Direct enterprise tier, not a marketplace listing

Real-time healthcare and federal compliance API for risk and vendor diligence teams

273K records across the LEIE and SAM exclusion lists and the OFAC sanctions list. REST API access for on-demand screening across all three, a daily webhook for every new LEIE exclusion, and bulk CSV on request. One flat subscription. No per-call metering.

273K records8+ source feedsDaily LEIE webhooks$999/mo flat

Month-to-month. Cancel any time from the Stripe portal. API key and webhook secret provisioned by email within one business day of payment.

Who buys this

Four buyer profiles drive the direct enterprise subscription. Each one wants the feed wired into their own systems, not a per-call dashboard.

Vendor onboarding pipelines

Verify a vendor is not on LEIE, SAM, or any state exclusion list before contracting. Wire the API into the procurement workflow and block engagement on a positive match.

Healthcare credentialing teams

LEIE, SAM exclusions and OFAC sanctions in one feed. One refresh covers what previously required three separate manual checks.

M&A counterparty diligence

Screen target-entity officers, agents, and affiliated NPIs against federal and state exclusion data. Surface issues before LOI rather than during confirmatory diligence.

Compliance SaaS embed

White-label the feed inside a downstream compliance product. Filter rules let your customers narrow to their own roster scope without exposing the full dataset.

Federal prime contractors

Screen tier-1 and tier-2 subcontractors against SAM exclusions before flowing down work. Before submitting a bid that includes teaming partners, verify none are excluded.

Sources covered

Federal exclusion lists (LEIE, SAM) plus the OFAC sanctions list. All three are searchable through the REST API. LEIE is also fingerprinted on each refresh, and records not seen before become change rows for webhook delivery.

LEIE (HHS-OIG)

List of Excluded Individuals and Entities, refreshed monthly by the OIG. 84,001 records as of the most recent pull.

Free 5K-row sample on Kaggle →

OFAC SDN (US Treasury)

Specially Designated Nationals list — individuals, entities, vessels, and aircraft under US sanctions. 19,488 records as of the most recent pull.

Free 5K-row sample on Kaggle →

SAM exclusions (GSA)

System for Award Management exclusion records covering federal debarment, suspension, and ineligibility. 169,091 records across individuals and entities.

How webhook delivery works

Customers register a webhook URL plus a filter_rules JSONB object. Once a day, every new LEIE exclusion that matches the rules is sent to the configured URL as a signed POST. A failed delivery is retried on the next two daily runs. Every attempt is logged.

example filter_rules

{
  "sources": ["LEIE"],
  "states": ["MI", "OH", "IN", "IL"],
  "npis": [
    "1234567890",
    "9876543210"
  ]
}

example webhook payload

{
  "event": "compliance.change",
  "change_id": "5f3e2c1d-7a8b-49d0-9c1e-2b3a4d5e6f7a",
  "source": "LEIE",
  "npi": "1234567890",
  "name": "EXAMPLE, PROVIDER",
  "state": "MI",
  "exclusion_type": "1128(a)(1)",
  "exclusion_date": "2026-05-14",
  "detected_at": "2026-05-20T15:41:09Z",
  "raw": { "...": "the full record as published on the source list" }
}

curl -X POST https://palavir.co/api/compliance-api/webhook-register \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "cmpl_live_...",
    "webhook_url": "https://hooks.your-domain.com/palavir",
    "filter_rules": {
      "sources": ["LEIE"],
      "states": ["MI", "OH"]
    },
    "notification_email": "compliance@your-domain.com"
  }'

Change-row schema

Every change row carries the same shape. Customers can persist the raw payload as-is or extract the fields they need into their own warehouse.

Field	Type	Description
event	string	Always compliance.change
change_id	uuid	Identifier of the change row
source	enum	LEIE
npi	string \| null	10-digit NPI when available
name	string \| null	Name as published on the source list
state	string \| null	Two-letter state code
exclusion_type	string \| null	Source-specific exclusion code
exclusion_date	date \| null	ISO date when the exclusion was effective
detected_at	timestamp	ISO 8601 UTC of when the change row was detected
raw	object	The full record as published on the source list

One flat subscription

Direct enterprise tier. No per-call metering. No marketplace middleman.

Direct enterprise

Compliance API

$999/mo

Month-to-month. Cancel from the Stripe portal at any time.

Daily webhook delivery of new LEIE exclusions
Filter rules by source, state, or NPI roster
REST API access for on-demand lookups across LEIE, SAM and OFAC
Bulk CSV of the full dataset on request
HMAC-SHA256 signed payloads on every webhook
Up to three delivery attempts, one per daily run
Every delivery attempt logged

Volume buyers and embedded resellers can request custom terms by email. For the metered marketplace tier (single-call lookups starting at $9/mo), see the exclusion screening page.

Metered marketplace tiers (RapidAPI)

Prefer per-call screening over the flat feed? The same dataset is listed on RapidAPI as a metered API. No card required for the Basic tier. All tiers include the same data; only quotas and rate limits change.

Basic

$0/mo

100/mo

Evaluation, hobby

Starter

$29/mo

1,000/mo

Small consultancy, vendor onboarding

Pro

Ultra

$299/mo

50,000/mo

Mid-market platforms

Enterprise

$999/mo

250,000/mo

Banks, fintech, KYC subprocessors

Start free on RapidAPI, 100 requests/mo

Or install an official integration: MCP server · n8n node · Pipedream

Common questions

How is this different from the RapidAPI listing?

The RapidAPI listing is a metered tier for low-volume single-call lookups. This direct enterprise tier is the same underlying dataset but delivered as unmetered REST API access, daily webhooks for new LEIE exclusions, and bulk CSV on request. It is for teams that want the data flowing into their own systems rather than a per-call screening tool.

What do the webhooks actually send?

On each LEIE refresh the system fingerprints every record. A record whose fingerprint has not been seen before becomes a change row. Once a day, subscriptions with matching filter rules receive a signed POST for each new change row. A failed delivery is retried on the next two daily runs, then left in the delivery log for inspection. SAM and OFAC are available through the REST API rather than as webhook changes.

How are payloads signed?

Every webhook delivery carries an X-Palavir-Signature header of the form sha256=hex. The signature is HMAC-SHA256 over the raw request body using the subscription secret returned at registration time. Verify the signature before processing the payload.

Can I filter to my own NPI roster?

Yes. The filter_rules object accepts npis as an array of 10-digit NPI strings. Up to 10,000 NPIs per subscription. Only changes matching any NPI in the list will fire to that webhook.

How do I cancel?

Month-to-month. Cancel from the Stripe customer portal at any time. The API key and webhook subscriptions remain active through the end of the current period and then deactivate on renewal.

Do you offer subprocessor terms for embedded products?

Yes. Standard DPA available on Enterprise. SOC 2 documentation in progress. Sub-200ms p95 latency on the screening endpoint. Designed to be embedded behind your branded product.

Is the data I submit for screening stored?

No. Screen requests do not generate identifiable records. Names submitted are not stored, not indexed, and not used to train models. Your customers' KYB data stays your own.

Wire the feed into your compliance stack

273K records. REST API. Daily signed webhooks for new LEIE exclusions. Bulk CSV on request. $999/mo flat.

Compliance API privacy policy