Guide · Croatia · Lookup and validation

Croatia company data API: look up and validate an MBS or an OIB

A customer types an MBS, an OIB, a Croatian VAT number or the first letters of a name; your form fills in the legal name, legal form, status and registered address from the Croatian court register (Sudski registar). One key, and the same response shape as every other country the API covers.

What you get, and what you do not

Company records from the Croatian court register (Sudski registar): legal name, legal form, status, registered address, activity code and dates; with register-change events and monitoring, but no officers and no registry-compliance signal (corporate insolvency notices are linked by MBS), and sole traders (trgovac pojedinac) are never served.

That is the record of a Croatian company as an onboarding form, an invoice or a CRM row needs it. If you need board members, financial statements of companies that are not listed, or a change history from before 2026-09-30 for Croatia, this is not the API for it. If you want to know what the register itself is, start with What is the Sudski registar? (also na hrvatskom).

What the Croatian record gives your product

• Exact match on the MBS. company_number=080000604 with country=HR. A dropped leading zero is restored. The check digit is advisory, because the register itself documents a few legacy numbers that fail it: the API validates the format, and a number of the wrong length is a 400 validation error, so a typo never looks like a missing company.
• Exact match on the OIB. oib=27759560625 with country=HR. The ISO 7064 MOD 11,10 check digit is verified server-side, and an OIB that fails it is a 400.
• The VAT number as an alias. vat=HR27759560625 reaches the same company through its OIB. The Croatian VAT number is HR plus the OIB.
• Autocomplete by name. ?name= is a normalised, partial match ranked by a match score. Call it on every keystroke; each call is one request.
• The fields a form needs. Legal name, legal form, status, registered address, postal code and city, the NKD 2025 activity code where it is published, the founding date, the share capital with its currency, the year of the last annual accounts and the OIB.
• The register's own state. A company in bankruptcy, in a pre-bankruptcy settlement or in liquidation carries that in status and is not served as plain active.
• One schema for every country. The same response shape as country=ES|FR|GB|IE|PL|NO|FI|SE|BE|HR|DK|EE|SK|CH|LV|CY|RO|US|LT|CA|AU|JP|IL|SG|CO|TW|BR|CZ|DE|AR|UA|RS|SI|EC|NL|CL|NL|MX.

Validate before you call

The OIB check digit is an ISO 7064 MOD 11,10 digit over the first ten digits, which makes an OIB one of the identifiers you can reject offline, in your own code, before it costs a call. An MBS uses the same kind of check digit, but treat a mismatch as a warning and not a rejection: the register itself documents a few legacy numbers that fail it. The identifier validator runs the same arithmetic in the browser; this is the version to paste into a form handler:

// OIB: 11 digits, an ISO 7064 MOD 11,10 check digit over the first ten
export function checkOib(input) {
  const digits = String(input).replace(/[\s.-]/g, '')
  if (!/^\d{11}$/.test(digits)) return null
  let t = 10
  for (let i = 0; i < 10; i++) {
    t = (Number(digits[i]) + t) % 10
    if (t === 0) t = 10
    t = (t * 2) % 11
  }
  return (11 - t) % 10 === Number(digits[10]) ? digits : null
}

// MBS: 9 digits, or 8 when a spreadsheet dropped the leading zero. The check digit is advisory, so shape only.
export function normaliseMbs(input) {
  const digits = String(input).replace(/[\s.-]/g, '')
  return /^\d{8,9}$/.test(digits) ? digits.padStart(9, '0') : null
}

checkOib('27759560625')   // '27759560625'  (INA - Industrija nafte d.d.)
checkOib('27759560626')   // null: the check digit should be 5
normaliseMbs('80000604')  // '080000604'

A passing check digit says the number is well-formed, never that the company exists or is still registered. That is what the lookup is for.

Four calls

# 1. By MBS
curl -H "Authorization: Bearer rk_live_..." \
  "https://api.prometiam.com/functions/v1/risk-api/companies/search?company_number=080000604&country=HR"

# 2. By OIB
curl -H "Authorization: Bearer rk_live_..." \
  "https://api.prometiam.com/functions/v1/risk-api/companies/search?oib=27759560625&country=HR"

# 3. By the VAT number
curl -H "Authorization: Bearer rk_live_..." \
  "https://api.prometiam.com/functions/v1/risk-api/companies/search?vat=HR27759560625&country=HR"

# 4. By name, for a type-ahead field
curl -H "Authorization: Bearer rk_live_..." \
  "https://api.prometiam.com/functions/v1/risk-api/companies/search?name=ina&country=HR&limit=5"

To resolve a list, POST /companies/lookup takes up to 100 items in one call, each one counted as one request:

curl -X POST "https://api.prometiam.com/functions/v1/risk-api/companies/lookup" \
  -H "Authorization: Bearer rk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"items":[{"country":"HR","company_number":"080000604"},{"country":"HR","vat":"HR27759560625"},{"country":"HR","name":"INA"}]}'

The search returns the record's id; pass it to GET /companies/{id} for the detail.

An autocomplete endpoint in Node

Your server keeps the key and proxies the search; the form calls your server. A well-formed OIB goes to the oib filter, a well-formed MBS to company_number, anything else is a name, and a malformed number is rejected before it costs a call:

// server: /api/hr-company?q=...   (keep the key out of the browser)
app.get('/api/hr-company', async (req, res) => {
  const q = String(req.query.q || '').trim()
  const looksLikeId = /^[\d\s.-]+$/.test(q)
  const oib = looksLikeId ? checkOib(q) : null
  const mbs = looksLikeId && !oib ? normaliseMbs(q) : null
  if (looksLikeId && !oib && !mbs) return res.status(422).json({ error: 'That is not a valid MBS or OIB' })

  const params = new URLSearchParams({ country: 'HR', limit: '6', ...(oib ? { oib } : mbs ? { company_number: mbs } : { name: q }) })
  const r = await fetch('https://api.prometiam.com/functions/v1/risk-api/companies/search?' + params,
    { headers: { Authorization: 'Bearer ' + process.env.PROMETIAM_API_KEY } })
  const { data } = await r.json()
  res.json(data.map(c => ({ id: c.id, name: c.company_name, mbs: c.company_number, oib: c.oib, form: c.legal_form,
    status: c.status, city: c.city, postal_code: c.postal_code, address: c.address })))
})

What Croatia does not carry

• Officers and board members. Not part of the Croatian record.
• Gazette notices. The register-change events are not gazette notices: they show a change to the name, status, legal form or registered address, and to the share capital, dated when it first appears in the register data, and none is dated before 2026-09-30. Monitoring is available for every live country except France and Chile.
• A registry-compliance signal. Not served for Croatia.
• More than the register states. The notices are court decisions from the Croatian court register (bankruptcy, shortened bankruptcy, pre-bankruptcy proceedings), with the court and case number where the register states them and only for companies still on the register. They are linked by MBS, and the register's bankruptcy, liquidation and pre-bankruptcy settlement states are also in the company's status.
• Financial statements and beneficial owners. Beneficial owners are not served for Croatia. Financial statements are served for listed companies only, from the Scale plan: their ESEF annual financial reports (IFRS, mostly consolidated); group and company accounts from the Zagreb Stock Exchange; not every report is held. Other Croatian companies have none.
• Sole traders. Never served, so a lookup of one returns nothing even though the business exists.

Pricing

Croatia is included in every tier at no upcharge. Starter begins with a 14-day trial: 500 credits in total, 10 requests/minute, card required, nothing charged for 14 days. Subscribing keeps the same key working. Then Starter at €9.99/month (1,000 credits, 60 requests/minute), Professional at €29.99/month (10,000 credits, 120 requests/minute) and Scale at €99.99/month (50,000 credits, 300 requests/minute), monthly or annual; annual is ten months' price for twelve. A company record costs 1 credit, an autocomplete keystroke costs 1 credit, and error responses cost nothing, so a product onboarding a few hundred Croatian customers a month stays inside Starter.

FAQ

How do I look up a Croatian company by MBS from an API?
Call GET /companies/search?company_number=080000604&country=HR. A dropped leading zero is restored and the check digit is advisory, so the API validates the format; a malformed number is a 400 validation error rather than an empty list.

Can I look up a Croatian company by OIB or VAT number?
Yes: oib=27759560625 or vat=HR27759560625 with country=HR resolves to the same company. An OIB that fails its check digit is a 400.

Does the Croatian record include officers, company events or insolvency notices?
Partly. Croatia is company-level: legal name, legal form, status, registered address, activity code and dates. There are no officers and no registry-compliance signal. Register-change events (name, status, legal form and registered address, and share capital, dated when the change first appears in the register data, none before 2026-09-30) and monitoring are available, and corporate insolvency notices (court decisions from the Croatian court register (bankruptcy, shortened bankruptcy, pre-bankruptcy proceedings), with the court and case number where the register states them and only for companies still on the register) are linked by MBS. The register's bankruptcy, liquidation and pre-bankruptcy settlement states are also in the company's status.

Does it cover Croatian sole traders?
No. They are never served, so a lookup of one returns nothing even though the business exists.

Can I call the API from the browser?
You can, but a key in the browser is public. Proxy the search through your server, as in the sample above. Rate limits are per key.

Is there a way to try it before signing up?
Yes: the free MBS / OIB lookup runs the same call with a shared key.

Izvor: Sudski registar, Ministarstvo pravosuđa, uprave i digitalne transformacije (Otvorena dozvola)