Integrate in 20 lines

1. One vendor, one registered receipt

Every check prints answered or did not answer, the row count under the exact name, the source file's date and SHA-256. There is no status or risk column — your officer's rule decides.

# pip install requests — one registered receipt per vendor, signed and timestamped by the registry
import requests
KEY = "ac_live_…"   # Partner API key (Monitor tier for watches)
r = requests.get("https://alphacovenantholdings.com/api/partner/v1/screen",
                 params={"name": "Acme Government Solutions LLC", "uei": "X1Y2Z3W4V5U6"},
                 headers={"X-API-Key": KEY}, timeout=60)
rec = r.json()
print(rec["receipt_id"], rec["sha256"])                 # cite these two in the workpaper
for c in rec["checks"]:
    print(c["id"], c["state"], c.get("count"), "-", c["summary"])  # answered / did not answer — never a verdict

2. Watch your vendor master for exclusion changes

GSA publishes the exclusions extract daily; we diff file to file and push only your matches, the day GSA publishes. Monitor tier and above.

# Register a watch: a signed webhook the day a watched exact name or UEI appears in GSA's daily exclusions extract change
w = requests.post("https://alphacovenantholdings.com/api/partner/v1/exclusion-watch",
                  json={"webhook_url": "https://your-lambda.example.com/ach", "names": ["ACME GOVERNMENT SOLUTIONS LLC"], "ueis": ["X1Y2Z3W4V5U6"], "label": "AP vendor master"},
                  headers={"X-API-Key": KEY}, timeout=30).json()
SECRET = w["secret"]   # keep with your other secrets; used below to verify each delivery

3. Receive it in a Lambda or cloud function

Two headers on every delivery: X-Alpha-Covenant-Sha256 (digest of the body) and X-Alpha-Covenant-Signature (HMAC-SHA256 with your watch secret — proves the sender). Verify before you act.

# AWS Lambda (Function URL) or any HTTPS endpoint — verify, then hand the rows to your own rule
import hmac, hashlib, json, os
def handler(event, context):
    body = event["body"]                                   # raw string, exactly as received
    sent = event["headers"].get("x-alpha-covenant-signature", "")
    want = "hmac-sha256=" + hmac.new(os.environ["ACH_WEBHOOK_SECRET"].encode(), body.encode(), hashlib.sha256).hexdigest()
    if not hmac.compare_digest(sent, want):
        return {"statusCode": 401}
    msg = json.loads(body)                                 # event = "sam_exclusions_changed"
    for row in msg["added"]:    # rows that appeared in today's file under a watched name/UEI
        print("appeared:", row["name"], row["uei"], row["excluding_agency"], row["exclusion_type"], "active", row["active_from"])
    for row in msg["removed"]:  # rows that left the file (terminated/corrected — the extract does not say which)
        print("left file:", row["name"], row["uei"])
    # msg["file_sha256"] / msg["previous_file_sha256"] identify the two GSA files; msg["verify"] re-reads the batch publicly
    return {"statusCode": 200}

4. From the command line

curl -s "https://alphacovenantholdings.com/api/partner/v1/screen?name=Acme%20Government%20Solutions%20LLC&uei=X1Y2Z3W4V5U6" -H "X-API-Key: ac_live_…"
curl -s "https://alphacovenantholdings.com/api/public-record/sam-exclusions/changes?uei=X1Y2Z3W4V5U6"      # public, no key
curl -s "https://alphacovenantholdings.com/api/log/proof/r_…"                                                  # inclusion proof for any receipt

5. Make the receipt part of the transaction record

The receipt id travels with the payment or subcontract the way an invoice number does. Your document for the step is anchored by hash — it never leaves your system. At period end, one signed file statement per organization.

# At the transaction, not after: before the subcontract is signed or the grant payment is released,
# pull the receipt and store its id on YOUR record — the way an invoice number travels with a payment.
r = requests.get(f"{BASE}/api/partner/v1/screen", params={"name": vendor.legal_name, "uei": vendor.uei}, headers=H, timeout=120).json()
ap.update_vendor_bill(bill_id, custom_fields={"ac_receipt_id": r["receipt_id"], "ac_receipt_sha256": r["sha256"], "ac_read_at": r["created_at"]})

# Your own document for the step (signed 52.209-6 check, certification, memo): hash it locally, send only the hash.
import hashlib
digest = hashlib.sha256(open("subcontract_check_signed.pdf", "rb").read()).hexdigest()
a = requests.post(f"{BASE}/api/anchor", json={"sha256": digest, "label": "Signed 52.209-6 check — PO 4471", "document_date": "2026-10-20",
                                              "stage": "subaward_screening", "receipt_id": r["receipt_id"]}, headers=H, timeout=60).json()
ap.update_vendor_bill(bill_id, custom_fields={"ac_anchor_id": a["anchor_id"]})

# Period end: one signed page per organization for the file — recompute its hash and signature without us.
fs = requests.get(f"{BASE}/api/file-statement/{vendor.uei}", params={"days": 90}, timeout=120).json()
save(f"file-statement-{vendor.uei}-{fs['period']['to'][:10]}.json", fs)

These are field conventions for your own system, not connectors we sell or certify. Nothing here states that a transaction was permitted — only that the dated read and your document are on file and recomputable.

What your auditor can check without trusting us

• Recompute the receipt's SHA-256 from the JSON you hold and compare it with the registry (/api/receipts/{id}/verify).
• Fetch the inclusion proof (/api/log/proof/{id}): RFC 6962 Merkle log, signed tree heads, RFC 3161 timestamps from independent authorities.
• Export the Verifiable Credential (/api/vc/{id}, eddsa-jcs-2022) or the RFC 6283 Evidence Record for the file.
• Re-read the exclusion-change batch publicly at /exclusion-changes with both GSA file hashes.