CAGE code API: how to look up CAGE codes in code

Published 30 October 2026

A CAGE code is the five-character ID the US government uses for a supplier at a specific location. If you need to look one up in code, the documented route is SAM.gov's Entity Management API, which takes a cageCode parameter. Here's how it works, what limits you'll hit and a Python example.

What a CAGE code is

CAGE stands for Commercial and Government Entity. The Defense Logistics Agency (DLA) CAGE Branch assigns CAGE codes to US entities and keeps the CAGE master file, and a code identifies a facility at a specific location. DLA's Qualified Products Database help describes the format: five characters, letters and digits, never the letters I or O, and the fifth character is always a number.

For a business in the US, the DLA CAGE Branch assigns a CAGE code as part of SAM.gov registration (FAR 52.204-16). You can also search codes by hand on DLA's site at cage.dla.mil.

The Entity Management API

Endpoint: GET https://api.sam.gov/entity-information/v3/entities (GSA also documents v1, v2 and v4)

What GSA's documentation says:

• api_key: your Public API Key, from the Account Details page of your SAM.gov account.
• cageCode: "a single 5-character value or up to 100 values". GSA's example is a single code: cageCode=00000. Our example below looks up one code per request.
• includeSections: limits the response to the parts you need, such as entityRegistration and coreData.
• The response gives ten records per page, and the API only returns the first 10,000 records of any search.
• Each match's entityRegistration section carries cageCode, ueiSAM (the Unique Entity ID) and legalBusinessName.

Gotchas

• The daily quota is tiny for a new account. GSA's table gives a non-federal user with no role in SAM.gov 10 requests a day. A role in a registered entity raises it to 1,000. See SAM.gov API limits for the full table.
• One code per request adds up. Our example sends one CAGE code per request, so on a new key you can look up about 10 codes a day. For a long list, ask for a role in SAM.gov first.
• Not every entity is in public data. A Public API Key returns publicly available entities. GSA's documentation says entities that opted out of public display are only in the restricted (FOUO) data, which needs a federal system account. A code that returns nothing may still be valid.
• Some characters break the request. GSA lists & | { } ^ \ as not allowed inside parameter values.

Python example

Put your key in an environment variable, not in the script. This reads CAGE codes from a text file, one per line, and prints the matching entity names.

import os, requests

URL = "https://api.sam.gov/entity-information/v3/entities"
KEY = os.environ["SAM_API_KEY"]

codes = [c.strip().upper() for c in open("cage_codes.txt") if c.strip()]

def lookup(code):
    found, page = [], 0
    while True:
        r = requests.get(URL, timeout=60, params={
            "api_key": KEY,
            "cageCode": code,
            "includeSections": "entityRegistration",
            "page": page, "size": 10})
        if r.status_code == 429:
            raise SystemExit("Daily quota used up. Try again tomorrow or ask for a role in SAM.gov.")
        r.raise_for_status()
        data = r.json()
        rows = data.get("entityData") or []
        found += rows
        if not rows or len(found) >= data.get("totalRecords", 0):
            return found
        page += 1

for code in codes:                          # one code per request
    for e in lookup(code):
        reg = e["entityRegistration"]
        print(reg["cageCode"], reg["ueiSAM"], reg["legalBusinessName"], reg.get("registrationStatus"))

For a large list, GSA documents a format=csv or format=json option that turns the same search into a file extract you download later, instead of paging ten records at a time.

Outside the US: NCAGE codes

A business outside the US, including a UK business, gets an NCAGE code rather than a CAGE code. FAR 52.204-16 says SAM.gov registrants outside the US must get the NCAGE code before they register in SAM.gov. The same FAR clause says NCAGE codes come from the appropriate country codification bureau.

If you sell to UK public buyers rather than US ones, our UK Tender Desk covers live UK tenders.

We built this

Disclosure: Your Evenings Ltd built and sells this. It isn't an official government product and isn't affiliated with GSA, SAM.gov or DLA. SAM.gov Scraper: Government Contracts, Bids & Grants.gov on the Apify Store reads SAM.gov's public daily Contract Opportunities extract, so you don't need an API key for opportunities. It doesn't look up CAGE codes. It returns opportunities, and award notices include the awardee's name, which you can then check against the Entity Management API.

More on SAM.gov: SAM.gov API for contract opportunities and SAM.gov API limits.

FAQ

Is there an API for CAGE codes? Yes. SAM.gov's Entity Management API takes a cageCode parameter, for example cageCode=00000, and returns the matching registered entities. It needs a Public API Key from your SAM.gov account.

How many CAGE code lookups can I do a day? It depends on your SAM.gov account. GSA's table gives 10 requests a day for a non-federal user with no role, and 1,000 a day with a role. If you look up one code per request, a new key covers about 10 codes a day.

Why does a valid CAGE code return no results? A Public API Key only returns publicly available entities. Entities that opted out of public display are only in restricted data, which needs a federal system account.

What does a CAGE code look like? Five characters, letters and digits. DLA says it never uses the letters I or O, and the fifth character is always a number.

Written with AI assistance by the Your Evenings team at Your Evenings Ltd. Last updated 30 October 2026.

Product names and logos belong to their owners. Your Evenings Ltd is not affiliated with or endorsed by them.