Every endpoint, from the spec

Pick an endpoint on the left. Parameters and request fields come straight from the OpenAPI spec, so they match what the API accepts. Response fields and examples are read from real responses. You can run any request in the sandbox with your own key. New here? Start with the quick start.

Start with restricted-party screening →

Authentication

Send your key as a Bearer token: Authorization: Bearer $CG_API_KEY. The x-api-key header works too, and server-to-server integrations can use OAuth 2.0 client credentials through POST /oauth/token.

Key	Host	Data
cg_sk_…	sandbox.api.compliancegrid.ai	Mock data, free, rate limited
cg_pk_…	api.compliancegrid.ai	Live data, billed per successful call

A key is refused on the other environment's host. See Authentication and API keys.

Errors and rate limits

Status	Meaning
400	Invalid request: malformed JSON or a field that failed validation.
401	Missing, unknown or revoked key.
403	Not subscribed to this API in this environment, or a key used on the wrong host.
404	The endpoint or record does not exist.
409	Conflict, a batch result that is not ready yet, or a request still in progress under the same Idempotency-Key.
422	Well-formed but not acceptable, for example a retired HTS code.
429	Rate limited. Wait the number of seconds in Retry-After.
5xx	Our side or a government data source. Retry with backoff. Errors are never billed.

Rate limits

Sandbox: 60 requests a minute, 1,000 a day, 10,000 a month, and 50 AI Risk scores a month.
Production: 300 requests a minute and 50,000 a day by default. Enterprise limits are agreed with our team.
Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset.
Send an Idempotency-Key on POST requests to retry safely.

Details: error codes and rate limits.