API Endpoint: List Sanctions
The list-sanctions endpoint screens a name against more than 330 global sanctions and watchlists.
POST /api/v1/validate/list-sanctions
https://www.tincomply.com/api/v1/validate/list-sanctions
Screens a person or business name against more than 330 sanctions and watchlists, including OFAC SDN, the Consolidated Screening List, SAM exclusions, FinCEN, BIS, EU and UN, with fuzzy matching and alias detection. Hits below your account's match threshold are filtered out.
Request body
| Field | Type | Description |
|---|---|---|
namerequired |
string | The person or business name to screen. |
Response object: listSanctionsMatchResult
| Field | Type | Description |
|---|---|---|
results | array | Hits, omitted when there are none. Each item has name, type, confidence, list (the source list), properties, related and relationships. |
anyFiltered | bool | True when the name matched an entry that appears only on lists your account does not have enabled. Those hits are left out of results. |
completed | bool | False when the upstream source was unavailable. The request is retried automatically; call request-details with the request id later to get the finished result. |
A hit is a lead for review, not a determination. Compare the list source and the returned identifiers (aliases, addresses, IDs) against your record before acting.
What to do with this result
| When you see | Do this |
|---|---|
| No results | Clear. Keep the request id as evidence of the screening. |
| anyFiltered is true | The name is on a list your account does not screen against. If that list matters to your program, enable it in the portal and screen again. |
| One or more results | Hold the payment or onboarding and review each hit: the list it came from, aliases, addresses and identifiers. |
| A hit you confirm is the same party | Do not pay. Escalate to your compliance officer; OFAC and other regimes have their own blocking and reporting rules. |
| completed is false | The source was unavailable. Keep the request id and call request-details later; the result fills in once the retry succeeds. |
Sample request
curl -X POST https://www.tincomply.com/api/v1/validate/list-sanctions \
-H "X-API-Key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name":"INTERNATIONAL BUSINESS MACHINES"}'import requests
response = requests.post(
"https://www.tincomply.com/api/v1/validate/list-sanctions",
headers={"X-API-Key": "YOUR_API_KEY"},
json={
"name": "INTERNATIONAL BUSINESS MACHINES",
},
)
response.raise_for_status()
print(response.json()["listSanctionsMatchResult"])using System.Text;
using var client = new HttpClient();
client.DefaultRequestHeaders.Add("X-API-Key", "YOUR_API_KEY");
var body = """
{
"name": "INTERNATIONAL BUSINESS MACHINES"
}
""";
var response = await client.PostAsync(
"https://www.tincomply.com/api/v1/validate/list-sanctions",
new StringContent(body, Encoding.UTF8, "application/json"));
Console.WriteLine(await response.Content.ReadAsStringAsync());const response = await fetch("https://www.tincomply.com/api/v1/validate/list-sanctions", {
method: "POST",
headers: {
"X-API-Key": "YOUR_API_KEY",
"Content-Type": "application/json",
},
body: JSON.stringify({
name: "INTERNATIONAL BUSINESS MACHINES",
}),
});
const data = await response.json();
console.log(data.listSanctionsMatchResult);import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class Main {
public static void main(String[] args) throws Exception {
String body = """
{
"name": "INTERNATIONAL BUSINESS MACHINES"
}
""";
HttpRequest request = HttpRequest.newBuilder(URI.create("https://www.tincomply.com/api/v1/validate/list-sanctions"))
.header("X-API-Key", "YOUR_API_KEY")
.header("Content-Type", "application/json")
.POST(HttpRequest.BodyPublishers.ofString(body))
.build();
HttpResponse<String> response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());
// Parse with your JSON library (Jackson, Gson) and read listSanctionsMatchResult.
System.out.println(response.body());
}
}package main
import (
"bytes"
"encoding/json"
"fmt"
"log"
"net/http"
)
func main() {
body := []byte(`{
"name": "INTERNATIONAL BUSINESS MACHINES"
}`)
req, err := http.NewRequest("POST", "https://www.tincomply.com/api/v1/validate/list-sanctions", bytes.NewReader(body))
if err != nil {
log.Fatal(err)
}
req.Header.Set("X-API-Key", "YOUR_API_KEY")
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)
if err != nil {
log.Fatal(err)
}
defer resp.Body.Close()
var data map[string]any
if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
log.Fatal(err)
}
fmt.Println(data["listSanctionsMatchResult"])
}$body = @'
{
"name": "INTERNATIONAL BUSINESS MACHINES"
}
'@
$response = Invoke-RestMethod -Method Post `
-Uri "https://www.tincomply.com/api/v1/validate/list-sanctions" `
-Headers @{ "X-API-Key" = "YOUR_API_KEY" } `
-ContentType "application/json" `
-Body $body
$response.listSanctionsMatchResultSample response
{
"id": "Wm3nB5vC7xZ9aS1dF2gH4jK6",
"request": {
"name": "INTERNATIONAL BUSINESS MACHINES",
"requestDate": "2026-10-01T14:02:11Z",
"requestedServices": "list-sanctions"
},
"listSanctionsMatchResult": {
"completed": true,
"anyFiltered": false,
"results": [
{
"name": "INTERNATIONAL BUSINESS MACHINES",
"type": "Organization",
"confidence": 75,
"list": "Business Identifier Code (BIC) Reference Data",
"properties": {
"names": "INTERNATIONAL BUSINESS MACHINES",
"sWIFTBIC": "IBMXUS33",
"country": "United States"
},
"related": [],
"relationships": []
}
]
}
}Errors
Requests that cannot be processed return HTTP 400 with an object keyed by field name, each listing what was wrong. Authentication, permission and other status codes are covered in Errors & service status.
This endpoint requires an API key with the Validate permission.
See how this check works in the portal and what it costs: Sanctions & OFAC Screening