Vendor Risk Assessment

SEC data, sanctions screening, domain security — answers 'should we do business with this company?' in one call.

7 steps x402 eligible vendor-risk-assess

What it runs

US Company Data
Source: SEC EDGAR (US Securities and Exchange Commission)
Sanctions Check
Source: Dilisense consolidated (OFAC SDN, EU FSF, UN SC, UK Sanctions List, CH SECO, BIS, World Bank, EBRD, ADB + 125 national sanctions/debarment lists; full attribution at https://dilisense.com/en/sources/sanction-sources)
WHOIS Lookup
Source: WHOIS protocol (ICANN-accredited registrar databases)
DNS Lookup
Source: DNS protocol (authoritative nameservers)
SSL Certificate Check
Source: TLS handshake (X.509 certificate from target server)
Domain Reputation
Source: Threat intelligence feeds (multi-source scoring)
Security Header Check
Source: HTTP response headers from target server (CSP, HSTS, X-Frame-Options)

The answer returns every step’s result, so your agent can show or check each one.

Inputs

Field	Type	Required	What it is
`domain`	string	Yes	Company domain to assess
`company`	string	Yes	Company name, CIK, or ticker

How to call it

# Needs an API key. The whole check is charged once, at the listed price.
curl -X POST https://api.strale.io/v1/solutions/vendor-risk-assess/execute \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "inputs": {
      "domain": "apple.com",
      "company": "Apple Inc"
    },
    "max_price_cents": 180
  }'

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i -X POST https://api.strale.io/x402/v2/solutions/vendor-risk-assess \
  -H 'Content-Type: application/json' \
  -d '{
    "domain": "apple.com",
    "company": "Apple Inc"
  }'

The bundle’s published example input.

Limitations

Coverage varies by state — Delaware, California, New York most complete. Some states have limited electronic registry access
From step: US Company Data
What to do instead: For states with limited coverage, supplement with the state's Secretary of State website directly
Name and ticker searches find SEC filings mentioning the query, which can belong to another company, particularly for private companies without filings. Low-confidence matches return an error by default; accepted matches report exact or high `match_confidence`.
From step: US Company Data
What to do instead: Supply the CIK directly for an exact, unambiguous lookup. To receive the best-effort match for an unresolved name anyway, pass allow_low_confidence=true and gate on the returned is_exact_match / match_confidence fields yourself.
Does not include privately held financial data — only publicly filed information
From step: US Company Data
What to do instead: Request privately held financial information directly from the company.
Secretary of State filings may lag 1-5 business days behind actual filing date
From step: US Company Data
What to do instead: For time-critical checks, compare the filing_date in the response against SEC EDGAR for publicly traded companies
Sanctions lists updated daily from OFAC, EU, and UN sources — newly sanctioned entities may take up to 24 hours to appear
From step: Sanctions Check
What to do instead: For same-day compliance, subscribe to OFAC's RSS feed and cross-reference against today's additions
Name matching uses fuzzy logic — common names may produce false positives. Always verify flagged results
From step: Sanctions Check
What to do instead: Filter results by match confidence score and verify flagged entities against the primary sanctions list PDF
Some registrars rate-limit WHOIS queries — bulk lookups may see slower response times
From step: WHOIS Lookup
What to do instead: Batch lookups with 1-2 second delays between requests, or use the RDAP protocol endpoint when available
GDPR-redacted registrations (common for EU domains) show limited registrant information
From step: WHOIS Lookup
What to do instead: Use the abuse contact email from the WHOIS response to request registrant details through the registrar's disclosure process
Results reflect current DNS propagation — recent changes may take up to 48 hours to appear
From step: DNS Lookup
What to do instead: Query the authoritative nameserver directly (returned in the NS records) to see changes before full propagation
Checks the certificate presented on port 443 only — does not verify non-standard TLS configurations
From step: SSL Certificate Check
What to do instead: For services on non-standard ports, use ssl-certificate-chain with the specific hostname:port combination
Reputation scores aggregate multiple blocklists — a single listing may not indicate actual malicious activity
From step: Domain Reputation
What to do instead: Check which specific blocklist flagged the domain in the response details and verify the listing reason before blocking
Blocklist data refreshed daily — recently resolved issues may still show negative reputation for 24-48 hours
From step: Domain Reputation
What to do instead: If a domain was recently cleaned, re-check after 48 hours and use the trend direction to assess improvement
Checks HTTP security headers only — does not assess server configuration, TLS settings, or application-level vulnerabilities
From step: Security Header Check
What to do instead: Combine with ssl-check for TLS assessment and use a full DAST scanner for application-level security testing