CAGE Code Lookup API: DoD Identifier to Federal Contractor Profile

5-character DoD identifier in, full federal contractor profile out. JSON, one HTTP call.

A Commercial and Government Entity (CAGE) code is the 5-character alphanumeric identifier the Defense Logistics Agency assigns to every federal contractor location. DoD contracting officers, NATO partners, and many legacy procurement systems still key transactions on CAGE rather than UEI. This endpoint takes a CAGE and returns the entity it identifies: legal name, UEI, address, NAICS, certifications, registration status.

Who this page is for: developers integrating DoD/DLA workflows where CAGE is the primary key. Contract administrators, defense subcontract teams, NSCM-aware ERP integrators, anyone who has CAGE codes in their data and needs to resolve them to a current federal contractor record.

What this page is NOT: a CAGE issuance or modification tool. CAGE codes are issued by DLA. This endpoint reads the public registration data; it doesn't write to it.

What one call returns

You pass a CAGE code. You get the same response shape as our UEI-keyed endpoint, plus a queried_cage field echoing your input so you can confirm the match.

Real response for CAGE 53YC5, trimmed to fit:

{
  "queried_cage": "53YC5",
  "uei": "C111ATT311C8",
  "registration": {
    "status": "A",
    "active": true,
    "expiration_date": "2026-06-18",
    "expiring_soon": true,
    "source_extract_date": "2026-04-05"
  },
  "entity": {
    "legal_business_name": "K & K CONSTRUCTION SUPPLY INC",
    "physical_address": {
      "city": "RANCHO CORDOVA", "state": "CA",
      "zip": "95742", "country": "USA"
    },
    "primary_naics": "444110",
    "business_types": ["2X", "8W", "A2", "HQ", "XS"],
    "business_types_labels": [
      "For Profit Organization",
      "Women-Owned Small Business (WOSB)",
      "Woman-Owned Business",
      "DOT Certified DBE",
      "Subchapter S Corporation"
    ],
    "cage_codes": ["53YC5"]
  }
}

Use cases this enables

Defense subcontract validation. Your prime contract names sub-tier suppliers by CAGE. Validate each one is currently active in SAM before order release. Combine with /api/v1/exclusions/search to check debarment status by UEI.

Legacy ERP enrichment. Your procurement system stores CAGE codes from 2005-era data when CAGE was the de facto primary key. Bulk-resolve them to current legal names, addresses, NAICS, and (especially valuable) modern UEIs. The uei field in the response gives you the bridge.

NATO supplier verification. NATO uses an extended CAGE system (NCAGE for non-US suppliers). This endpoint covers the US CAGE space. Useful when checking US-side counterparties on a NATO purchase order.

Receiving-dock reverse lookup. The packing slip has a CAGE; you need to know if it's still a valid supplier and where they're headquartered. One call, full record.

FAR-clause flow-down audit. Federal prime contractors must verify each subcontractor's small-business and socio-economic status. CAGE → entity → business_types array tells you what self-certifications the supplier has on file with SAM at the moment you check.

How to call the API

Single GET. Auth via Authorization: Bearer <api_key>.

curl -H "Authorization: Bearer $API_KEY" \
     https://govconapi.com/api/v1/entities/by-cage/53YC5

The CAGE in the path is normalized: lowercase and surrounding whitespace are accepted and converted to canonical uppercase.

Error shapes:

401: missing or invalid Authorization header
404: CAGE not found in current SAM data
429: rate limit (60/min per IP burst, 1000/hr per API key)

CAGE vs UEI: when to use which

Both identify the same underlying entity. Pick by what you have on hand:

UEI (12-char): the modern primary identifier. SAM standardized on UEI in 2022 when DUNS was retired. If you're integrating against modern SAM workflows, UEI is the canonical key. Use /api/v1/entities/{uei}.
CAGE (5-char): the long-standing DoD identifier. Most pre-2022 procurement data, NATO transactions, and DoD/DLA-internal systems still key on CAGE. Use this endpoint.

One entity can have multiple CAGE codes (one per registered facility). Most entities have exactly one. Some large institutions have many: USPS has 80, large banks similar. The cage_codes[] array in any entity response lists all CAGE codes registered to that UEI.

Combining with other endpoints

/api/v1/entities/{uei} (Developer): same data keyed by UEI instead of CAGE.
/api/v1/companies/{uei} (Pro Bundle): adds award-history aggregations to the entity profile.
/api/v1/entities/search (Developer for q; Pro for filters): find entities by name or by NAICS / state / certification combinations.
/api/v1/entities/expiring (Pro Bundle): active registrations expiring within N days. Useful when you've resolved a CAGE and want to know if the entity needs to renew soon.
/api/v1/exclusions/search?uei={uei} (Developer): debarment check on the resolved UEI.
/api/v1/vendor-risk/{uei} (Pro Bundle): seven-signal risk screening including address-cluster and name-variant matches.

What this doesn't do (data caveats)

Near-real-time, not real-time. We track SAM and refresh as upstream data publishes. In rare cases there can be up to ~30 days of latency between a registration changing on sam.gov and the change appearing here. The source_extract_date field tells you the freshness of any given record. For time-sensitive compliance decisions, verify directly with sam.gov as the system of record.

NCAGE codes for non-US suppliers are not in this dataset. NATO's extended CAGE system covers international suppliers under codes that don't appear in the US-side public SAM data we read from. If your supplier is foreign-only and has only an NCAGE, this endpoint won't resolve it.

Historical CAGE codes that have been superseded may not resolve. When DLA reassigns or retires a CAGE, the old code typically falls out of the active SAM dataset within a refresh cycle. We return 404 for those. If your records are old enough to contain superseded codes, expect some 404s.

Pricing

This endpoint is on the Developer tier ($19/mo): 1,000 requests/hour across the whole API surface, single CAGE lookup, single UEI lookup, name search, exclusions search, awards search, opportunities. Pro Bundle ($39/mo) adds award-history merge, multi-filter entity search, expiration radar, and seven-signal vendor-risk screening.

No annual contracts, no setup fees, monthly billing via Stripe. Cancel anytime.

FAQ

Can one CAGE belong to multiple entities?

No. DLA assigns each CAGE to one entity (one specific facility of one company). The reverse, multiple CAGEs per entity, is common for organizations with multiple registered locations.

What if I have a 6-character or 7-character "CAGE"?

That's likely an NCAGE (NATO) code, not a US CAGE. NCAGE is 5 characters in the same shape; codes longer than 5 are out of spec for this endpoint and will 404.

What's the difference between CAGE and DUNS?

CAGE is DoD-issued (DLA, since the 1950s). DUNS was D&B-issued and used in non-DoD federal procurement until 2022, when it was replaced by UEI. CAGE survived the transition; DUNS didn't. CAGE is still in active use across DoD and FAR-regulated procurement.

How fresh is the data?

We refresh as upstream data publishes. In rare cases there can be up to ~30 days of latency between a CAGE record updating on sam.gov and the change appearing here. The source_extract_date field tells you which snapshot the record came from.

Can I look up entities by other identifiers (DUNS, EIN, FEIN)?

No. UEI and CAGE are the only public-key lookups we support. EIN/FEIN are not in the public SAM dataset (taxpayer identification is restricted). DUNS is retired.

Is the response shape identical to the UEI-lookup endpoint?

Almost. We add a queried_cage field to the top of the response so callers can confirm which CAGE was used to resolve the entity. Everything else (registration block, entity block) is identical.