Guide · Spain · Lookup, BORME events and risk flags

BORME API: Spanish company registry data by NIF, officers and events

A customer types a NIF or the first letters of a name; your form fills in the legal name, legal form, status, registered address and registry coordinates from the Spanish commercial registry (Registro Mercantil) as published in the BORME, and the same key reads the administrators, every later BORME act as an event, and the risk signals on the company. One response shape, the same as every other country the API covers.

Is there an official Spanish company registry API?

As at 5 Nov 2026, partly. The BOE (Agencia Estatal Boletín Oficial del Estado) publishes an open-data API that serves the BORME, the gazette of the Registro Mercantil, as one summary per day in XML or JSON (GET /datosabiertos/api/borme/sumario/DATE); its page names no key and no price, and reuse is under the BOE reuse conditions. That is a daily gazette summary, not a search by NIF, and annual accounts are sold per document by the Registradores. One API across the live countries adds a company record keyed on the NIF, the administrators published in the BORME and each BORME act as a typed event, in the same response shape as every other country. Scope limits for Spain: no beneficial owners and no credit scores, and financial statements for listed companies only. Compare register access in every country we checked.

BORME API and Prometiam, field by field

The official BORME open data is published by the BOE (as read on its open-data page, 13 Nov 2026). Prometiam is a separate, paid REST API that serves what the gazette publishes as company records.

BORME API: what to know before you build on it

From the BOE's own pages, its open-data page and its BORME FAQ, as read on 13 Nov 2026:

1. The BORME endpoint takes a date and returns that day's summary; the page lists no search by company.
2. The date is a fecha in aaaammdd format, and the page lists 400 for an invalid identifier or wrong parameters and 404 when the requested information does not exist.
3. The BORME is published every day of the year except Saturdays, Sundays and holidays in Madrid, so a loop over calendar days meets days with no issue.
4. The summaries are available since January 2009.
5. The electronically signed PDF is the only official and authentic version.
6. A summary links each document by URL (PDF, HTML and XML), so the content of an act is a further download per document.
7. Reuse means accepting the BOE reuse conditions.

BORME API: documentation, example, Python, key and price

BORME API documentation

The BOE publishes the BORME summary API documentation as a PDF, APIsumarioBORME.pdf, with a BORME FAQ, both linked from the open-data page. Ours is the Prometiam API documentation.

BORME API example

One call to our API for a Spanish company by NIF:

curl -H "Authorization: Bearer $PROMETIAM_API_KEY" \
  "https://api.prometiam.com/functions/v1/risk-api/companies/search?nif=A46103834&country=ES"

BORME API in Python

The same call with requests:

import os
import requests

r = requests.get(
    "https://api.prometiam.com/functions/v1/risk-api/companies/search",
    params={"nif": "A46103834", "country": "ES"},
    headers={"Authorization": "Bearer " + os.environ["PROMETIAM_API_KEY"]},
)
print(r.json())

BORME API key

The BOE's open-data page mentions no key and no registration. Ours needs a key. To try it without an account, use the demo key in the docs or the free NIF lookup.

BORME API price

The BOE's page names no price; reuse is under its reuse conditions. Ours starts at Starter, EUR 9.99 a month for 1,000 credits; a company search or a company record costs 1 credit. The 14-day trial has 500 credits, card required, nothing charged during it.

What you get, and what you do not

Spain is covered end to end: the company record keyed on the NIF, its officers, each BORME act as a typed event, monitoring with webhooks, a registry-compliance signal, the AEAT large-debtor flags, public-procurement awards from the PLACSP, beta buyer-risk scores and, in beta and for Spain only, PEP screening. Spain is one of the sixteen insolvency markets: its concurso notices from the BORME are on GET /insolvency/search, and on GET /search too.

Searching officers by name and reading corporate events need a Starter plan or above; a trial key has 25 calls a month on each. If you want to know what the gazette itself is, start with What is the BORME? (also en español).

What the Spanish record gives your product

• Exact match on the NIF. nif=A46103834 with country=ES; company_number and vat are aliases. The match is exact, so send capitals with no spaces or hyphens, and check the control character first.
• Autocomplete by name. ?name= is an accent-insensitive, normalised, partial match ranked by a match score. Each call is one request.
• Registry coordinates. Tomo, libro, folio, sección, hoja and inscripción on the company detail.
• Sector and new-company feeds. cnae=62 takes a CNAE code or prefix, objeto=software a keyword in the objeto social (the statutory business purpose), and founded_after=2026-01-01 lists companies by incorporation date. These filters are for Spain.
• The register's own state. In Spain local_status: "dissolved" means the company still exists pending liquidation (status: "in_dissolution").
• One schema for every country. The same response shape whichever country you pass, so a multi-country flow needs one integration.

A field the gazette never printed is empty. Capital and address come from the acts that establish them, so a company incorporated before the digital editions and never since moved or recapitalised can carry neither, and the NIF of the very newest companies can fill in on a later update.

Validate before you call

A company NIF (formerly the CIF) is a letter for the legal form (A for an S.A., B for an S.L.), seven digits and a control character, a digit or a letter, computed from the seven digits. That makes it one of the identifiers you can reject offline, in your own code, before it costs a call. The identifier validator runs the same arithmetic in the browser; this is the version to paste into a form handler:

// Spanish company NIF (CIF form): a letter, seven digits and a control digit or letter
const CONTROL_LETTERS = 'JABCDEFGHI'

export function checkCif(input) {
  const v = String(input).toUpperCase().replace(/[\s.-]/g, '')
  if (!/^[ABCDEFGHJNPQRSUVW]\d{7}[0-9A-J]$/.test(v)) return null
  let sum = 0
  for (let i = 0; i < 7; i++) {
    const n = Number(v[i + 1])
    if (i % 2 === 0) { const d = n * 2; sum += d > 9 ? d - 9 : d } else sum += n
  }
  const digit = (10 - (sum % 10)) % 10
  return v[8] === String(digit) || v[8] === CONTROL_LETTERS[digit] ? v : null
}

checkCif('A46103834')     // 'A46103834'
checkCif('a-78053147')    // 'A78053147': case and separators are normalised
checkCif('A78053148')     // null: the control character should be 7 or G

A passing check says the number is well-formed, never that the company exists or is still registered. A personal DNI or NIE has a different shape and is not a company identifier.

Four calls

# 1. By NIF
curl -H "Authorization: Bearer $PROMETIAM_API_KEY" \
  "https://api.prometiam.com/functions/v1/risk-api/companies/search?nif=A46103834&country=ES"

# 2. By name, for a type-ahead field
curl -H "Authorization: Bearer $PROMETIAM_API_KEY" \
  "https://api.prometiam.com/functions/v1/risk-api/companies/search?name=mercadona&country=ES&limit=5"

# 3. New software companies since a date
curl -H "Authorization: Bearer $PROMETIAM_API_KEY" \
  "https://api.prometiam.com/functions/v1/risk-api/companies/search?founded_after=2026-01-01&cnae=62&country=ES&limit=100"

# 4. The full record by the id the search returned, with its risk flags
curl -H "Authorization: Bearer $PROMETIAM_API_KEY" \
  "https://api.prometiam.com/functions/v1/risk-api/companies/$COMPANY_ID?country=ES&include=risk_flags"

To resolve a list, POST /companies/lookup takes up to 100 items in one call, each one counted as one request:

curl -X POST "https://api.prometiam.com/functions/v1/risk-api/companies/lookup" \
  -H "Authorization: Bearer $PROMETIAM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"items":[{"country":"ES","nif":"A46103834"},{"country":"ES","nif":"A78053147"},{"country":"ES","name":"Repsol"}]}'

Beyond the record: officers, BORME events and monitoring

Officers

The company record carries appointments: role, dates and the person. To find an officer by name, GET /people/search?name=...&country=ES needs a Starter plan or above; Spain is the default country of that endpoint.

BORME events

# Director changes of a company, by name
curl -H "Authorization: Bearer $PROMETIAM_API_KEY" \
  "https://api.prometiam.com/functions/v1/risk-api/company-events/search?country=ES&company_name=inditex&event_type=director_change&limit=5"

# The event history of a company
curl -H "Authorization: Bearer $PROMETIAM_API_KEY" \
  "https://api.prometiam.com/functions/v1/risk-api/company-events/timeline?country=ES&company_name=inditex&limit=10"

Each act is an event with an event_type (new_incorporation, director_change, capital_change, address_change, name_change, merger, demerger, dissolution, liquidation, insolvency, status_change, filing, correction, object_change, bylaws_change, legal_form_change, ownership_change, power_of_attorney, sale_of_business, debt_default, registry_closure, registry_reopening, reactivation, litigation, securities_issue, branch, charge, resolution, website, other; 9 Oct 2026: 19 finer types served, status_change now only the status changes no finer type describes), the raw BORME act code in act_type, the date and a notice_url to the gazette. Search Spanish events by company_name: on the event endpoints company_number is the registry-sheet number the BORME prints, and the NIF is in vat_number.

Monitoring

curl -X POST "https://api.prometiam.com/functions/v1/risk-api/monitor" \
  -H "Authorization: Bearer $PROMETIAM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"company_id": 812044, "country": "ES", "label": "vendor-1", "webhook_url": "https://yourapp.com/hooks/prometiam", "events": ["corporate_event", "status_change", "sanctions_match"]}'

company_id is the id from /companies/search. Alerts go to your webhook, signed with HMAC-SHA256 in X-Prometiam-Signature, and are always pollable through GET /monitor. Monitoring covers every live country except France and Chile; Spain gets the full corporate-event stream. sanctions_match alerts rely on sanctions screening, which is beta. How many companies a key can monitor scales with the plan.

Registry-compliance signal and tax-debt flags

# Companies whose registry sheet is closed, newest closures first
curl -H "Authorization: Bearer $PROMETIAM_API_KEY" \
  "https://api.prometiam.com/functions/v1/risk-api/companies/search?risk_flag_type=registry_compliance&country=ES&limit=20"

# Companies on the AEAT large-debtor list
curl -H "Authorization: Bearer $PROMETIAM_API_KEY" \
  "https://api.prometiam.com/functions/v1/risk-api/companies/search?has_risk_flag=true&country=ES&limit=20"

The registry-compliance signal (sheet_closed, dated in as_of) is the BORME's provisional closure of a registry sheet, for example when annual accounts were not filed. It is a compliance signal, not an insolvency or a dissolution: the closure is kept until a reopening, or any later act that needs an open sheet, is published.

The tax-debt flag comes from the AEAT list of large debtors (debts above EUR 600,000) and is point-in-time, not a live balance: the list reports balances as at 31 December of the prior year, is published about six months later, and inclusion is appealable. Each flag carries amount_eur, severity, reference_date, published_date and a link to the official source, and states in identifier_source whether its identifier was read directly or reconstructed with name corroboration. The match is by exact NIF, which favours precision over recall.

Public procurement and buyer risk

# Awards to one supplier, by NIF
curl -H "Authorization: Bearer $PROMETIAM_API_KEY" \
  "https://api.prometiam.com/functions/v1/risk-api/procurement/awards?country=ES&nif=A78053147&limit=20"

# Beta: contracting bodies ranked by the competition score
curl -H "Authorization: Bearer $PROMETIAM_API_KEY" \
  "https://api.prometiam.com/functions/v1/risk-api/procurement/buyers?country=ES&model=competition&min_score=8"

Awards come from the PLACSP, open tenders and minor contracts alike. One row is one award to one supplier; minor contracts are awarded directly by law, so read procedure and nature before summing amounts. Awards to natural persons are never returned. The buyer-risk scores are in beta, cover Spain and France, and describe the contracting body: a score is a prompt to look, not a finding of wrongdoing.

PEP screening (beta, Spain only)

curl -H "Authorization: Bearer $PROMETIAM_API_KEY" \
  "https://api.prometiam.com/functions/v1/risk-api/sanctions/screen?name=PERSON_NAME&include_pep=true&pep_min_tier=regional"

PEP screening is beta and covers Spain only. Membership is by occupation, not by office, so every hit carries its recorded offices, their dates and a derived pep_tier; apply your own threshold with pep_min_tier. There are no relatives or close associates in the set, so it does not by itself satisfy a FATF PEP obligation. Treat a hit as a prompt to investigate, not a determination.

Concursal notices

curl -H "Authorization: Bearer $PROMETIAM_API_KEY" \
  "https://api.prometiam.com/functions/v1/risk-api/search?vat=A46103834&country=ES"

GET /search returns the insolvency filings, dissolutions and liquidations published in the BORME for Spanish companies. GET /insolvency/search also serves the concurso notices of Spain, one of its sixteen corporate markets (FR, DE, GB, AT, CH, NO, FI, US, NL, DK, HR, SE, ES, LV, EE, SG).

An autocomplete endpoint in Node

Your server keeps the key and proxies the search; the form calls your server. A full-length, well-formed NIF goes to the exact filter, anything else is a name, and a full-length NIF that fails its control character is rejected before it costs a call:

// server: /api/es-company?q=...   (keep the key out of the browser)
app.get('/api/es-company', async (req, res) => {
  const q = String(req.query.q || '').trim()
  const compact = q.toUpperCase().replace(/[\s.-]/g, '')
  const looksLikeId = /^[A-Z]\d{7}[0-9A-Z]$/.test(compact)     // a full-length NIF; anything shorter is still a name
  const nif = looksLikeId ? checkCif(compact) : null
  if (looksLikeId && !nif) return res.status(422).json({ error: 'That is not a valid company NIF' })

  const params = new URLSearchParams({ country: 'ES', limit: '6', ...(nif ? { nif } : { name: q }) })
  const r = await fetch('https://api.prometiam.com/functions/v1/risk-api/companies/search?' + params,
    { headers: { Authorization: 'Bearer ' + process.env.PROMETIAM_API_KEY } })
  if (!r.ok) return res.status(502).json({ error: 'Lookup failed' })
  const { data } = await r.json()
  res.json(data.map(c => ({ id: c.id, name: c.company_name, nif: c.company_number, form: c.legal_form,
    status: c.status, city: c.city, province: c.province, postal_code: c.postal_code })))
})

What Spain does not carry

• Insolvency in the sixteen-market feed. Spain is one of the sixteen insolvency markets; the judge and the insolvency administrator are never served. Spanish concursal notices are also on GET /search.
• Beneficial owners. Not served for Spain.
• Credit scores. Not served.
• Financial statements. Listed companies only, from the Scale plan: their ESEF annual financial reports (IFRS, mostly consolidated); not every report is held, and the reports of Spanish listed companies are available free of charge on the CNMV website. Other Spanish companies have none: their annual accounts are sold per document.
• A live tax balance. The AEAT flag is a dated list entry, not a live debt figure.
• Relatives and close associates of PEPs. The PEP set is beta and holds none.

Pricing

Spain is included in every tier at no upcharge. Starter begins with a 14-day trial: 500 credits in total, 10 requests/minute, card required, nothing charged for 14 days. Subscribing keeps the same key working. Then Starter at €9.99/month (1,000 credits, 60 requests/minute), Professional at €29.99/month (10,000 credits, 120 requests/minute) and Scale at €99.99/month (50,000 credits, 300 requests/minute), monthly or annual; annual is ten months' price for twelve. A company record costs 1 credit, an autocomplete keystroke costs 1 credit, and error responses cost nothing. Officers by name and corporate events are Starter-tier scopes, with 25 calls a month on a trial key; sanctions and PEP screening are in beta and have their own plan scope, listed on the pricing page.

FAQ

How do I look up a Spanish company by NIF from an API?
Call GET /companies/search?nif=A46103834&country=ES. The match is exact, so send the NIF in capitals with no spaces or hyphens, and validate the control character in your own code first.

Does it return administrators and BORME acts?
Yes. The company record carries the appointments published in the BORME, and each act is an event with a typed event_type. Searching officers by name and reading events need a Starter plan or above; a trial key has 25 calls a month on each.

Does the API cover Spanish insolvency proceedings?
Yes. Spain is one of the sixteen insolvency markets of GET /insolvency/search (FR, DE, GB, AT, CH, NO, FI, US, NL, DK, HR, SE, ES, LV, EE, SG): concurso notices (declaration, opening of the liquidation phase, conclusion) from the entries published in the BORME since 2009, linked by NIF and dated by the court resolution, with the BORME publication date alongside. The judge and the insolvency administrator are never served. GET /search also returns the concursal notices published in the BORME, filtered by NIF, name or registry number.

What is the AEAT tax-debt flag, and how current is it?
It marks companies on the AEAT list of large debtors (debts above EUR 600,000). It is point-in-time, not a live balance: the list reports balances as at 31 December of the prior year, is published about six months later, and inclusion is appealable.

Can I monitor Spanish companies?
Yes. Monitoring covers every live country except France and Chile, and Spain gets the full corporate-event stream, delivered to a signed webhook or through GET /monitor.

Is there PEP screening for Spain?
In beta and for Spain only. Membership is by occupation, not by office, and there are no relatives or close associates, so it does not by itself satisfy a FATF PEP obligation. Treat a hit as a prompt to investigate.

How much does the Spain company registry API cost?
Spain is included in every tier at no upcharge. Free is a 14-day trial with 500 credits in total and card required, nothing charged for 14 days; subscribing keeps the same key working. Paid tiers run from EUR 9.99 to EUR 99.99 a month, monthly or annual.

Is there a way to try it before signing up?
Yes: the free NIF lookup (en español) runs the same call with a shared key.

Source: BORME (Registro Mercantil), Spain.