Executive Summary: Search by SOS ID when the file holds a state entity number with a traceable source, and search by business name to find a record the file does not yet hold. Cobalt's API reference accepts sosId as a search input, and its help center says a state plus registration ID scopes the lookup to that one record, but Cobalt's field spreadsheet marks ID search for only Florida and Mississippi: it marks neither Texas nor Ohio. So this guide does not offer ID search as the Texas or Ohio fix; it shows how to confirm ID search in a state, and what to do by name where it is not confirmed.
Why does a correct business name return nothing in some states?
Both cases below come from one reviewer, and Cobalt's field spreadsheet marks ID search for neither Texas nor Ohio, so this article shows how to confirm ID search in a state and what to do by name when it is not confirmed.
What does the Texas punctuation problem look like?
A prospect's reviewer said the Texas search they use, the Comptroller's site rather than the Secretary of State's, returns nothing unless the name matches exactly, including punctuation such as a comma. Neither the Comptroller's search page nor Cobalt's help center documents that matching rule, so treat it as one reviewer's report about one interface. The Texas Comptroller's Franchise Tax Account Status Search accepts an 11-digit taxpayer number or 9-digit federal EIN, an entity name between 2 and 50 characters, or a Texas Secretary of State file number of 6 to 10 digits.[1] Separately, the Texas Secretary of State has announced that SOSPortal, its new business filing system, goes live on September 29, 2026 and replaces both SOSDirect and SOSUpload, bringing filing, ordering, and searching into one platform,[2] so matching behavior learned on the Secretary of State's old search can change.
What did the reviewer report about Ohio?
The same reviewer reported that in Ohio a correctly entered name sometimes returns nothing while a search by the entity number finds the record. Cobalt has not published Ohio's index rule. Cobalt's own measurement on September 11, 2026 searched three large national companies by name in the 50 states and the District of Columbia, 153 probes with a 180-second ceiling each. In Ohio, two probes returned a record in about 65 seconds and the third did not finish inside the ceiling; none came back empty. That neither reproduces nor rules out the reviewer's miss, because the measurement covered one day and three well-formed names, shows what a state can return rather than what it never returns, and is not a service expectation. Test current Ohio behavior with known entities, by name and by number, before relying on either path.
Why are these input failures and not coverage failures?
In both cases the reviewer described, the record was on file and a different input found it. Each state runs its own filing office, database schema, status vocabulary, and disclosure policy, and an aggregating API is a normalization layer over 51 independent systems.[3] So a no-result has three possible meanings: the entity is not registered in that state; the entity is registered under a different string than the one sent; or the state index did not surface a record it holds. Only the first is a verification finding. Cobalt's own guidance says to treat a no-result as a useful signal, that if a manual search also fails, the supplied name or registration may be inaccurate or unregistered, and that a down state site or an error produces a clear error message instead.[4] Cobalt asks customers to report any record visible on the state site that the API does not return.[5]
What does a state actually index when it searches a name?
How do Texas naming rules treat punctuation?
Under the Texas Administrative Code, names are the same, and therefore not available, when the only difference is this condition:[6]
The addition, substitution, or omission of punctuation marks, accent marks, periods, spaces, or symbols that do not alter the name sufficiently to make the names distinguishable. (A) "A.F.G. Consulting" is the same as "AFG Consulting".
Under that rule, "AFG Consulting, LLC" and "AFG Consulting LLC" are the same name for availability. For retrieval, the record exists under one exact string, the one on the certificate, and a search index may key on that string alone.
Why is an ampersand different from the word and?
Cobalt does not globally convert an ampersand to the word and, because many state search pages treat the two as distinct characters and can register different legal names, such as "Pizza & Pasta" and "Pizza and Pasta"; converting automatically can return the wrong legal entity.[7] Before any query runs, Cobalt applies a base normalization that straightens smart quotes, converts dashes to hyphens, removes invisible characters, collapses whitespace, and lowercases the query; further adjustments depend on the state, since some states accept characters such as a slash and others need stricter normalization. If the first search returns nothing and abbreviations appear to be involved, a second pass can expand them, such as "First Natl Bank" to "FIRST NATIONAL BANK", and the returned confidence may still be lower than an exact match.[8]
How do assumed names and DBAs complicate a name search?
Applicants sometimes supply the trade name. In Texas, a corporation, LLC, or LP doing business under a name other than the legal name in its certificate of formation must file assumed name certificates with the Secretary of State and with the county clerk.[9] When a fictitious name is searched, Cobalt may return that record with the legal entity shown under the assumed business names section of the response,[10] and many states do not publish DBA data at all.[11] Some states merge DBA and legal names, and Cobalt's help center gives the example of a search for "Home Center" that can show a 100 percent match in the list view while the legal detail shows "3855 Eight Mile Corp".[12]
What is an SOS ID and why does every state have one?
What does the identifier get called in each state?
Cobalt defines sosId as the official registration number the state Secretary of State assigns, unique within that jurisdiction.[13] Every jurisdiction returned one in Cobalt's September 11 measurement, and Cobalt's public field spreadsheet marks the sosId field for all 52 jurisdictions it lists, including Puerto Rico.[14] Delaware's Division of Corporations search accepts an entity name or a file number and returns the entity name, file number, formation date, and registered agent details.[15] The Texas Comptroller calls it the Texas Secretary of State file number.[1] The Puerto Rico business name versus SOS ID guide applies the same division of labor to Puerto Rico: the name starts discovery, and the SOS ID retrieves a record already selected. Cobalt's help center calls it the state registration ID and says a single-state lookup needs the business name, or that ID if available, plus the state.[16]
Where does a lender get the entity number legitimately?
The number has to come from a source the lender can trace, and an empty name search leaves nothing to copy a number from. The legitimate sources are narrow:
• The file-stamped formation document. When the state's filing stamp or acknowledgment shows the entity number, the filed copy is the primary source.
• A certificate of status or good standing. Where the state prints the entity number on the certificate, it is a second filed-record source.
• A prior accepted search. A retained sosId from a record the lender already selected and reconciled, which is the right input for a pre-funding recheck.
• A form-time selection. When the applicant is present, an entity chosen from a candidate list can carry its identifier into the file, as described in the business name autocomplete guide for lenders.
• An analyst copy from the state site. A reviewer who finds the record manually copies the number into the case, for the reason Cobalt gives for tracking the validated legal name actually used apart from the raw client input: it improves reproducibility and lets a team re-run consistently.[17]
OCR of the filed document is a reasonable capture method, but its output is an assertion until an analyst confirms it or a search result agrees with the file.
FinCEN's customer due diligence rule defines a legal entity customer to include a corporation, limited liability company, or other entity created by the filing of a public document with a Secretary of State or similar office.[18] That rule binds covered financial institutions, a term it takes from 31 CFR 1010.605(e)(1),[18] which lists banks, securities broker-dealers, futures commission merchants and introducing brokers, and mutual funds,[19] so it does not reach most non-bank alternative lenders. For any lender, the number on that public filing is still the closest thing to a primary key for the borrower entity.
What can an SOS ID not prove?
An identifier retrieves a record. It does not prove that the person applying controls the entity, who owns it, whether its TIN matches, what liens exist, or whether anyone connected to it is sanctioned. And because the number is state-scoped, it cannot settle a case the same reviewer described, where two states each held a domestic LLC with the same name and the same associated individual; that case needs the lender to ask which entity is borrowing.
How does the name-search retry work before it fails?
What does the punctuation and suffix waterfall retry?
Cobalt applies a waterfall automatically: it tries an exact match with the submitted name, then strips punctuation and entity suffixes such as LLC or Inc, then returns alternatives with confidence scores and an addressMatch flag, which helps catch missing punctuation, wrong suffixes, and typos.[20] Where a city or ZIP is supplied, Cobalt biases toward candidates that align on it, can drop the last token of the name if needed, and returns an explicit addressMatch value of true or false either way.[21]
Stripping removes punctuation, but it cannot restore a comma the applicant left out, so if a state's search needs the exact filed string and lists nothing close, the name path can still miss. Cobalt's top 34 questions about the Secretary of State API cover the wider set of questions buyers ask about the API.
How should the confidence score and alternatives be read after a retry?
A missing suffix alone can move a match below 1.0: Cobalt's example is an input of "Boom City Brewing Company" that may return "Boom City Brewing Company LLC" at 0.86 confidence.[22] Cobalt's typical guidance is 0.80 and above to auto-accept, 0.60 to 0.79 to review, and below 0.60 usually to reject unless other signals such as address are strong,[23] and the lender sets its own lines. The alternatives array holds up to about ten candidates. With an address, Cobalt retrieves fuller details for them, including entity status, filing number, and date; without one, it returns what the state's results page shows, names and URLs.[24] In the API reference, possibleAlternatives entries on a completed result carry a sosId field, and alternativeResults entries on a no-exact-match response carry both sosId and realSosId.[25] The reference does not define the difference, so confirm which value an ID request accepts, a case the test set below includes, before carrying an accepted candidate's number into the next request. The guide to reviewing alternative matches before funding covers the review step itself.
When should an integration search by SOS ID instead of business name?
Use the ID whenever the file can supply one with provenance and the state's ID lookup is confirmed, meaning Cobalt's field spreadsheet marks the state for searchBySosId, as it did for only Florida and Mississippi on September 24, 2026,[14] or the lender's own test file shows ID lookups there returning the named record. Use the name to discover a record the file does not yet hold, and as the fallback wherever the ID lookup is unconfirmed.
Which file states justify an ID-first request?
• The file holds a number from a filed document. Send sosId with the state first; a name search adds only a chance to miss.
• The file holds a prior accepted record. Reuse the retained sosId for a pre-funding recheck or a refresh, and keep the link to the earlier selection event. Business Monitoring can also enroll the business by sosId and state and check it every 1 to 30 days.[26]
• A correct name returned nothing. When the applicant can supply the formation document, retrieve by number instead of guessing at punctuation variants.
• The name search returned a close alternative with a filing number. After a reviewer accepts the candidate, re-request by that number so the retained record is the accepted one.
• The applicant supplied a trade name. A DBA search may resolve to a legal entity the application never named; the number on the filed documents points at the entity that will sign.
• The legal name is short or generic. Cobalt's help center notes that small differences lower confidence disproportionately on short names,[27] and generic names return crowded candidate lists that a number bypasses.
When should the name still go first?
When the file has no number with provenance, or the state's ID lookup is unconfirmed, the name is the discovery input, sent with the state scope the application supports. Include the entity suffix if it is trusted, because accurate suffixes typically improve match certainty and the normalized fallbacks still run if needed.[28] Send city and ZIP when they are known, since ZIP is applied across the physical, mailing, and registered-agent address fields, does not relax automatically, and produces an addressMatch flag for the lender's own rule.[29]
What should happen when the name and the ID disagree?
Stop the automatic route. A name request and an ID request that return different records can mean a suffix variation, a DBA, a legal name change after the documents were issued, a mistyped number, a foreign registration, or a different entity with a similar name. The article on what happens when application data does not match Secretary of State records covers how lenders route those mismatches.
A team can do all of this without a vendor: analysts can search each state site by number, a scraping layer can be built against each portal, or a full-service verification platform can run the lookup inside a wider onboarding product. Hand searches do not scale, and a platform that owns the decision layer is more than a data-only buyer wants. What follows is the identifier route when the integration calls Cobalt's Secretary of State API directly and keeps the rules on its own side.
How does the sosId parameter work in the Cobalt SOS API?
What does an ID-first request look like?
The SOS Search endpoint needs one search input, searchQuery, sosId, or a person-name query, plus a state, and returns a bad request message when either is missing or the state is not a camel-cased name or two-letter abbreviation.[30] The public API reference lists sosId, described as the entity ID to search for, beside searchQuery and state, with liveData, screenshot, and callbackUrl as options.[25] An ID-first request for a Texas entity, a test case until Texas is confirmed, looks like this:
GET /v1/search?sosId=TX-EXAMPLE-0000001&state=tx&liveData=true&screenshot=true
Host: apigateway.cobaltintelligence.com
x-api-key: YOUR_API_KEY
Accept: application/jsonThe sosId value is a synthetic placeholder, not a real Texas file number. Cobalt's help center, answering a batch-upload question, says that when a request includes the state and the registration ID, the API scopes the lookup to that specific record only and does not look for additional or similar entities.[31]
What does the response carry that the lender must retain?
In Cobalt's September 11 measurement, eight fields came back from all 51 jurisdictions: status, normalizedStatus, filingDate, normalizedFilingDate, sosId, stateOfSosRegistration, title, and confidenceLevel. Registered agent and physical address fields came back from 41 to 49 jurisdictions, and officer records from 32 of the 51. Cobalt's field spreadsheet marks the state's record URL for 19 jurisdictions and a screenshot URL for all 52,[14] while the API reference calls the screenshot a short-lived URL not yet available in all states,[25] so check your states and download any image the file needs. Retain the input type used; a lookup by number and a lookup by name are different evidence. A customer-owned provenance record, which is not a Cobalt field, might look like this:
{
"caseId": "app-2026-091234",
"state": "tx",
"inputType": "sosId",
"idLookupBasis": "lender test set",
"sosId": "TX-EXAMPLE-0000001",
"identifierSource": "file-stamped certificate of formation, page 1",
"identifierCapturedBy": "intake-ocr",
"identifierConfirmedBy": "analyst",
"nameOnApplication": "Example Fabrication LLC",
"priorNameSearch": {
"searchQuery": "Example Fabrication LLC",
"state": "tx",
"outcome": "no_result",
"requestId": "req_example_01"
},
"note": "Illustrative customer-owned record with synthetic names and identifiers. Field names are the lender's, not the API schema."
}What limitations apply to ID search?
On September 24, 2026, Cobalt's field spreadsheet marked its searchBySosId row for only Florida and Mississippi, not Texas or Ohio,[14] while the API reference lists sosId as a general search input.[25] The sheet does not define the row. So run Texas, Ohio, and every other unmarked state through the test set below before routing files to the ID path; until a state passes, the name search, narrowed by city, ZIP, or street and reviewed through the alternatives list, is the fallback.
State search behavior varies and is not guaranteed. When a live lookup fails, or the state is down for maintenance, and recent data exists, the API reference shows the response returning that data with a message saying so.[25] The help center calls a failed live search answered with recent cached data Complete with fallback, and a search that failed completely Failed.[30] In Cobalt's September 11 measurement, the 110 live probes that returned a record took 1.51 to 170.27 seconds, median 15.01; 19 more completed with no exact match, three Nevada probes were answered from the cache while the state site was down for maintenance, and 21 did not finish inside the 180-second ceiling. Those were name searches, so they show how fast states answered that day, not how fast an ID search runs. A long search returns status Incomplete with HTTP 202 and a retryId to poll,[30] and the API reference offers a callbackUrl that receives the data when the search completes,[25] so an ID-first request in a slow state needs one of those patterns. Cobalt is a data source: it returns the record, the score, and the alternatives, and the lender's rules decide what happens next. No customer outcome is claimed for the ID-first pattern; the evidence is documentation and one prospect's described problem.
What should the lender-owned rule set look like?
Which fields feed the decision?
A starting rule set can use six inputs: the input type used; confidenceLevel; addressMatch; the returned title compared with the application name; normalizedStatus with the raw status kept beside it; and stateOfFormation, where the state returns it, compared with stateOfSosRegistration to spot a foreign registration. Cobalt's rules of thumb for combining confidence with address signals run as follows: high confidence with an address match supports auto-accept, high confidence without one is a likely match to verify by city or ZIP, mid confidence with an address match goes to review, and low confidence is reject or manual review regardless of address.[32]
How should a no-result be classified?
Record the reason class, not just the empty result. A cached-mode miss carries the message that no business was found in the database and suggests a live search,[30] which is a different state from a live no-result. A live name search with no exact match says so in its message and may offer alternativeResults, which makes it a review case rather than a no-result.[30] Classify a response that returns records with the optional top-level message field as a fallback answer, whatever the message's wording or HTTP status,[25] record it apart from a live hit, and rerun live before relying on it. In Cobalt's September 11 measurement, none of the 110 live records carried a message, while all three Nevada answers came back HTTP 200 with records and a maintenance message worded as in the API reference's 500 Failed example, not its 200 example. A live no-result with a name input is a candidate for the ID path if a document exists. A live no-result with a number input in a confirmed state is a stronger signal that the number, the state, or the entity is wrong; route it to a reviewer with the source document. In an unconfirmed state, it may only mean the ID lookup does not work there. A Failed response with no records is an error, not a finding of any kind.
What should the exception queue show?
It should show the name as submitted, the name actually searched, the number sent, the state, the returned title and number for each request, the source URL, the confidence and address flags, the reason class, and the owner.
How should an engineering team test the ID-first path before production?
Which cases belong in the test set?
Cobalt supports a sandbox mode in which test parameters return dummy responses, so a team can validate requests and integration flow before running live lookups.[33] Then run a live test file drawn from the lender's own book. Cobalt's coverage checklist recommends salting such a file with recently formed LLCs, entities with punctuation and abbreviation variants in the legal name, administratively dissolved entities, and entities from slow states.[3] For this path, add: a filed name with a comma before the suffix; the same name with the comma removed; an ampersand name; a DBA; a number with leading zeros as printed on the document; a number from the wrong state; a dissolved entity retrieved by number; a name and number that disagree; a state error during a number lookup; an alternative's sosId and realSosId, each sent as the number; and number lookups in Texas, Ohio, and each other high-volume state the spreadsheet does not mark for searchBySosId.
What should be measured after launch?
Measure the name-first hit rate and the ID-first hit rate by state, the share of files that arrive with a number captured at intake, the share of no-results that converted to a record once a number was supplied, and the exception reason mix. Keep a small gold set of known answers and re-run it on a schedule. Texas's move to SOSPortal is the kind of change that gold set exists to catch: the Secretary of State announced that online filing services, searches, and orders would be unavailable from noon on September 25 until the new system goes live at 8 a.m. on September 29, 2026.[2]
To review how an ID-first request fits your intake, exception, and recheck workflow, schedule a demo with Cobalt.
.jpg){kind=small}
.png)