Get started › Overview

Overview

Screen people, companies and transactions against sanctions, PEP, watchlist and adverse-media data — from your own software or from the console.

AMLPRO is a screening platform. You send a name; it comes back with the records that match, the lists they came from, and a report you can keep. It covers sanctions and PEP screening, watchlist and enforcement checks, corporate registry data and adverse media, with matching rules you configure yourself.

For compliance teams, AMLPRO takes the guesswork out of a name check and leaves an audit trail behind every decision. For engineers, it is a signed REST API that answers in under a second and bills per search from a prepaid balance — no SDK, no session, no login step.

This documentation covers the whole platform: what the pieces are, how a screening runs, how to shape matching with the workflow builder, how billing and access work, and how to call the API.

To get up and running:

1. Sign in to the console — every new account starts on the free starter package.
2. Create an API credential and copy the secret key; it is shown once.
3. Sign your first request and call POST /ir-find.
4. Build a workflow so the results match your risk appetite.
5. Top up the balance and go live.

The two ways in

There are two ways to reach the same screening engine, over the same data.

Both run the same six steps, charge the same rates and write to the same usage log, so a search run by hand and a search run from your code are indistinguishable afterwards except for who ran it.

How a screening runs

One call does six things, in this order.

Workflow builder

A workflow is your own answer to which of these matches are really mine. It is a small graph: a chain of steps, each outcome wired to the next step or to one of two endings. Every candidate enters at the name step and walks until it reaches an ending.

The kinds of step

What a step can test

The steps available depend on what is being screened.

Individual

Company and organization

Adverse media takes the name step only.

Three rules, all of them fail-open

In screening, a missed match costs more than an extra one. Every rule resolves toward keeping the record.

• A step you sent no value for cannot be evaluated, so it is skipped. Sending no date of birth narrows nothing.
• A step whose field the record does not carry follows your no-value rule, which can only be carry on or include.
• An outcome wired to nothing keeps the record.

Every decision is recorded per candidate, so a record that survived because three steps were skipped is distinguishable from one that passed three checks.

Plans and balance

Screening is billed in money from a prepaid balance, per search, at the price the plan sets for that entity type.

Terms, not a subscription counter

Each period an account holds a package is its own term, with its own credit and its own rates. An account runs one package at a time; buying another ends the one running, and unspent credit tied to that term is forfeited while money never tied to it — opening balances, payments — stays with the customer. Prepaid credit is the exception: what is left on a prepaid plan moves to the balance when the plan changes, and is spent after the new plan's own credit, at the new plan's rates. Where terms overlap, the oldest one with credit left prices the next search.

What a plan sells

There are four services. A plan prices each one separately, and they are the same four you ask for as schema on a search.

Each of the four is set to one of three things on the plan:

A service is sold if any package you are running sells it, so a second package bought to add a service takes effect straight away.

Unlimited plans

A plan can sell the period instead of the searches. On one of those the fee buys the month and a search costs nothing: the balance is not read and not written, so there is no balance to run out and no 402 to hit. It still screens only what the plan sells, so an unlimited plan can be Individual-only, and a service set to not available is still refused.

The free starter

Every new account is put on a free package: Individual screening only, worth exactly 100 screenings a month, renewed monthly until the account buys something. It is granted, never sold, and has no subscription to cancel.

Volume pricing

One price list for the platform, shown on every customer's Packages page as a slider: at each monthly call volume, the price a month, the calls it includes and the rate per call. It sells nothing — its button opens a support ticket naming the volume chosen. What a search costs is still the plan's per-search price.

Roles and access

A company has one owner and any number of members. The owner always has every permission and cannot be locked out. A member gets a role.

The last row is not an oversight. The company's legal details are the account holder's own record, so they stay the owner's whatever role a member holds. The logo is not: it is the mark on their invoices and at the top of their console, and the person who runs the account day to day is usually an Admin. A company can also define its own roles from the same set of permissions.

Authentication

Every request carries three headers. There is no session, no bearer token and no login step.

The signature

Concatenate three values in this order, remove every space, and sign what is left with your secret key.

// concatenate, then delete all spaces
payload   = <subject> + inonce + ikey

// sign with the secret key, then base64
signature = base64( HMAC-SHA256( secret_key, payload ) )

<subject> is whatever the call is about:

Signing code

The same request in four languages. Switching the tab switches every sample on the page.

import base64, hashlib, hmac, time, requests

APP_KEY    = "your-app-key"
SECRET_KEY = "your-secret-key"
BASE       = "https://api.example.com"

def sign(subject: str, ikey: str, secret: str, inonce: str) -> str:
    payload = f"{subject}{inonce}{ikey}".replace(" ", "")
    digest  = hmac.new(secret.encode(), payload.encode(), hashlib.sha256).digest()
    return base64.b64encode(digest).decode()

name   = "Jane Doe"
inonce = str(int(time.time()))

response = requests.post(
    f"{BASE}/ir-find",
    headers={
        "ikey":         APP_KEY,
        "inonce":       inonce,
        "isignature":   sign(name, APP_KEY, SECRET_KEY, inonce),
        "Content-Type": "application/json",
    },
    json={
        "full_name":     name,
        "schema":        "Person",
        "percent_limit": 80,
        "result_limit":  10,
    },
    timeout=90,
)

print(response.status_code, response.json()["records_found"])

<?php
$appKey    = 'your-app-key';
$secretKey = 'your-secret-key';
$base      = 'https://api.example.com';

function amlpro_sign(string $subject, string $ikey, string $secret, string $inonce): string {
    $payload = str_replace(' ', '', $subject . $inonce . $ikey);
    return base64_encode(hash_hmac('sha256', $payload, $secret, true));
}

$name   = 'Jane Doe';
$inonce = (string) time();

$body = json_encode([
    'full_name'     => $name,
    'schema'        => 'Person',
    'percent_limit' => 80,
    'result_limit'  => 10,
]);

$ch = curl_init($base . '/ir-find');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 90,
    CURLOPT_HTTPHEADER     => [
        'ikey: '       . $appKey,
        'inonce: '     . $inonce,
        'isignature: ' . amlpro_sign($name, $appKey, $secretKey, $inonce),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS     => $body,
]);

$response = curl_exec($ch);
$status   = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

$result = json_decode($response, true);
echo $status . ' ' . $result['records_found'] . PHP_EOL;

import crypto from "node:crypto";

const APP_KEY    = "your-app-key";
const SECRET_KEY = "your-secret-key";
const BASE       = "https://api.example.com";

function sign(subject, ikey, secret, inonce) {
  const payload = `${subject}${inonce}${ikey}`.replaceAll(" ", "");
  return crypto.createHmac("sha256", secret).update(payload).digest("base64");
}

const name   = "Jane Doe";
const inonce = String(Math.floor(Date.now() / 1000));

const response = await fetch(`${BASE}/ir-find`, {
  method: "POST",
  headers: {
    ikey:           APP_KEY,
    inonce,
    isignature:     sign(name, APP_KEY, SECRET_KEY, inonce),
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    full_name:     name,
    schema:        "Person",
    percent_limit: 80,
    result_limit:  10,
  }),
});

const result = await response.json();
console.log(response.status, result.records_found);

# the signature is HMAC-SHA256 over "JaneDoe" + inonce + ikey
# compute it in your own code — this shows only the request shape

curl --request POST 'https://api.example.com/ir-find' \
  --header 'ikey: your-app-key' \
  --header 'inonce: 1790640000' \
  --header 'isignature: BASE64_HMAC_SHA256_HERE=' \
  --header 'Content-Type: application/json' \
  --data '{
    "full_name": "Jane Doe",
    "schema": "Person",
    "percent_limit": 80,
    "result_limit": 10
  }'

Credential permissions

Each credential carries its own permissions and, optionally, its own IP allowlist. A call outside them is refused even with a valid signature. These are the names you tick when you create a credential in the console.

Run a screening

Requires Name Screening. Accepts JSON or form-encoded fields. Sign the full_name.

Download a report by reference

Requires Report Download. Answers with application/pdf.

Download a report by link

Requires Report Download Link. Uses the download_url a screening returned, which expires five minutes after the search.

The record shape

Results arrive under result.AML and result.adverse_media. One record looks like this — the values are made up, the shape is not.

{
  "entity": {
    "schema":  "Person",
    "name":    "Jane Doe",
    "sources": [
      "US OFAC Specially Designated Nationals (SDN) List",
      "US Trade Consolidated Screening List (CSL)",
      "US SAM Procurement Exclusions"
    ]
  },
  "properties":     { "name": ["DOE, Jane", "Jane Doe"] },
  "topics":         ["sanction", "debarment", "export.control"],
  "person_details": { "first_name": "Jane", "last_name": "DOE" },
  "relationships": {
    "sanctions": [
      {
        "sanctioned_entity_name": "Jane Doe",
        "authority":              "Office of Foreign Assets Control",
        "program":                "EXAMPLE-01",
        "provisions":             "Block | EXAMPLE-01",
        "listing_date":           "Mon, 05 Feb 2024 00:00:00 GMT",
        "country":                "us",
        "source_url":             "https://www.treasury.gov/…"
      }
    ]
  },
  "similarity_percentage": "100.00",
  "matched_name": { "value": "Jane Doe", "type": "name" },
  "category": "AML"
}

Internal identifiers are stripped from every response — each sits beside something readable that means the same thing. Empty fields are removed rather than returned as nulls, so the absence of a key means the record does not carry it.

Status codes

A refusal from /ir-find answers with status: "failed" and a description that says what to do about it. The download routes are older and answer some refusals with status: "error" and message instead, so read both keys if you are handling all three endpoints in one place.