Canadian sanctions API in Swift: identity review in a backend

{
  "subject": {
    "name": "Mira Calder",
    "entityType": "person",
    "birthDate": "1984"
  },
  "package": "sandbox@1",
  "retention": "standard"
}

// Swift 6. Server or trusted CLI only. Do not ship an API key in an iOS app.
import Foundation
#if canImport(FoundationNetworking)
import FoundationNetworking
#endif

struct ScreeningFailure: Error { let message: String }
final class NoRedirect: NSObject, URLSessionTaskDelegate, @unchecked Sendable {
    func urlSession(_ session: URLSession, task: URLSessionTask,
                    willPerformHTTPRedirection response: HTTPURLResponse,
                    newRequest request: URLRequest,
                    completionHandler: @escaping (URLRequest?) -> Void) { completionHandler(nil) }
}
@main struct Screen {
    static func main() async {
        do { try await run() }
        catch {
            // Do not print the request, credential, or raw response.
            FileHandle.standardError.write(Data("Screening incomplete. Check the operation before retrying.\n".utf8))
            exit(1)
        }
    }
    static func run() async throws {
        let env = ProcessInfo.processInfo.environment
        guard let key = env["SANCTIONSKIT_API_KEY"], let operation = env["SCREENING_OPERATION_ID"], !operation.isEmpty else {
            throw ScreeningFailure(message: "Missing credential or operation ID")
        }
        let path = CommandLine.arguments.count > 1 ? CommandLine.arguments[1] : "request.json"
        let raw = try Data(contentsOf: URL(fileURLWithPath: path))
        guard raw.count <= 65_536,
              let body = try JSONSerialization.jsonObject(with: raw) as? [String: Any],
              body["subject"] != nil, (body["sources"] != nil) != (body["package"] != nil) else {
            throw ScreeningFailure(message: "Invalid request object")
        }
        var request = URLRequest(url: URL(string: "https://www.sanctionskit.com/api/v1/screenings")!)
        request.httpMethod = "POST"; request.httpBody = raw
        request.setValue("Bearer \(key)", forHTTPHeaderField: "Authorization")
        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
        request.setValue(operation, forHTTPHeaderField: "Idempotency-Key")
        let configuration = URLSessionConfiguration.ephemeral
        configuration.timeoutIntervalForRequest = 25; configuration.timeoutIntervalForResource = 30
        let session = URLSession(configuration: configuration, delegate: NoRedirect(), delegateQueue: nil)
        defer { session.invalidateAndCancel() }
        // URLSession download avoids retaining an unbounded response in memory.
        let (file, response) = try await session.download(for: request)
        defer { try? FileManager.default.removeItem(at: file) }
        let size = try file.resourceValues(forKeys: [.fileSizeKey]).fileSize ?? 0
        guard size <= 8 * 1024 * 1024, let http = response as? HTTPURLResponse,
              (200..<300).contains(http.statusCode) else { throw ScreeningFailure(message: "Incomplete HTTP response") }
        let payload = try Data(contentsOf: file)
        guard let envelope = try JSONSerialization.jsonObject(with: payload) as? [String: Any],
              let data = envelope["data"] as? [String: Any], let id = data["id"] as? String, !id.isEmpty,
              let status = data["status"] as? String, ["potential_match", "no_match"].contains(status),
              let matches = data["matches"] as? [Any],
              (status == "no_match" ? matches.isEmpty : !matches.isEmpty) else {
            throw ScreeningFailure(message: "Unexpected screening response")
        }
        let summary: [String: Any] = ["id":id, "status":status, "candidateCount":matches.count]
        FileHandle.standardOutput.write(try JSONSerialization.data(withJSONObject: summary))
        FileHandle.standardOutput.write(Data("\n".utf8))
    }
}

swiftc -parse-as-library Screen.swift -o screen
./screen request.json

curl --fail-with-body --max-time 25 --header "Authorization: Bearer $SANCTIONSKIT_API_KEY" "https://www.sanctionskit.com/api/v1/sources"

{
  "subject": {
    "name": "Mira Calder",
    "entityType": "person",
    "birthDate": "1984"
  },
  "sources": [
    "ca-autonomous"
  ],
  "retention": "standard"
}