> ## Documentation Index > Fetch the complete documentation index at: https://docs.usecroma.com/llms.txt > Use this file to discover all available pages before exploring further. # CGU Sanctions Search > Search Brazil's federal integrity registers kept by the Controladoria-Geral da União (CEIS, CNEP, CEAF, CEPIM and the leniency agreements) by free text over every name the register gives the party, by CNPJ or CPF (exact; CPFs come back masked), register, party type and the sanctioning body's state. One row per sanction, by name, pages of up to 50. Served by Croma (`as_of` says how current the data is), brought up to date daily. **Dataset endpoint**: answers from the whole source in milliseconds and carries `as_of`. ## OpenAPI ````yaml /api-reference/openapi.json post /br/cgu/sanctions-search/v1 openapi: 3.1.0 info: title: Croma Marketplace API version: 1.0.0 description: >- Government-data APIs for Colombia, Peru, Mexico, and global web search. Croma normalizes public-sector data into structured JSON for product teams and AI agents. Every operation is a POST with a JSON body and an organization API key as a bearer token; every operation is an idempotent lookup and accepts an optional `Idempotency-Key` header. Paths carry their major version (`/v1`); the versioning and deprecation policy, including the `Deprecation` and `Sunset` headers a retiring endpoint sends, is at https://docs.usecroma.com/versioning. Rate limits are per organization and reported on every response (`RateLimit-Policy`, `X-RateLimit-*`): https://docs.usecroma.com/rate-limits. termsOfService: https://usecroma.com/en/terms contact: name: Croma support url: https://usecroma.com/en/support email: tomas@usecroma.com servers: - url: https://api.croma.run security: [] paths: /br/cgu/sanctions-search/v1: post: tags: - Brazil - Controladoria-Geral da União (CGU) summary: CGU Sanctions Search description: >- Search Brazil's federal integrity registers kept by the Controladoria-Geral da União (CEIS, CNEP, CEAF, CEPIM and the leniency agreements) by free text over every name the register gives the party, by CNPJ or CPF (exact; CPFs come back masked), register, party type and the sanctioning body's state. One row per sanction, by name, pages of up to 50. Served by Croma (`as_of` says how current the data is), brought up to date daily. **Dataset endpoint**: answers from the whole source in milliseconds and carries `as_of`. operationId: cgu_sanctions_search parameters: - $ref: '#/components/parameters/IdempotencyKey' requestBody: required: true content: application/json: schema: type: object required: [] properties: query: type: string maxLength: 200 default: '' description: Palabras a buscar en los nombres (opcional). document_number: type: string pattern: >- ^(?:\d{11}|\d{14}|\d{3}\.\d{3}\.\d{3}-\d{2}|\d{2}\.\d{3}\.\d{3}\/\d{4}-\d{2})?$ default: '' description: >- CPF o CNPJ de la parte sancionada, con o sin puntuación, p. ej. `12.345.678/0001-90` (opcional). Coincidencia exacta. list: type: string enum: - '' - ceis - cnep - ceaf - cepim - leniency default: '' description: >- Registro: `ceis` (inidóneas y suspendidas), `cnep` (Ley Anticorrupción), `ceaf` (servidores federales expulsados), `cepim` (entidades sin fines de lucro impedidas), `leniency` (acuerdos de lenidad) (opcional). party_type: type: string enum: - '' - individual - company default: '' description: >- Tipo de parte: `individual` (persona) o `company` (empresa u organización) (opcional). sanctioning_body_state: type: string pattern: ^(?:[A-Za-z]{2})?$ default: '' description: >- Sigla del estado (UF) del órgano que impuso la sanción, p. ej. `SP` (opcional). No es el estado de la parte. page: type: integer minimum: 1 maximum: 1000 default: 1 description: 1-based page number for paginated results. per_page: type: integer minimum: 1 maximum: 50 default: 20 description: Resultados por página (1-50). additionalProperties: false example: query: construtora list: ceis per_page: 10 responses: '200': description: Successful response headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' Idempotency-Key: $ref: '#/components/headers/Idempotency-Key' Deprecation: $ref: '#/components/headers/Deprecation' Sunset: $ref: '#/components/headers/Sunset' X-RateLimit-Limit: $ref: '#/components/headers/X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/X-RateLimit-Reset' X-Cache: $ref: '#/components/headers/X-Cache' content: application/json: schema: $ref: '#/components/schemas/CguSanctionsSearchResponse' '400': description: Invalid request body headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' Idempotency-Key: $ref: '#/components/headers/Idempotency-Key' Deprecation: $ref: '#/components/headers/Deprecation' Sunset: $ref: '#/components/headers/Sunset' content: application/json: schema: $ref: '#/components/schemas/ApiError' '401': description: Missing or invalid API key headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' Idempotency-Key: $ref: '#/components/headers/Idempotency-Key' Deprecation: $ref: '#/components/headers/Deprecation' Sunset: $ref: '#/components/headers/Sunset' content: application/json: schema: $ref: '#/components/schemas/ApiError' '429': description: Rate limit exceeded headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' Idempotency-Key: $ref: '#/components/headers/Idempotency-Key' Deprecation: $ref: '#/components/headers/Deprecation' Sunset: $ref: '#/components/headers/Sunset' X-RateLimit-Limit: $ref: '#/components/headers/X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/X-RateLimit-Reset' Retry-After: $ref: '#/components/headers/Retry-After' content: application/json: schema: $ref: '#/components/schemas/ApiError' '500': description: Internal error headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' Idempotency-Key: $ref: '#/components/headers/Idempotency-Key' Deprecation: $ref: '#/components/headers/Deprecation' Sunset: $ref: '#/components/headers/Sunset' content: application/json: schema: $ref: '#/components/schemas/ApiError' '502': description: Upstream source returned an error headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Policy: $ref: '#/components/headers/RateLimit-Policy' Idempotency-Key: $ref: '#/components/headers/Idempotency-Key' Deprecation: $ref: '#/components/headers/Deprecation' Sunset: $ref: '#/components/headers/Sunset' content: application/json: schema: $ref: '#/components/schemas/ApiError' security: - bearerAuth: [] externalDocs: description: Interactive documentation and examples url: https://docs.usecroma.com/guides/brazil/cgu components: parameters: IdempotencyKey: name: Idempotency-Key in: header required: false description: >- Optional client-chosen key for this request (any string up to 255 characters, e.g. a UUID). Every Croma operation is an idempotent lookup: repeating a request with the same body returns the same result and creates nothing, so retrying after a timeout or network failure is always safe. The key is echoed back in the `Idempotency-Key` response header so you can correlate a retry with its first attempt. Each attempt that reaches the API counts against the rate limit. schema: type: string maxLength: 255 example: 0f8e9a42-6b7c-4d1e-9a3f-2c5d7e8f9a0b headers: X-Request-Id: description: Unique id for the request (req_…). Include it in support reports. schema: type: string RateLimit-Policy: description: >- Quota policy for this endpoint as an IETF RateLimit-Policy structured field, e.g. `"default";q=100;w=86400` (100 requests per 86400-second window per organization). Endpoints with an extra hourly ceiling list both policies, e.g. `"webSearch";q=10;w=3600, "default";q=100;w=86400`. Present on every response, including 401 and 429. schema: type: string example: '"default";q=100;w=86400' Idempotency-Key: description: >- The `Idempotency-Key` the request carried, echoed back unchanged. Absent when the request sent none. schema: type: string Deprecation: description: >- Present only on an endpoint version scheduled for removal: the date the deprecation took effect (RFC 9745). A `Sunset` header and a `Link` with `rel="successor-version"` accompany it. Policy: https://docs.usecroma.com/versioning schema: type: string example: '@1767225600' Sunset: description: >- Present only on an endpoint version scheduled for removal: the date after which it answers 410 (RFC 8594). Announced in the changelog at least 90 days ahead. schema: type: string format: date-time example: Wed, 01 Apr 2026 00:00:00 GMT X-RateLimit-Limit: description: Requests allowed in the current window. schema: type: integer X-RateLimit-Remaining: description: Requests left before you are throttled. schema: type: integer X-RateLimit-Reset: description: ISO 8601 timestamp when the window resets. schema: type: string format: date-time X-Cache: description: HIT or MISS. Cached hits still count against your quota. schema: type: string enum: - HIT - MISS Retry-After: description: Seconds to wait before retrying. schema: type: integer schemas: CguSanctionsSearchResponse: type: object required: - data properties: data: $ref: '#/components/schemas/CguSanctionsSearchData' ApiError: type: object required: - error properties: error: type: object required: - type - code - message properties: type: type: string description: >- Broad category: invalid_request_error, authentication_error, not_found_error, rate_limit_error, upstream_error, api_error. code: type: string description: Machine-readable specific code. message: type: string description: Human-readable explanation, safe to surface in UI. param: type: string description: Field that triggered the error. Present on validation errors. details: type: object description: Free-form structured detail. CguSanctionsSearchData: type: object properties: as_of: anyOf: - type: string - type: 'null' description: How current the data in this response is. query: type: string list: anyOf: - type: string - type: 'null' party_type: anyOf: - type: string - type: 'null' sanctioning_body_state: anyOf: - type: string - type: 'null' total: type: number description: Sanctions matching the filters, across every page. page: type: number per_page: type: number total_pages: type: number count: type: number sanctions: type: array items: type: object properties: id: type: string description: >- The register and CGU's own code, joined by a hyphen, e.g. `ceis-72529`: the key. list: type: string enum: - ceis - cnep - ceaf - cepim - leniency description: '`ceis`, `cnep`, `ceaf`, `cepim` or `leniency`.' sanction_code: type: string description: >- CGU's own code for the sanction; the agreement number for a non-profit's bar; the agreement id for a leniency agreement. party_type: anyOf: - type: string enum: - individual - company - type: 'null' description: >- `individual` or `company`; null for a foreign or unidentified party. document_type: anyOf: - type: string enum: - cpf - cnpj - foreign - type: 'null' description: >- What `document` is: a Brazilian CPF, a CNPJ, or a foreign identifier. document: anyOf: - type: string - type: 'null' description: >- The party's document as it can be shown: a CNPJ in full (`12.345.678/0001-90`), a CPF masked the way CGU masks it (`***.456.789-**`), a foreign identifier as published. name: type: string description: The party's name as the register records it. names: type: array items: type: string description: >- Every name the register gives the party (as sanctioned, as the sanctioning body reported it, the company's registered and trade names), for search. sanction_type: anyOf: - type: string - type: 'null' description: >- The kind of sanction, as CGU words it, e.g. `Suspensão`, `Multa`, `Demissão`, `Declaração de Inidoneidade sem prazo determinado`. start_date: anyOf: - type: string - type: 'null' description: '`yyyy-mm-dd` the sanction started.' end_date: anyOf: - type: string - type: 'null' description: >- `yyyy-mm-dd` the sanction's term ends, when it has one. A past date does not mean the sanction has ended: CGU removes a sanction from the register when it ends. publication_date: anyOf: - type: string - type: 'null' description: '`yyyy-mm-dd` the sanction was published.' final_judgment_date: anyOf: - type: string - type: 'null' description: >- `yyyy-mm-dd` the decision became final (trânsito em julgado), for a court-imposed sanction. information_date: anyOf: - type: string - type: 'null' description: '`yyyy-mm-dd` the sanctioning body reported it.' publication: anyOf: - type: string - type: 'null' description: >- Where the sanction was published, e.g. `Diário Oficial da União`. publication_detail: anyOf: - type: string - type: 'null' scope: anyOf: - type: string - type: 'null' description: How far the sanction reaches (abrangência), as CGU words it. sanctioning_body: anyOf: - type: string - type: 'null' description: >- The body that imposed the sanction; for a non-profit's bar, the ministry that granted the transfer. sanctioning_body_state: anyOf: - type: string - type: 'null' description: >- Two-letter state (UF) of the sanctioning body, not of the party; null for a federal body. sanctioning_body_sphere: anyOf: - type: string enum: - federal - state - municipal - type: 'null' description: '`federal`, `state` or `municipal`.' legal_basis: anyOf: - type: string - type: 'null' description: The legal basis the sanctioning body cites. process_number: anyOf: - type: string - type: 'null' description: The administrative or court process the sanction came from. information_source: anyOf: - type: string - type: 'null' description: >- Where CGU received the sanction from, e.g. `Conselho Nacional de Justiça (CNJ-DF)`. notes: anyOf: - type: string - type: 'null' fine_amount: anyOf: - type: number - type: 'null' description: The fine in reais, for a fine under the Anti-Corruption Law. reason: anyOf: - type: string - type: 'null' description: Why a non-profit is barred from federal transfers. public_servant: anyOf: - type: object properties: position: anyOf: - type: string - type: 'null' description: The permanent post the servant held (cargo efetivo). role: anyOf: - type: string - type: 'null' description: The appointed role or function, when there was one. unit: anyOf: - type: string - type: 'null' description: The federal body the servant worked in. act_number: anyOf: - type: string - type: 'null' description: The number of the act that imposed the penalty. required: - position - role - unit - act_number - type: 'null' description: Set only for an expelled federal servant. agreement: anyOf: - type: object properties: status: anyOf: - type: string - type: 'null' description: '`Em Execução` or `Cumprido`, as CGU words it.' terms: anyOf: - type: string - type: 'null' description: The agreement's terms, as CGU summarises them. effects: type: array items: type: object properties: effect: type: string description: >- What the agreement grants, as CGU words it, e.g. an exemption from a declaration of unfitness. detail: anyOf: - type: string - type: 'null' required: - effect - detail description: What the agreement grants the company. required: - status - terms - effects - type: 'null' description: Set only for a leniency agreement. required: - id - list - sanction_code - party_type - document_type - document - name - names - sanction_type - start_date - end_date - publication_date - final_judgment_date - information_date - publication - publication_detail - scope - sanctioning_body - sanctioning_body_state - sanctioning_body_sphere - legal_basis - process_number - information_source - notes - fine_amount - reason - public_servant - agreement required: - as_of - query - list - party_type - sanctioning_body_state - total - page - per_page - total_pages - count - sanctions securitySchemes: bearerAuth: type: http scheme: bearer description: 'Use Authorization: Bearer YOUR_API_KEY' ````