Key: $AUTHENICA_CLE_API" \
  -H "Content-Type: application/json" \
  -d '{"fullName":"Kassim Dromvale","dateOfBirth":"1968-03-02","nationality":"CI","scoreThreshold":0.85}'

{
  "requestId": "5ce9f675-92cf-4f19-9bd3-3098496f12e9",
  "matches": [
    {
      "listType": "PPE",
      "listName": "AUTHENICA_TEST_PPE",
      "listVersion": "a0a0a0a0-0000-4000-8000-000000000002",
      "targetLabel": "Kassim DROMVALE",
      "score": 1.0,
      "confidence": "CORROBORATED",
      "evidence": [
        {
          "field": "DOCUMENT_NUMBER",
          "status": "UNKNOWN",
          "customerValue": null,
          "listValue": null
        },
        {
          "field": "DATE_OF_BIRTH",
          "status": "MATCH",
          "customerValue": "1968-03-02",
          "listValue": "02 Mar 1968"
        },
        {
          "field": "NATIONALITY",
          "status": "MATCH",
          "customerValue": "CI",
          "listValue": "Côte d'Ivoire"
        },
        {
          "field": "PLACE_OF_BIRTH",
          "status": "UNKNOWN",
          "customerValue": null,
          "listValue": "Abidjan"
        }
      ],
      "details": {
        "entityType": "NATURAL_PERSON",
        "list": {
          "label": "Liste d'essai fictive : personnes politiquement exposées",
          "publisher": "Authenica"
        },
        "sanctionPrograms": [],
        "title": "Ministre (fonction fictive)",
        "description": "Fiche fictive pour tester l'intégration. Aucune personne réelle.",
        "nationalities": [
          "Côte d'Ivoire"
        ],
        "datesOfBirth": [
          "02 Mar 1968"
        ],
        "placesOfBirth": [
          "Abidjan"
        ]
      }
    }
  ],
  "ignoredFields": []
}

curl -X POST https://api.authenica.tech/api/v1/screenings \
  -H "X-Api-Key: $AUTHENICA_CLE_API" \
  -H "Content-Type: application/json" \
  -d '{"fullName":"Aminata Kone Diabate","dateOfBirth":"1990-04-12","nationality":"CI","scoreThreshold":0.85}'

{
  "requestId": "3b3a92ce-018f-452e-a63b-24d9129179a6",
  "matches": [],
  "ignoredFields": []
}

curl -X POST https://api.authenica.tech/api/v1/screenings \
  -H "X-Api-Key: $AUTHENICA_CLE_API" \
  -H "Content-Type: application/json" \
  -d '{"fullName":"Nandrawell Holding SARL","entityType":"LEGAL_ENTITY","scoreThreshold":0.85}'

{
  "requestId": "bf7e6348-5909-49a4-a997-ed600d1e7494",
  "matches": [
    {
      "listType": "SANCTIONS",
      "listName": "AUTHENICA_TEST_SANCTIONS",
      "listVersion": "a0a0a0a0-0000-4000-8000-000000000001",
      "targetLabel": "NANDRAWELL HOLDING SARL",
      "score": 1.0,
      "confidence": "UNCORROBORATED",
      "evidence": [],
      "details": {
        "entityType": "LEGAL_ENTITY",
        "list": {
          "label": "Liste d'essai fictive : sanctions",
          "publisher": "Authenica"
        },
        "sanctionPrograms": [
          "TEST-FICTIF"
        ],
        "title": "Société fictive de la liste d'essai",
        "description": "Fiche fictive pour tester l'intégration. Aucune société réelle.",
        "nationalities": [],
        "datesOfBirth": [],
        "placesOfBirth": []
      }
    }
  ],
  "ignoredFields": []
}

Filter the search

Two filters that can be combined. An absent filter filters nothing.

# Seulement les personnes politiquement exposées
-d '{"fullName":"Kassim Dromvale","scoreThreshold":0.85,"listTypes":["PPE"]}'

# Seulement les sociétés, dans les listes de sanctions
-d '{"fullName":"Société Exemple SARL","scoreThreshold":0.85,"entityType":"LEGAL_ENTITY","listTypes":["SANCTIONS"]}'

# Avec la date de naissance et la nationalité, pour corroborer
-d '{"fullName":"Zorbek Nandrawell","scoreThreshold":0.85,"corroboratedThreshold":0.70,"dateOfBirth":"1975-06-15","nationality":"ML"}'

An unknown type (for example "entityType":"NAVIRE") is rejected with an error 400.

List the sources

GET /api/v1/lists/sources

One entry per list: code (the one you find in listName), label (its readable name), publisher (the issuer), listType, lastBatchId (the last batch loaded, the one you find in listVersion), lastLoadedAt (the load date), status and entityCount (the number of records). No personal data.

curl https://api.authenica.tech/api/v1/lists/sources -H "X-Api-Key: $AUTHENICA_CLE_API"

Read and check an identity document

Beyond the lists, Authenica reads an identity document from its photo: identity card, passport, driving licence, residence permit. The service returns the fields read, the document model recognised and the checks performed (validity, authenticity, image quality, consistency of the machine-readable zone). You can prefill your onboarding form and know whether the document deserves trust.

What you send

POST /api/v1/document-readings, as multipart/form-data, with your key in X-Api-Key as for the lists.

Images JPEG or PNG, 5 MB maximum each. The content is checked: a file renamed .jpg that is not an image is rejected.

curl -X POST https://api.authenica.tech/api/v1/document-readings \
  -H "X-Api-Key: $AUTHENICA_CLE_API" \
  -F "front=@recto.jpg;type=image/jpeg" \
  -F "back=@verso.jpg;type=image/jpeg"

What you receive

Flags

A real test on a fictitious document

Here is the actual API response for a passport image generated for the test : it is not authentic and carries only invented data. The service reads the fields, but reports that the model is not recognised and that the authenticity checks could not be performed, exactly as it should. For an authentic document of a known model, the model is named and the security checks are performed and counted in securityChecks.

curl -X POST https://api.authenica.tech/api/v1/document-readings \
  -H "X-Api-Key: $AUTHENICA_CLE_API" \
  -F "singlePage=@passeport-fictif.png;type=image/png"

{
  "requestId": "c6f82bd1-898a-45de-bcbf-95925b156d48",
  "documentName": null,
  "fields": {
    "LAST_NAME": {
      "value": "KONE",
      "confidence": 78,
      "source": "MRZ",
      "validity": "NOT_PERFORMED",
      "consistent": true
    },
    "GIVEN_NAMES": {
      "value": "AMINATA",
      "confidence": 82,
      "source": "MRZ",
      "validity": "NOT_PERFORMED",
      "consistent": true
    },
    "DATE_OF_BIRTH": {
      "value": "1990-04-12",
      "confidence": 34,
      "source": "MRZ",
      "validity": "ERROR",
      "consistent": true
    },
    "NATIONALITY": {
      "value": "CIV",
      "confidence": 97,
      "source": "MRZ",
      "validity": "OK",
      "consistent": true
    },
    "DOCUMENT_NUMBER": {
      "value": "XXI2345G7",
      "confidence": 34,
      "source": "MRZ",
      "validity": "ERROR",
      "consistent": true
    },
    "EXPIRY_DATE": {
      "value": "2031-01-01",
      "confidence": 29,
      "source": "MRZ",
      "validity": "OK",
      "consistent": true
    }
  },
  "otherFields": {
    "MRZ Type": {
      "value": "ID-3",
      "confidence": 100,
      "source": "MRZ",
      "validity": "NOT_PERFORMED",
      "consistent": true
    },
    "Issuing State Name": {
      "value": "Cote d'Ivoire",
      "confidence": 0,
      "source": "MRZ",
      "validity": "OK",
      "consistent": true
    }
  },
  "authenticity": {
    "overall": "ERROR",
    "documentType": "ERROR",
    "security": "NOT_PERFORMED",
    "expiry": "OK",
    "imageQuality": "ERROR",
    "mrz": "ERROR",
    "securityChecks": null
  },
  "expired": false,
  "warnings": [
    "DOCUMENT_TYPE_NOT_RECOGNISED",
    "AUTHENTICITY_NOT_PERFORMED",
    "LOW_IMAGE_QUALITY",
    "MRZ_CHECK_FAILED"
  ]
}

Errors

Errors

Every error has the same shape: {"code": "...", "message": "...", "requestId": "..."}. The message never repeats what you sent.

Code examples

In each example, the key comes from an environment variable and a failure suspends the operation.

import os, requests

reponse = requests.post(
    "https://api.authenica.tech/api/v1/screenings",
    headers={"X-Api-Key": os.environ["AUTHENICA_CLE_API"]},
    json={"fullName": "Zorbek Nandrawell", "scoreThreshold": 0.85, "listTypes": ["SANCTIONS"]},
    timeout=10,
)
if reponse.status_code != 200:
    raise RuntimeError(f"Criblage impossible ({reponse.status_code}) : suspendre l'opération")
for fiche in reponse.json()["matches"]:
    print(fiche["listName"], fiche["listVersion"], fiche["score"], fiche["confidence"])

// Node.js 18 ou plus
const reponse = await fetch("https://api.authenica.tech/api/v1/screenings", {
  method: "POST",
  headers: { "X-Api-Key": process.env.AUTHENICA_CLE_API, "Content-Type": "application/json" },
  body: JSON.stringify({ fullName: "Zorbek Nandrawell", scoreThreshold: 0.85 }),
  signal: AbortSignal.timeout(10_000),
});
if (!reponse.ok) throw new Error(`Criblage impossible (${reponse.status}) : suspendre l'opération`);
const { matches, requestId } = await reponse.json();

// Java 11 ou plus
HttpRequest requete = HttpRequest.newBuilder(URI.create("https://api.authenica.tech/api/v1/screenings"))
    .timeout(Duration.ofSeconds(10))
    .header("X-Api-Key", System.getenv("AUTHENICA_CLE_API"))
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString("{\"fullName\":\"Zorbek Nandrawell\",\"scoreThreshold\":0.85}"))
    .build();
HttpResponse<String> reponse = HttpClient.newHttpClient().send(requete, HttpResponse.BodyHandlers.ofString());
if (reponse.statusCode() != 200) throw new IllegalStateException("Criblage impossible : suspendre l'opération");

curl -X POST https://api.authenica.tech/api/v1/screenings \
  --max-time 10 --fail-with-body \
  -H "X-Api-Key: $AUTHENICA_CLE_API" \
  -H "Content-Type: application/json" \
  -d '{"fullName":"Zorbek Nandrawell","scoreThreshold":0.85}'

OpenAPI contract

The API contract is published at https://api.authenica.tech/v3/api-docs. You can import it into Postman or Insomnia, or generate a client with a tool such as OpenAPI Generator.

Good practice

• Keep the requestId and the listVersion with your decision: it is your proof in an inspection.
• Do not log the names searched or the key. Authenica does not keep them either: it searches, it does not store.
• A result is not a decision: a person reviews every match.
• Lists are reloaded automatically. The date each list was last loaded is in the list of sources.
• Set a timeout on every call and decide in advance what your process does if the service does not respond: it suspends.

Plans

Contact us

A demo, evaluation access, a commercial question: the contact form.

A key to change or revoke, an integration question, an incident: it@authenica.tech. Quote the requestId of the call concerned when you have one.