Yes, there is a SAM.gov exclusions API: GSA's Exclusions API returns public exclusion records in JSON, filtered by name, unique entity ID, classification, excluding agency and other fields, with daily limits that depend on the kind of key. For an SBA 7(a) or 504 lender it is one part of a stack: SBA requires a SAM.gov exclusions search for a defined list of people and entities, a CAIVRS check through HUD's portal for prior losses and delinquent federal debt, an OFAC check of the business and its owners, and the evidence of each in the loan file. Every one of those checks needs a list of names to run on, and the list comes from the application package, traced to every direct and indirect owner. Botminds' SBA Eligibility Screening is built around that join: its agents trace the owners, run each check on the right people and file the evidence beside the rule, and a person clears every hit.
API details are from GSA's and OFAC's own documentation; SBA requirements from SOP 50 10 8.1. Worked examples use fictional sample data in the solution.
The SBA eligibility stack in SBA Eligibility Screening: five sources, who each covers, and the proof each leaves
SAM.gov exclusions
Who it must coverApplicant; 20% owners; officers, directors, managing members, general partners; key employees; living trustor; 20% entity owners; EPC and OC. Lender staff, agents and service providers once, before their first day.
AccessWeb search, or GSA’s Exclusions API with a key
Proof in the fileEvidence of each search, “for example, a screenshot”
CAIVRS
Who it must coverThe applicant; guarantors; associates; businesses they own, operate or control
AccessHUD’s web portal; several tax IDs per search
Proof in the fileDocumentation of the check; how any loss or debt was satisfied
OFAC sanctions lists
Who it must coverThe applicant business and its owners, at application
AccessDownloadable lists and delta files; OFAC’s search tool
Proof in the fileThe result; any potential match investigated and recorded
SAFER (FMCSA)
Who it must coverApplicants that need a USDOT number
AccessWeb lookup
Proof in the fileActive USDOT number in good standing; matching physical address
The application package
Who it must coverEvery direct and indirect owner and related business
AccessRead by people, or by agents
Proof in the fileOwnership traced to 100%; size, business type, citizenship
Is there a SAM.gov exclusions API?
Yes. GSA's SAM.gov Exclusions API "will allow users to request Public Exclusion Information based on various optional request parameters," with the response "provided in the JSON format in a paginated manner" (GSA, SAM.gov Exclusions API). The production endpoint is version 4, at api.sam.gov/entity-information/v4/exclusions, called with an API key. It "returns ten records per page," "can return only the first 10,000 records," and "returns only Active records."
The parameters suit an eligibility search. A caller can search by exclusionName, which "accepts multi-text values in any order," by ueiSAM for an entity's unique ID, by classification (Individual, Firm, Vessel, Special Entity Designation), by exclusionType ("Ineligible (Proceedings Pending), Ineligible (Proceedings Completed), Prohibition/Restriction and Voluntary Exclusion") and by excluding agency. For individuals, an address can narrow a name search: when addressLine1 is sent with exclusionName, "it must match 85% of an Individual's address." A separate extract mode returns up to 1,000,000 records as a downloadable JSON or CSV file, which suits a lender that would rather screen against a local copy.
SAM.gov Exclusions API: requests a day, by kind of key
For a lender the arithmetic is comfortable once the key is right. An SBA application with nine owners, a holding company and three officers needs perhaps fifteen searches; a lender with a system account could screen sixty such applications a day before the limit. A personal key with no role, at ten requests a day, is a test key, not a production one.
Who must be searched in SAM for an SBA loan?
The applicant and a list SOP 50 10 8.1 spells out by entity type: for a corporation, "all owners of 20% or more of the corporation, and each officer and director"; for a limited liability company, "all members owning 20% or more of the company; each officer, director, and managing member"; for a partnership, all general partners, limited partners owning 20% or more and any partner involved in management; key employees; a living trustor; "The legal entity, when 20% or more ownership interest in the applicant is held by a corporation, partnership, or other form of legal entity"; and, for a property structure, both the eligible passive company and the operating company (SOP 50 10 8.1, Section A, Ch. 4, Para B).
The lender's own side is searched too, once. The lender's employees involved in any stage of an SBA loan, its agents, and for 7(a) its lender service providers and their employees are searched before "the entity or person's first day of work on SBA-related business." SBA's servicing SOP shows why it matters: SBA "may deny liability in full on a Loan guaranty if a Lender uses the services of a suspended or debarred Agent to administer the Loan at any time during the life of the Loan" (SOP 50 57 4, Ch. 25).
What proof of a SAM search must be kept?
Evidence of each required search must be in the loan file, and SBA's example is "a screenshot of the search results." The phrase "for example" leaves room for other evidence, but whatever a lender keeps has to show the same things a screenshot does: which name or ID was searched, when, in which system, and what came back, including a clean result.
An API response can carry all of that and more, if it is kept properly: the query parameters, the timestamp, the full response including an empty result set, and a readable rendering for the reviewer who will not parse JSON. A lender moving from screenshots to API calls should write that choice into its procedures and keep the rendering with the file. What fails a review is not the format but the gap: a search run on the three owners the application listed when the documents named nine.
The SAM.gov exclusions API in four numbers
10
records per page in a synchronous response
10,000
records a synchronous query can return
1,000,000
records an extract can return as a JSON or CSV file
85%
address match needed to return an individual’s address with a name search
How do lenders check CAIVRS?
Through HUD's CAIVRS web portal, which SOP 50 10 8.1 points lenders to at entp.hud.gov/caivrs. "CAIVRS allows the SBA Lender to enter multiple tax identification numbers (either SSN or EIN) to conduct a search in connection with a loan application," and "SBA Lenders must retain documentation of the CAIVRS check in the loan file." The check answers two eligibility tests: a prior loss to the government by the applicant or any business it or its associates own, operate or control, and delinquent federal debt of the applicant, any guarantor or associate.
CAIVRS differs from the other two sources in one useful way: it searches by tax identification number, not by name, so a result belongs to a person or business without the name-matching that SAM.gov and OFAC require. The cost is that the lender needs every owner's and guarantor's SSN or EIN, which is one more reason the ownership tree has to be complete before the screens run.
Can CAIVRS be automated?
Partly. SBA's SOP describes CAIVRS only as a web portal and gives no machine interface, so a lender should treat the query itself as a supervised step under its own HUD access, not as a background API call. What can be automated is everything around it: knowing whose tax IDs must be entered, assembling them from the package, recording the result against each person, and comparing a hit with the person's Form 1919 answer on federal debt.
That comparison is where the value is. In the sample file, CAIVRS returned a HUD claim on a 21% indirect owner who was also a guarantor, and his Form 1919 said "No" to the federal-debt question. The CAIVRS result alone makes the application ineligible until HUD clears the claim; the contradiction with the form makes a corrected Form 1919 a second item to clear.
The SBA eligibility stack, by how each source is reached and joined
| Source | How it is reached | Matched on | Who decides a hit |
|---|---|---|---|
| SAM.gov exclusions | Web search, or the Exclusions API with a personal or system key | Name, unique entity ID; address for individuals | The compliance officer, from the exclusion record’s details |
| CAIVRS | HUD’s web portal, as SBA’s SOP describes it | SSN or EIN | The underwriter, once the agency’s clearance is in the file |
| OFAC | Sanctions List Service downloads and delta files; OFAC’s search tool | Name, with aliases, dates of birth, IDs in the listing | The compliance officer, under the bank’s sanctions procedures |
| SAFER | FMCSA web lookup | USDOT number | The underwriter |
| Application package | Read by people or agents | Document and page | The underwriter, on each traced owner and affiliate |
The joins an agent can make, and the ones a person must
An agent can make every join that a document or an identifier settles; a person must make every join that rests on resemblance. Matching a CAIVRS result to an owner by SSN, or a SAM.gov record to an entity by its unique ID, is mechanical. Deciding that "J. Ridgeway" on an exclusion record in another state is or is not the guarantor is judgement, and OFAC's own guidance says so: reviewers should compare "all of the details in the OFAC listing" with what they know, because "Many potential matches identified through screening are false positives" (OFAC FAQ 5).
The federal government's own experience points the same way. GAO, reviewing SBA's pandemic data analytics, identified "over 3.7 million unique recipients with fraud indicators out of a total of 13.4 million," and was careful to add: "They are not proof of fraud" (GAO-23-105331). An indicator is the end of an agent's job and the start of a person's.
SBA Eligibility Screening's government records check: who joins what
Agent
Entity document readerBuilds the list of people and entities to search from the traced ownership tree, with their roles and shares.
Never: Adds a person without a document.
Agent
Government records checkerRuns SAM.gov exclusions for the SOP’s list of parties, OFAC for the business and owners, and prepares each person’s CAIVRS search by tax ID; records every result, clean or not.
Never: Clears a hit without the agency’s clearance.
Agent
Ownership and citizenship verifierSets each hit beside the person’s Form 1919 answers, certifications and identifiers, and flags contradictions.
Never: Decides a name match is the same person.
A person decides
Compliance officerDecides whether each potential match is valid, and takes the second look on every cleared hit.
A person decides
SBA underwriterTreats a valid hit as an eligibility failure until cleared, and signs the determination.
What systems does SBA eligibility screening use?
Five sources and one place to put the results. The sources are the application package, SAM.gov exclusions, CAIVRS, OFAC's lists and, for motor carriers, FMCSA's SAFER. The results go into the loan file the lender keeps, while the SBA Loan System receives the ownership data and the lender's certifications. SBA's own 2023–25 screen shows what happens when the stack is all databases and no documents: it drew on "Treasury's Do Not Pay list, an online data compilation and analytics provider's evaluation of businesses and principals, and the business' credit," and never tested size or for-profit status (SBA OIG Report 26-07).
Where the stack ends: the eligibility checklist, every line with its source
Building the stack: a checklist for IT and operations
The integration work is modest; the discipline is not. Most of the checklist below is about what gets saved and who sees it, because the purpose of the stack is a file a purchase reviewer can read years later.
Integrating SAM.gov, CAIVRS and OFAC for SBA eligibility
- Get the right SAM.gov key
A system account key for production; personal keys without a role are limited to ten requests a day.
- Save every search, including clean ones
Query, timestamp, full response and a readable rendering, filed against the person searched.
- Generate the search list from the traced owners
By entity type, as SOP 50 10 8.1 lists the parties; never from the application’s owner list alone.
- Screen the lender’s own people once
Employees on SBA loans, agents and service providers, before their first day.
- Run CAIVRS as a supervised step
Under the lender’s HUD access, with every owner’s and guarantor’s tax ID assembled first.
- Track OFAC list versions
Record which list version or delta file each screen used.
- Route every potential match to a person
With the listing’s details and the applicant’s identifiers side by side.
- Re-run before closing
Core requirements apply through closing and disbursement.
- Keep access and settings changes on an audit trail
So the lender can show which procedure applied to a file.
The file the stack produces: cleared items, signatures and the certification
SBA Eligibility Screening is the layer that turns the stack into an eligibility file: it decides whose names go to which source, runs the checks it can, prepares the one it cannot run unattended, keeps every result as the source of a checklist line, and stops at every hit. It does not replace the bank's sanctions platform or its HUD access, and it does not submit anything to the SBA Loan System. The gap between OFAC tools and the SBA check and the eight-week go-live plan cover the buying and the rollout. To see the stack on your own applications, start from SBA Eligibility Screening.
Questions people ask
Does the SAM.gov exclusions API need an account?
Yes. A registered SAM.gov user generates a personal API key on the Account Details page; a system account key needs a registration tied to an entity, a request through the System Accounts workspace and GSA's approval. Limits run from ten requests a day for a personal key with no role to 1,000 for a non-federal system.
Is a screenshot required for a SAM.gov search on an SBA loan?
SOP 50 10 8.1 requires evidence of the search in the loan file and gives a screenshot as an example. A lender using the API should keep equivalent evidence, the query, timestamp and result, and say in its procedures that it does.
Does the SAM.gov API show inactive exclusions?
No. GSA's documentation says the API "returns only Active records." That suits an eligibility check, which asks whether a party is excluded now, but a lender should record the date of each search so the result can be tied to the application.
Can OFAC's lists be screened locally?
Yes. OFAC's Sanctions List Service offers the SDN and consolidated lists for download, customised datasets and an archive of published delta files, so a lender can screen against a local copy and record the version used.
Who must CAIVRS cover for an SBA loan?
The applicant, guarantors and associates, and businesses the applicant or its associates own, operate or control, for both prior loss and delinquent federal debt. A supplemental guarantor is excepted from the delinquent-debt test.