Executive Summary: An embedded equipment finance broker that pre-qualifies an application inside a vendor's checkout and routes it to a lending partner needs seven Secretary of State fields and no vendor risk score: legal name, raw status, normalized status, filing date, state registration number, one usable address, and officers where the state publishes them. Time in business is the broker's own routing input, calculated from the filing date in the broker's code, and the lending partner still underwrites the deal in full. The hard part is fetching those fields without making an applicant wait on a slow state registry, which takes a cache-first read, a live verification that runs while the form is completed, and an explicit path for entities formed last month.
Why Does an Embedded Equipment Finance Broker Need Secretary of State Data Before Routing?
What does the broker decide, and what does the lending partner still own?
The Equipment Leasing and Finance Association reports that in 2023 banks accounted for 59 percent of financed equipment acquisitions, captives (manufacturer or vendor financing) for 17 percent, independents for 15 percent, and fintechs for 7 percent.[1] When the application sits on the vendor's website, the platform behind it can be a broker that pre-underwrites, checks the data, and passes the deal to a lending partner that carries the credit decision. That split defines the data requirement.
Why is time in business the routing input rather than a score?
Firm age changes lending outcomes. The Federal Reserve Banks' report on startup firms found that startup employer firms were far more likely than other firms to have sought financing in the prior 12 months, and that among applicants, startup employers were less likely than older employers to be fully approved.[2] When lending partners set tenure thresholds by program, the broker's routing logic has to weight time in business heavily. The registry supplies the date. The broker supplies the arithmetic and the tiers. A vendor score that blends tenure with other signals hides the one number the partners want.
What does refusing a score change about vendor selection?
Middesk describes its product as verifying business identity, confirming ownership, and screening for risk, and contrasts legacy KYB that "gives you data" with its own approach that "takes it from data to decision."[3] A broker that only routes asks a narrower question: which provider returns the seven fields fastest, in a normalized form, with a delivery pattern that does not block the applicant.
Route on the record and its timestamps. Score inside the lender's underwriting, never inside the broker's intake form.
Which Secretary of State Fields Does Routing Actually Consume?
Which seven fields make up the broker's routing set?
Cobalt's own measurement on September 11, 2026 searched three large national companies by name in each of the 50 states and the District of Columbia: 153 probes, each allowed up to 180 seconds. Eight fields came back from every jurisdiction that returned a record: title, status, normalizedStatus, filingDate, normalizedFilingDate, sosId, stateOfSosRegistration, and confidenceLevel. The measurement covers one day and three well-formed names, so it shows what a state can return rather than what it never returns, and it is not a service expectation. Five of the broker's seven routing fields sit in that universal set; the last two depend on the state:
• title. The legal name as registered, compared against the applicant's entry after normalization.
• status. The state's own status string, kept raw for exception handling because 51 registries use different vocabularies.
• normalizedStatus. Cobalt's cross-state status value and the field the routing gate reads, with the raw status as its fallback.
• filingDate. The original state registration (formation) date, which Cobalt's help center says does not change with later filings such as annual reports.[4] It arrives as the state displays it; normalizedFilingDate carries a normalized version.[5]
• sosId. The official registration number assigned by the state, unique within that jurisdiction.[6]
• Address. The API splits it into physicalAddressStreet, physicalAddressCity, physicalAddressState, and physicalAddressZip, with parallel agent and mailing fields.[7] Most states provide at least one address type; in Delaware it is typically the registered agent's location rather than the operating address.[8]
• officers. Public officer data where the state publishes it; Cobalt's guidance says to treat it as public registry information, not validated identity proof.[9]
The routing rule reads three results: the record-to-applicant match described below, the normalized status, and the filing date; the rest serve the exception reviewer and the lending partner's file.
Which fields depend on the state?
The same measurement found officer records from 32 of 51 jurisdictions, registered agent and physical address fields from 41 to 49, and stateOfFormation from 37. Delaware's status service illustrates the gap: officer and director names sit on annual report images and are not available through its online status application, and Delaware LLCs, LPs, and general partnerships do not currently file annual reports.[10] Cobalt's help center offers a downloadable field spreadsheet showing, state by state, whether address, registered agent, and officer data come back; read it before writing an officer-match rule.[11]
Which fields can the broker leave out of pre-qualification?
Screenshots, UCC filings, and related-business discovery are lender-side evidence, not routing inputs. The confidence score is a match signal rather than a risk score: Cobalt's help center says confidenceLevel quantifies how closely the returned entity name matches the submitted name.[12] The help center's typical bands are 0.80 and above for auto-accept, 0.60 to 0.79 for review, and below 0.60 as usually reject unless other signals such as address are strong.[13] Treat those bands as configuration the broker owns.
How Does the Filing Date Become Time in Business?
What does the filing date represent, and what does it not?
Cobalt's help center calls filingDate the best proxy for the incorporation date and says it is commonly used for tenure.[14] It is a registry date, not an operating date. The lending partner's policy decides whether tenure means registry age, bank-statement history, or both.
The trap is the foreign registration. Cobalt returns both stateOfFormation, the home state where the business was organized, and stateOfSosRegistration, the state where it is registered to do business; when they differ, the entity is likely a foreign registration, and some states also label entityType as Foreign.[15] California makes the date problem explicit: its Registration Date is the date a California or foreign entity registered in California, or converted into a California entity.[16]
How should the broker compute and store tenure?
Compute months from normalizedFilingDate to the receipt time in the broker's own code, store the raw date and the computed value together, and record which state's record produced it. Cobalt's field spreadsheet leaves normalizedFilingDate unmarked for Delaware and New Jersey, though all 51 jurisdictions returned it in the measurement,[17] so fall back to parsing the raw filingDate, and send a date that will not parse to the exception queue. When the formation state differs from the searched state, fetch the home-state record for the tenure calculation or flag the file so the lending partner sees a registration date rather than a formation date. Texas shows why the two diverge: a foreign filing entity must file an application for registration once it transacts business in Texas, with a 90-day grace period, so the Texas date can trail formation by months or years.[18] Texas also shows the check's blind spot: the field spreadsheet marks stateOfFormation for Texas,[17] but the measurement's three Texas probes returned neither that field nor entityType. Treat a missing formation state as unknown: ask for it on the form, fetch that state's record when the answer differs, and otherwise label the tenure as registration-based.
Tenure cutoffs, whether 12 months or 24, come from each lender's credit box and belong in a configuration table with an effective date, not in code.
What counts as a match between the application and the record?
The name leg is required: a confidenceLevel in the auto-accept band above, confirmed after uppercasing both names, stripping punctuation, and treating LLC and L.L.C. as equal. For the address leg, pass the applicant's city and ZIP in the live search's city and zip parameters, which check the physical, then mailing, then agent address.[7] The API reference calls each "an AND search parameter that checks the top 10 results from your searchQuery",[7] but the help center says address filters "are no longer treated as a hard filter", so a mismatch still returns the record, with addressMatch false.[19] The officer leg compares the signer's surname with officers where returned. High confidence with addressMatch false is what the help center calls a likely match to verify,[20] so route an auto-accept name only with one agreeing address or officer leg, and review anything less.
Treat a leg the record cannot answer as unknown. Delaware, Illinois, Maine, Ohio, Oklahoma, and South Carolina returned neither a physical city and ZIP nor officers in the measurement, and the field spreadsheet leaves eight jurisdictions unmarked for physical city, ZIP, and officers: Delaware, Kansas, Maine, Montana, Ohio, Oklahoma, South Carolina, and Wisconsin.[17] There only an agent or mailing address is left, which may not be the applicant's, so route an auto-accept name alone, flagged for the lending partner. First, test that a deliberately mismatched ZIP still returns the record there. The registry cannot prove control or ownership: Cobalt's guidance notes that state registries generally do not provide beneficial ownership information.[9]
How Should Status and Normalized Status Drive the Route?
Why do 51 registries disagree about what active means?
Each state's business code defines its own statuses. California alone defines more than a dozen, including Surrender, Merged Out, and Term Expired, and it separates a Secretary of State suspension (a missing Statement of Information) from a Franchise Tax Board suspension (unmet tax requirements), with Forfeited counterparts for foreign entities.[16] Nebraska administratively dissolves an entity for failing to file its annual or biennial report, failing to maintain a registered agent, or an expired corporate existence, and after reinstatement the status shows as Active again.[21] Cobalt's guide to normalized SOS status across 50 states walks through the label, reason, and scope variance a normalization layer has to absorb.
What rule does the broker write against normalizedStatus?
Write the gate against the normalized value, keep the raw string beside it, and map each normalizedStatus value to route, hold, or stop in a configuration table. Active routes. A curable status, such as a suspension or an administrative dissolution for a missed report, holds the file in an exception queue with the raw status attached; the applicant may be one filing away from reinstatement, and the lending partner decides whether that matters. A status that ends the registration, such as a voluntary dissolution or a merger, stops the route, and the file records which status stopped it. A value the table has never seen goes to the exception queue. These are routing outcomes, not credit decisions.
A state's status describes only that state's registration. California says a foreign entity's status there applies only to its California registration and points to the formation state for the entity's own status, so a California Surrender says nothing about standing at home.[16] Route on the home-state status when the partner cares about standing.
Status is also a point-in-time observation. Cobalt's help center says cached records do not auto-expire and that each payload includes createdAt and updatedAt so the consumer can judge freshness,[22] and the API reference shows both timestamps on cached (liveData=false) responses.[7] The field spreadsheet marks them for only 26 of its 52 jurisdictions,[17] so a cached record without them has an unknown age. When a cached record and a later live result disagree on status, the divergence is the routing signal, and both observations belong in the file.
What Happens When the Applicant's Entity Was Formed Last Month?
Why can a cache miss a new entity?
New businesses keep arriving. The Census Bureau counted 578,926 seasonally adjusted business applications, meaning applications for an Employer Identification Number, in July 2026.[23] This design treats a recently formed applicant as a routine case. Cobalt's help center says the cache holds roughly 70 to 80 percent of U.S. businesses,[24] that many sources refresh about monthly and some quarterly, and that a successful live call also updates the cache.[25] An entity formed since its state's last refresh, weeks to a quarter back, is likely missing unless someone has searched it live, so size the live-by-name path for every newly formed applicant. A miss, the help center adds, does not prove the entity is absent at the state; when certainty matters, run a live lookup.[26] The API says so in its own response: a cached search with no match returns "No business found in database. Try with liveData=true to search the registry in real time."[27]
What is the live-by-full-name fallback?
When the cache misses, the form asks for the exact legal name and state and fires a live search, which can end three ways. A match with a recent filing date proceeds to the tenure calculation, where a two-month-old entity lands in the startup tier rather than in a decline. A response with no exact match can carry alternativeResults for a reviewer to confirm.[7] A live no-results response is a real signal; Cobalt's guidance says that if a manual search also fails, the supplied name or registration may be inaccurate or unregistered.[28]
Some applicants have no registry record because none exists. The Small Business Administration explains that a sole proprietorship does not produce a separate business entity and that a person doing business under their own legal name need not register anywhere.[29] Capture entity type up front so a no-result for a sole proprietorship routes to the programs that accept one instead of into a fraud queue.
How should the broker route a no-result?
Route it to an exception queue that asks for the registration number and state. The API reference lists sosId as a general search input,[7] but Cobalt's field spreadsheet marks search by sosId for only Florida and Mississippi,[17] so re-run by identifier only where the spreadsheet marks the state or the broker's own tests confirm it; elsewhere, re-run by the corrected name and check the returned sosId against the number supplied. The IRS tells anyone creating a corporation or LLC to form it through the secretary of state before applying for an EIN.[30] A filed entity is not yet a searchable one: Oregon's business registry page, checked September 24, 2026, listed an estimated one to three business days for online filings, so a company that filed on Monday may not appear until Thursday.[31] A no-result inside that window is a timing condition; re-check after a set interval before asking the applicant again.
How Do You Keep the Applicant From Waiting on the State Registry?
How long does a live lookup take, state by state?
Cobalt's help center describes cached lookups at one to three seconds, fast live states at roughly seven to fifteen seconds, and slower states, with Delaware, Nevada, and Texas as its examples, at up to two minutes.[32] Cobalt's September 11 measurement gives one day's spread. Of its 153 probes, 110 returned a record live, 3 in Nevada came from the cache because the state site was down for maintenance, 19 completed with no exact match and offered alternatives instead, and 21 did not finish within the 180-second ceiling. The 110 live records took 1.51 to 170.27 seconds, with a median of about 14.8 seconds. Texas, one of the help center's slower-state examples, was the fastest live state that day at 1.51, 1.68, and 2.13 seconds; Indiana returned in 17.3, 73.76, and 170.27.
The design constraint follows: an applicant should never wait inside the form on a lookup that can run for minutes.
What does asynchronous verification look like inside the form?
Four steps. First, resolve the entity with a cache-first read (liveData=false), which returns in seconds when the record exists, and pre-fill the legal name, filing date, address, and status, a documented lending and onboarding use.[33] Second, fire the live verification with a callbackUrl. The help center says a lookup running longer than about 20 seconds returns a retryId instead of holding the connection open, and that with a callback Cobalt returns a requestId immediately and POSTs the completed result when it is ready.[34] The API reference instead says requests that take longer than 30 seconds receive a retryId,[7] so branch on the response status, not on a timer. Third, let the applicant finish the form while the application sits in a pending state. Fourth, when the live result posts, compare it with the cached pre-fill, compute tenure, apply the status gate, and move the record to complete or to an exception. A 202 with an Incomplete status means the search is still in progress, and the integration should never turn it into a no-match.[27]
Cobalt's public demonstration of business name autocomplete for lenders shows this sequence: the form copies suggestion data into its fields and starts the state search in the background while the applicant continues. The form, pre-fill mapping, and background call are the broker's own build, so confirm current endpoint behavior with Cobalt before designing around it. Cobalt's guides to cached data during live SOS searches and interim versus final SOS data cover the interim record.
Before step four trusts a live response that returns a record, check its top-level message: the API reference says one appears there only when the live lookup failed or the state was down for maintenance and recent data exists,[7] as with Nevada's three probes in the measurement. Store it and hold the file pending while the broker's code re-runs the live search within the five-minute cap below, so cached data never reaches sos_complete.
Cap the pending state at five minutes: the help center says Oregon and Delaware may need that long,[35] and the measurement's 170.27-second record and 21 unfinished probes, above, already passed the help center's two-minute figure for slower states. The applicant can submit before the callback posts, and only the route to a lending partner waits. If the cap passes with no callback, or with cached data only, the file goes to the exception queue as unverified, where a reviewer re-runs the live search; a missing callback is never a no-match.
What should the broker's routing record contain?
The record is customer-owned: Cobalt returns the observations; the broker adds the request context, the derived values, and the state machine. An illustrative shape, with the API's own parameter and field names inside the four sos blocks and broker-chosen names everywhere else:
{
"applicationId": "app_2026_0917_0412",
"receivedAt": "2026-09-17T15:42:08Z",
"sosCachedObservation": {
"sosId": "FL-EXAMPLE-0000001",
"title": "EXAMPLE APPLICANT LLC",
"status": "ACTIVE",
"normalizedStatus": "Active",
"normalizedFilingDate": "2024-06-14T00:00:00.000Z"
},
"sosRequest": { "searchQuery": "Example Applicant LLC", "state": "fl", "liveData": true, "city": "Jacksonville", "zip": "32202" },
"sosResponse": { "statusCode": 200, "message": null },
"sosLiveObservation": {
"sosId": "FL-EXAMPLE-0000001",
"title": "EXAMPLE APPLICANT LLC",
"status": "ACTIVE",
"normalizedStatus": "Active",
"filingDate": "06/14/2024",
"normalizedFilingDate": "2024-06-14T00:00:00.000Z",
"stateOfFormation": "FLORIDA",
"stateOfSosRegistration": "FL",
"physicalAddressStreet": "100 EXAMPLE ST",
"physicalAddressCity": "JACKSONVILLE",
"physicalAddressState": "FL",
"physicalAddressZip": "32202",
"officers": [{ "name": "J. EXAMPLE", "title": "MGR" }],
"confidenceLevel": 1,
"addressMatch": true
},
"derived": {
"tenureMonths": 27,
"nameMatch": "exact_after_normalization",
"addressCheck": "city_zip_agree",
"statusGate": "route",
"policyVersion": "routing-tiers-2026-09"
},
"phase": "sos_complete"
}What Are the Alternative Ways to Get These Fields?
What does manual portal lookup cost the operation?
The first alternative is a person and a browser, which fails at embedded-form volume for reasons the portals document. North Carolina says its online search tools are designed for interactive, real-time use, that automated or scripted searches are not permitted, and that bulk access runs through its Data Subscription Services.[36] Fifty-one portals, each with its own access rules, cannot sit behind a form that has to answer in seconds.
What do aggregated databases and bundled platforms offer?
The second alternative is an aggregated registry database. OpenCorporates documents a two-step API: a companies search endpoint that returns companies whose names match the search term, and a per-company endpoint keyed by jurisdiction code and company number that returns the core record, including incorporation_date, current_status, the registered address, and officers, with a retrieved_at timestamp for when the information was retrieved from the source.[37] A broker integrating one plans for the search-then-detail sequence and for record age.
The third alternative is the bundled KYB platform described earlier, built for the lender's decision rather than the broker's route.[3]
What the broker needs is a provider that resolves the entity, returns the seven fields in one normalized shape, offers both a fast cached read and a live read of the state, and delivers slow-state results asynchronously. The next section maps Cobalt's Secretary of State API against that specification.
Where Does Cobalt's Secretary of State API Fit, and What Does It Not Do?
Which parameters and fields map to the routing record?
The SOS Search endpoint accepts a business name or a sosId (state-dependent, as noted above) with a state, a liveData flag for live or cached retrieval, and callbackUrl or retryId for asynchronous completion.[7] It returns the seven routing fields where the state provides them, plus registered agent, mailing address, stateOfFormation, stateOfSosRegistration, a confidence score, and possible alternatives when the exact match is uncertain. One gap against that specification: no single request falls back from cache to live on its own. The caller picks through liveData, true by default,[7] so the broker's code sequences the two calls, as the four-step flow does. A separate Suggest endpoint returns candidate names, sosId values, states, and one address as the applicant types, and it returns immediately with no retryId to handle.[38] Cobalt's Secretary of State API fields reference documents the response field by field, and the top 34 questions about the Secretary of State API collects general buyer and integration questions.
Which limitations must the broker design around?
Cobalt is a data source, not a decisioning engine; the tenure cutoffs, status gate, and match thresholds are the broker's rules. The integration has to absorb every limit above: the slow live tail, officers from 32 of 51 jurisdictions in the measurement, state-by-state gaps in ID search and the normalized fields, a cache that can lag a new entity by weeks to a quarter,[25] and beneficial ownership that registries generally do not carry. For security, request Cobalt's current security documentation rather than rely on marketing copy.
What should the operations lead bring to an integration review?
Bring the applicant state mix for the last quarter, the share of applicants formed within the past 12 months, the current wait tolerance inside the vendor form, the tenure cutoffs each lending partner accepts, and the states where officer matching matters to a partner. To walk through that routing workflow against Cobalt's current endpoint behavior, schedule an integration review.
The applicant should never know which state was slow.
.jpg){kind=small}
.png)