Real-time healthcare and federal compliance API for risk and vendor diligence teams
269K records across federal exclusions, state Medicaid, DEA, and state board discipline. Webhook delta delivery on every nightly source pull. REST API access for on-demand screening. Monthly bulk CSV. One flat subscription. No per-call metering.
Month-to-month. Cancel any time from the Stripe portal. API key and webhook secret provisioned by email within one business day of payment.
Who buys this
Four buyer profiles drive the direct enterprise subscription. Each one wants the feed wired into their own systems, not a per-call dashboard.
Vendor onboarding pipelines
Verify a vendor is not on LEIE, SAM, or any state exclusion list before contracting. Wire the API into the procurement workflow and block engagement on a positive match.
Healthcare credentialing teams
LEIE plus state Medicaid plus DEA plus state board actions in one feed. One nightly delta refresh covers what previously required four separate manual checks.
M&A counterparty diligence
Screen target-entity officers, agents, and affiliated NPIs against federal and state exclusion data. Surface issues before LOI rather than during confirmatory diligence.
Compliance SaaS embed
White-label the feed inside a downstream compliance product. Filter rules let your customers narrow to their own roster scope without exposing the full dataset.
Sources covered
Federal exclusion lists plus state Medicaid plus DEA plus state board actions. Each source is pulled, fingerprinted, and compared against the prior snapshot to produce change rows.
LEIE (HHS-OIG)
List of Excluded Individuals and Entities, refreshed monthly by the OIG. 82,749 active exclusions as of the most recent pull.
OFAC SDN (US Treasury)
Specially Designated Nationals list — individuals, entities, vessels, and aircraft under US sanctions. 19,050 records refreshed daily.
SAM exclusions (GSA)
System for Award Management exclusion records covering federal debarment, suspension, and ineligibility. 167,643 records across individuals and entities.
State Medicaid exclusions
Active sweep across published state Medicaid exclusion lists. Coverage expanding; current focus includes TX, CA, NY, FL, and additional states.
DEA registration data
DEA controlled-substance registrant data and revocation actions. Used to surface providers whose DEA authority has lapsed or been pulled.
State medical board actions
License discipline and revocation actions published by state medical and dental boards. Names, NPIs where available, and action dates.
How webhook delta delivery works
Customers register a webhook URL plus a filter_rules JSONB object. Every night, after every source refresh, any matching change rows fire to the configured URL. Three retries with exponential backoff. Signed payloads. Delivery logs retained for 90 days.
{
"sources": ["LEIE", "SAM"],
"states": ["MI", "OH", "IN", "IL"],
"npis": [
"1234567890",
"9876543210"
]
}{
"event": "exclusion.added",
"delivery_id": "evt_8c7b2f1d3e4a",
"subscription_id": "sub_a1b2c3",
"change": {
"id": "5f3e2c1d-7a8b-49d0-9c1e-2b3a4d5e6f7a",
"source": "LEIE",
"change_type": "added",
"fingerprint": "9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d",
"affected_entity": {
"name_hash": "5b4f3a2e1d0c9b8a7c6d5e4f3a2b1c0d",
"npi": "1234567890",
"state": "MI",
"exclusion_type": "1128(a)(1)",
"exclusion_date": "2026-05-14",
"source_url": "https://oig.hhs.gov/exclusions/exclusions_list.asp"
},
"detected_at": "2026-05-20T03:14:07Z"
}
}curl -X POST https://palavir.co/api/compliance-api/webhook-register \
-H "Content-Type: application/json" \
-d '{
"api_key": "cmpl_live_...",
"webhook_url": "https://hooks.your-domain.com/palavir",
"filter_rules": {
"sources": ["LEIE", "SAM"],
"states": ["MI", "OH"]
},
"notification_email": "compliance@your-domain.com"
}'Change-row schema
Every change row carries the same shape. Customers can persist the raw payload as-is or extract the fields they need into their own warehouse.
| Field | Type | Description |
|---|---|---|
| source | enum | LEIE | SAM | STATE_MEDICAID | DEA | STATE_BOARD |
| change_type | enum | added | removed | modified |
| fingerprint | string | SHA-256 of the canonical record fields |
| affected_entity.npi | string | null | 10-digit NPI when available |
| affected_entity.name_hash | string | Salted SHA-256 of the entity name |
| affected_entity.state | string | null | Two-letter state code |
| affected_entity.exclusion_type | string | null | Source-specific exclusion code |
| affected_entity.exclusion_date | date | null | ISO date when the exclusion was effective |
| affected_entity.source_url | string | URL of the originating public list |
| detected_at | timestamp | ISO 8601 UTC of when the change row was detected |
One flat subscription
Direct enterprise tier. No per-call metering. No marketplace middleman.
Compliance API
Month-to-month. Cancel from the Stripe portal at any time.
- Webhook delta delivery on every nightly source pull
- Filter rules by source, state, or NPI roster
- REST API access for on-demand lookups
- Monthly bulk CSV across the full dataset
- HMAC-SHA256 signed payloads on every webhook
- Three delivery attempts with exponential backoff
- Delivery logs retained for 90 days
Volume buyers and embedded resellers can request custom terms by email. For the metered marketplace tier (single-call lookups starting at $9/mo), see the exclusion screening page.
Common questions
How is this different from the RapidAPI listing?
What does the webhook delta pattern actually look like?
How are payloads signed?
What states are covered for Medicaid exclusions?
Can I filter to my own NPI roster?
What does name_hash mean?
How do I cancel?
Wire the feed into your compliance stack
269K records. Nightly deltas. Signed webhooks. REST API. Monthly bulk CSV. $999/mo flat.