Use case · Third-party risk

Supplier Due Diligence API

Resolve every supplier to one official identifier, pull the registry profile, screen the legal name and its officers against sanctions, check for corporate insolvency, and keep watching after onboarding — across every registry the API covers, from one REST API.

Published 15 September 2026

The problem

Procurement and vendor-management teams onboard a supplier once — a form, a couple of documents, maybe a manual registry check — and then move on to the next one. The supplier that looked fine at intake can change: a director resigns, the company enters administration, a subsidiary turns up on a sanctions list eighteen months later. Nobody re-runs the original check, because the original check was never built to run again.

Finance teams feel the same gap from a different angle: an invoice paid to a supplier that has already filed for insolvency, or wired to an entity that no longer legally exists, is money that does not come back.

The EU's Corporate Sustainability Due Diligence Directive and most internal third-party-risk policies ask for the same baseline regardless of the paperwork around them: confirm the counterparty exists and is active, screen it for sanctions exposure, and know if it is in financial distress — at onboarding and again later. Prometiam is not legal advice on whether a given supplier relationship satisfies either one; it is the identity, status, sanctions and insolvency layer that a due-diligence file needs to show the checks happened.

The pattern

Five calls, all of them batchable, so a whole supplier book moves together instead of one row at a time:

Resolve. POST /companies/lookup takes up to 100 suppliers per call — by company_number, nif, siren, vat, or a fuzzy name with match_score — and returns one official identifier per row, in the order you sent them.
Verify. GET /companies/{id}?include=risk_flags,insolvency,lei pulls the full profile: registry status, dissolution_date, officers where the registry holds them, Spain's AEAT large-debtor flag, and any LEI the company has registered.
Screen. POST /sanctions/screen checks the legal name and, where held, each officer, against sanctions and the US export-control lists in the same call — up to 50 names, with a threshold you set. Beta, and a Professional-tier scope.
Check insolvency. POST /insolvency/check covers sixteen corporate-insolvency markets in one call, up to 100 items.
Keep watching. POST /monitor subscribes a company to webhook alerts for every live country except France and Chile; a daily GET /company-events/search sweep does the same job by polling, for Spain, France and the UK, plus register-change events for every other live country except Chile (none before 14 Oct 2026 for Ireland, Poland and Norway; Argentina is read monthly, none before 28 Oct 2026; Mexico covers its LEI-registered entities only).

# 1. Resolve every supplier to one official identifier — up to 100 per call
curl -X POST "https://api.prometiam.com/functions/v1/risk-api/companies/lookup" \
  -H "Authorization: Bearer rk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "items": [
      { "country": "ES", "company_number": "A46103834" },
      { "country": "FR", "siren": "552032534" }
    ]
  }'

# 2. Pull the profile: status, dissolution_date, officers, the Spain-only
#    AEAT flag, and the LEI block
curl "https://api.prometiam.com/functions/v1/risk-api/companies/812044?include=risk_flags,insolvency,lei" \
  -H "Authorization: Bearer rk_live_..."

# 3. Screen the legal name and each officer — Professional-tier scope, beta
curl -X POST "https://api.prometiam.com/functions/v1/risk-api/sanctions/screen" \
  -H "Authorization: Bearer rk_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "names": ["ACME TRADING SL"], "threshold": 85 }'

# 4. Corporate insolvency across the sixteen-market feed, Spain included
curl -X POST "https://api.prometiam.com/functions/v1/risk-api/insolvency/check" \
  -H "Authorization: Bearer rk_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "items": [ { "country": "FR", "company_number": "552032534" } ] }'

# 5. Keep watching: a webhook for every live country except France and Chile, or a daily sweep
#    for Spain, France and the UK
curl -X POST "https://api.prometiam.com/functions/v1/risk-api/monitor" \
  -H "Authorization: Bearer rk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "company_id": 812044,
    "country": "ES",
    "webhook_url": "https://your-erp.example.com/hooks/prometiam"
  }'

A real example

In practice this runs as a batch job against your vendor master: pull the list, split it into chunks of 100, and write one result row per supplier.

import os, csv, requests

API = "https://api.prometiam.com/functions/v1/risk-api"
HEAD = {"Authorization": f"Bearer {os.environ['PROMETIAM_API_KEY']}"}
INSOLVENCY_COUNTRIES = {"FR", "DE", "GB", "AT", "CH", "NO", "FI", "US", "NL", "DK", "HR", "SE"}

def chunks(items, size=100):
    for i in range(0, len(items), size):
        yield items[i:i + size]

def check_book(vendors):
    # vendors: [{"country": "ES", "company_number": "A46103834"}, ...]
    rows = []
    for batch in chunks(vendors, 100):
        resolved = requests.post(f"{API}/companies/lookup", json={"items": batch}, headers=HEAD).json()["data"]
        for vendor, result in zip(batch, resolved):
            company = result.get("company")
            row = {"input_country": vendor["country"],
                   "input_id": vendor.get("company_number") or vendor.get("siren") or vendor.get("name"),
                   "status": result["status"], "company_id": None, "legal_name": None,
                   "registry_status": None, "sanctions": None, "insolvency": None}
            if company:
                row["company_id"], row["legal_name"], row["registry_status"] = (
                    company["id"], company["company_name"], company["status"])
                sanc = requests.post(f"{API}/sanctions/screen", headers=HEAD,
                    json={"names": [company["company_name"]], "threshold": 85}).json()["data"][0]
                row["sanctions"] = sanc["status"]  # match | clear | error | timeout
                if vendor["country"] in INSOLVENCY_COUNTRIES:
                    ins = requests.post(f"{API}/insolvency/check", headers=HEAD, json={"items": [
                        {"country": vendor["country"], "company_number": company["company_number"]}]}).json()["data"][0]
                    row["insolvency"] = ins["status"]  # found | none | error | timeout
                elif vendor["country"] == "ES":
                    notices = requests.get(f"{API}/search", headers=HEAD,
                        params={"vat": company["company_number"], "country": "ES"}).json()["data"]
                    row["insolvency"] = "found" if notices else "none"
                # Ireland and Poland: no insolvency-notice coverage yet, stays None
            rows.append(row)
    return rows

vendors = [{"country": "ES", "company_number": "A46103834"}, {"country": "FR", "siren": "552032534"}]
rows = check_book(vendors)
with open("supplier_results.csv", "w", newline="") as f:
    w = csv.DictWriter(f, fieldnames=list(rows[0].keys()))
    w.writeheader()
    w.writerows(rows)

About 40 lines. It resolves a chunk of up to 100 suppliers in one call, then screens (Professional-tier scope) and checks insolvency only for the ones it actually found — routing the insolvency check to whichever endpoint covers that supplier's country, and leaving the column empty for Ireland and Poland rather than reporting a false "none", since neither has insolvency-notice coverage yet.

What comes back

The lookup response returns one result per supplier, in request order: a status of found, not_found, error or timeout; the resolved company object or null; and a match_score when the match came from a name rather than an exact identifier. meta.found and meta.not_found give the batch totals.

The profile adds status, dissolution_date, founding_date, registered capital, and contacts — each officer's full_name, role, appointment_date and is_current — plus, where requested, Spain's point-in-time AEAT large-debtor flag and the company's LEI record.

Sanctions screening returns a status of match, clear, error or timeout per name, with hits carrying match_score, source_list, program and listing_date, plus hit_count and distinct_entities. Insolvency checking returns status found, none, error or timeout, up to five notices newest first, and latest_filing_date. A none or clear result means nothing matched in the markets covered — not proof the supplier is solvent or unlisted everywhere.

The same record in the dashboard: identifiers, registered office, and the insolvency, sanctions (beta) and register signals on one page. Shown for a UK company. Open it in the dashboard

Scope limits, stated plainly

The five steps above do not reach every country the same way. This is what each country actually supports:

Country	Officers to screen	Insolvency notices	Push webhook	Daily sweep
Spain	Yes	Yes — concursal notices, `POST /insolvency/check`, linked by NIF	Yes	Yes
France	Yes	Yes — `POST /insolvency/check`	No	Yes
United Kingdom	Yes	Yes — `POST /insolvency/check`	No	Yes
Ireland	No — company-level	No coverage yet	Yes	No
Poland	Partly — boards and proxies, natural persons masked by the register	No coverage yet	Yes	No
Norway	Yes	Yes — `POST /insolvency/check`	No	No — register-change events only
Finland	No — company records only	Yes — `POST /insolvency/check`, linked by business ID	Yes	Yes — register-change events
Sweden	No — company records only	Yes — `POST /insolvency/check`, linked by organisationsnummer	Yes	Yes — register-change events
Belgium	No — company records only	No coverage	Yes	Yes — register-change events
Croatia	No — company records only	Yes — `POST /insolvency/check`, linked by MBS	Yes	Yes — register-change events
Denmark	No — company records only	Yes — `POST /insolvency/check`, linked by CVR number	Yes	Yes — register-change events
Estonia	No — company records only	Yes — `POST /insolvency/check`, linked by registry code	Yes	Yes — register-change events
Slovakia	No — company records only	No coverage	Yes	Yes — register-change events

Lookup and the profile pull (steps 1 and 2) work the same way for every live country. Sanctions screening runs on every live country too, on the legal name at minimum — a Professional-tier scope, beta.

Beneficial ownership is the UK's Persons with Significant Control register only; every other registry returns officers and directors, not beneficial owners. A supplier with a Legal Entity Identifier adds GLEIF Level-2 parents via GET /lei/{lei}/relationships.
Risk flags are Spain only: the AEAT large-debtor list is point-in-time — balances as at the prior 31 December, published roughly six months later — not a live balance.
PEP screening exists (beta, Spain only, by occupation, no relatives or close associates) but is a separate flag, not part of this pattern.
Prometiam does not return a credit score or ESG data, for any country. Company financial statements (annual accounts as filed) are served for GB, FR, DK, SE, NO and SEC filers in the United States from the Scale plan, for Finland (statements filed digitally with PRH, about one filer in twenty, and listed groups) and for listed companies only in ES, PL, HR and BE (their ESEF annual financial reports), and not for other companies or countries. Public-contract award history is a separate endpoint for Spain, France, the UK, Ireland, Poland and Norway (public procurement screening).

Pricing fit

POST /companies/lookup, GET /companies/{id} and POST /insolvency/check all run on the same base scope as a plain company search, so a 2,000-supplier book is 2,000 + 2,000 + 4,000 = 8,000 credits (1 per lookup, 1 per record, 2 per insolvency check) — more than the Starter tier (€9.99/month, 1,000 credits, 60 req/min) includes, so it takes the Professional tier.

Sanctions screening is the one step gated by scope rather than volume: POST /sanctions/screen needs the Professional tier (€29.99/month, 10,000 credits, 120 req/min), whatever the book size — it is also where full sanctions and export-control screening actually turns on. Screening the 2,000 names adds 6,000 credits (3 per name), 14,000 with the other three steps, so Professional covers the book over two months and Scale (€99.99/month, 50,000 credits, 300 req/min) in one, with room for a monthly re-check and whatever new suppliers join it.

Batch items count one request each. A batch bigger than what is left on the plan for that minute, day or month is refused up front with 429 batch_exceeds_quota, and the response's max_items_now says how many fit right now — so a script can split the remainder and retry instead of guessing.

FAQ

What counts as due diligence on a supplier?
At minimum: confirm the legal entity exists and is active, screen its name and officers where the registry holds them against sanctions lists, and check for corporate insolvency notices. The EU's Corporate Sustainability Due Diligence Directive and most internal third-party-risk policies ask for that same baseline. Prometiam is not legal advice on whether a given relationship satisfies either one — it supplies the identity, status, sanctions and insolvency checks the file needs to show it happened.

Can I run this against a few thousand suppliers at once?
Yes. POST /companies/lookup and POST /insolvency/check each take up to 100 items per call, and POST /sanctions/screen takes up to 50 names. Every item counts as one request against your plan. A batch larger than what is left on your plan is refused up front with 429 batch_exceeds_quota, and the response's max_items_now says how many fit right now. Sanctions screening also needs the Professional-tier scope; the other three batch endpoints run on any tier.

Does this cover beneficial ownership, not just officers?
Only for the UK, through the Persons with Significant Control register on the company profile. Spain, France, the UK, Norway, Poland and the Czech Republic (Polish natural persons are masked by the register itself; Czech natural persons are the name and the month and year of birth only) all return officers and directors, but a director is not a beneficial owner. Ireland is company-level: no officers yet, for either purpose. For a supplier with a Legal Entity Identifier, GET /lei/{lei}/relationships adds GLEIF's Level 2 direct and ultimate parent.

Which countries actually have insolvency coverage for a supplier check?
France, the UK, Norway, Finland, Denmark, Croatia, Sweden, Switzerland, Spain, Latvia, Estonia and Singapore are covered corporate-only through POST /insolvency/check (Swiss notices link to the company record by UID where the notice names it), alongside further countries where Prometiam holds no company registry at all: Germany, Austria, the US and the Netherlands. Ireland and Poland have no insolvency-notice coverage in either endpoint yet, and neither do Belgium or Slovakia (their bankruptcy shows in the company status).

How do I keep checking a supplier after onboarding?
Two ways. POST /monitor subscribes a company and pushes a signed webhook on status changes, dissolution and new sanctions matches, for every live country except France and Chile. For Spain, France and the UK, a daily GET /company-events/search sweep against your own supplier list catches capital_change, director_change, dissolution and the rest (for Finland, Sweden, Belgium, Croatia, Denmark, Estonia, Slovakia, Switzerland, Latvia, Cyprus, Romania, Lithuania, Canada, Australia, Japan, Israel, Singapore, Colombia, Taiwan, Czech Republic, Brazil and the United States it returns register-change events). Norway has register-change events only, from 14 Oct 2026 (no gazette), and a Norwegian supplier can be monitored (status, dissolution, sanctions match and register-change events).

Customer insolvency monitoring — the same insolvency feed, aimed at receivables instead of suppliers
Counterparty monitoring — the daily-sweep pattern for any B2B counterparty, not just suppliers
Sanctions screening — the standalone sanctions API pattern
Batch screening — running lookups, sanctions and insolvency checks at list scale
Insolvency monitoring in Europe — how the sixteen-market notice feed fits together