OFAC API in PHP: onboarding with cURL

{
  "subject": {
    "name": "Mira Calder",
    "entityType": "person",
    "birthDate": "1984"
  },
  "package": "sandbox@1",
  "retention": "standard"
}

<?php
// PHP 8.2+, ext-curl. Run in a backend or trusted CLI, never in browser code.
declare(strict_types=1);
try {
    $key = getenv('SANCTIONSKIT_API_KEY') ?: '';
    $operation = getenv('SCREENING_OPERATION_ID') ?: '';
    if ($key === '' || $operation === '') throw new RuntimeException('Set the API key and a persistent operation ID.');
    $raw = file_get_contents($argv[1] ?? 'request.json');
    if ($raw === false || strlen($raw) > 65536) throw new RuntimeException('Request file is missing or too large.');
    $body = json_decode($raw, true, 512, JSON_THROW_ON_ERROR);
    if (!is_array($body) || !isset($body['subject']) || (array_key_exists('sources', $body) === array_key_exists('package', $body))) {
        throw new RuntimeException('Supply a subject and exactly one of sources or package.');
    }
    $received = '';
    $curl = curl_init('https://www.sanctionskit.com/api/v1/screenings');
    if ($curl === false) throw new RuntimeException('Unable to initialize HTTP client.');
    curl_setopt_array($curl, [
        CURLOPT_POST => true, CURLOPT_POSTFIELDS => json_encode($body, JSON_THROW_ON_ERROR),
        CURLOPT_HTTPHEADER => ['Authorization: Bearer '.$key, 'Content-Type: application/json', 'Idempotency-Key: '.$operation],
        CURLOPT_FOLLOWLOCATION => false, CURLOPT_CONNECTTIMEOUT => 10, CURLOPT_TIMEOUT => 25,
        CURLOPT_SSL_VERIFYPEER => true, CURLOPT_SSL_VERIFYHOST => 2,
        CURLOPT_WRITEFUNCTION => static function ($handle, string $chunk) use (&$received): int {
            if (strlen($received) + strlen($chunk) > 8 * 1024 * 1024) return 0;
            $received .= $chunk;
            return strlen($chunk);
        },
    ]);
    $ok = curl_exec($curl);
    $status = (int) curl_getinfo($curl, CURLINFO_RESPONSE_CODE);
    curl_close($curl);
    if ($ok === false) throw new RuntimeException('Transport failed or response exceeded size limit.');
    $envelope = json_decode($received, false, 512, JSON_THROW_ON_ERROR);
    if ($status < 200 || $status >= 300) throw new RuntimeException('Screening incomplete: HTTP '.$status.'.');
    $data = is_object($envelope) ? ($envelope->data ?? null) : null;
    if (!is_object($data) || !is_string($data->id ?? null) || $data->id === '' ||
        !in_array($data->status ?? null, ['potential_match', 'no_match'], true) ||
        !is_array($data->matches ?? null)) {
        throw new RuntimeException('Incomplete response: unexpected screening shape.');
    }
    $count = count($data->matches);
    if (($data->status === 'no_match' && $count !== 0) || ($data->status === 'potential_match' && $count === 0)) {
        throw new RuntimeException('Incomplete response: inconsistent screening shape.');
    }
    echo json_encode(['id' => $data->id, 'status' => $data->status, 'candidateCount' => $count], JSON_THROW_ON_ERROR).PHP_EOL;
} catch (Throwable $error) {
    // No raw response, submitted identity, or credential is logged.
    fwrite(STDERR, 'Screening did not complete: '.get_class($error).'. Check the operation before retrying.'.PHP_EOL);
    exit(1);
}

php screen.php request.json

curl --fail-with-body --max-time 25 --header "Authorization: Bearer $SANCTIONSKIT_API_KEY" "https://www.sanctionskit.com/api/v1/sources"

{
  "subject": {
    "name": "Mira Calder",
    "entityType": "person",
    "birthDate": "1984"
  },
  "sources": [
    "ofac-sdn"
  ],
  "retention": "standard"
}