U.S. CSL API in Rust: review component list evidence

{
  "subject": {
    "name": "Example Harbor Trading",
    "entityType": "organization"
  },
  "package": "sandbox@1",
  "retention": "standard"
}

[package]
name = "sanctions-screen"
version = "0.1.0"
edition = "2021"

[dependencies]
reqwest = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls"] }
serde_json = "1"

// Trusted CLI/backend worker. Do not run blocking I/O inside an async executor task.
use reqwest::{blocking::Client, redirect::Policy};
use serde_json::{json, Value};
use std::{env, error::Error, fs, io::Read, time::Duration};

fn run() -> Result<(), Box<dyn Error>> {
    let key = env::var("SANCTIONSKIT_API_KEY")?;
    let operation = env::var("SCREENING_OPERATION_ID")?;
    if operation.is_empty() { return Err("missing operation ID".into()); }
    let path = env::args().nth(1).unwrap_or_else(|| "request.json".to_owned());
    let raw = fs::read(path)?;
    if raw.len() > 65_536 { return Err("request file exceeds 64 KiB".into()); }
    let body: Value = serde_json::from_slice(&raw)?;
    if !body.is_object() || body.get("subject").is_none() || body.get("sources").is_some() == body.get("package").is_some() {
        return Err("invalid request object".into());
    }
    let client = Client::builder().connect_timeout(Duration::from_secs(10))
        .timeout(Duration::from_secs(25)).redirect(Policy::none()).build()?;
    let response = client.post("https://www.sanctionskit.com/api/v1/screenings")
        .bearer_auth(&key).header("Idempotency-Key", operation).json(&body).send()?;
    let status_code = response.status();
    let limit = 8 * 1024 * 1024;
    let mut payload = Vec::new();
    response.take((limit + 1) as u64).read_to_end(&mut payload)?;
    if payload.len() > limit { return Err("oversized response".into()); }
    if !status_code.is_success() { return Err("screening HTTP request incomplete".into()); }
    let envelope: Value = serde_json::from_slice(&payload)?;
    let data = envelope.get("data").ok_or("missing response data")?;
    let id = data.get("id").and_then(Value::as_str).filter(|s| !s.is_empty()).ok_or("missing screening ID")?;
    let status = data.get("status").and_then(Value::as_str).ok_or("missing screening status")?;
    let matches = data.get("matches").and_then(Value::as_array).ok_or("missing matches array")?;
    if !["potential_match", "no_match"].contains(&status) ||
        (status == "no_match" && !matches.is_empty()) || (status == "potential_match" && matches.is_empty()) {
        return Err("inconsistent screening response".into());
    }
    println!("{}", json!({"id":id,"status":status,"candidateCount":matches.len()}));
    Ok(())
}
fn main() {
    if run().is_err() {
        // Do not print parser errors, submitted identity, or the raw response.
        eprintln!("Screening incomplete. Check the operation before retrying.");
        std::process::exit(1);
    }
}

cargo run -- request.json

curl --fail-with-body --max-time 25 --header "Authorization: Bearer $SANCTIONSKIT_API_KEY" "https://www.sanctionskit.com/api/v1/sources"

{
  "subject": {
    "name": "Example Harbor Trading",
    "entityType": "organization"
  },
  "sources": [
    "us-csl"
  ],
  "retention": "standard"
}