The US Corporate Registry API, Explained: One Call, 51 Separate Registries

Executive Summary: A corporate registry API is a single programmatic interface that queries the official business registration records the United States keeps in 51 separate places instead of one. There is no federal database of American companies. An LLC formed in Ohio, a corporation chartered in Delaware, and a partnership registered in Arizona each live in a different government system, with different field names, different status vocabularies, different access rules, and different response times. For a lender underwriting a merchant cash advance in forty states, that fragmentation is not a trivia point. It is the reason entity verification either runs in seconds or turns into a queue of analysts with fifty browser tabs open.

Why Does the United States Have No Single National Corporate Registry?

Company formation in the US is a matter of state law, not federal law. The Small Business Administration puts the division plainly: "If your business is a limited liability company (LLC), corporation, partnership, or nonprofit corporation, you'll probably need to register with any state where you conduct business activities."^[1] Federal registration exists only for narrow purposes such as trademark protection or tax-exempt status. There is no federal act of incorporation and no federal register of incorporated entities.

Which Office Actually Holds the Record in Each State?

Most of the time it is the Secretary of State. The National Association of Secretaries of State describes the function directly: "Most NASS member offices handle the registration of domestic and/or foreign corporations (profit and non-profit)," covering filings of incorporation, partnerships, mergers, and dissolutions, with the caveat that "Fees vary from state to state."^[2] The NASS jurisdiction list runs to 52 entries once the District of Columbia and Puerto Rico are counted.

But "Secretary of State" is a convention, not a rule, and the exceptions matter when you are writing routing logic. Arizona's filings run through the Arizona Corporation Commission, whose Corporations Division "provides a multitude of services for Arizona businesses, including approving articles of incorporation to start a corporation, approval of articles of organization to start a limited liability company (LLC)."^[3] The SBA acknowledges the variation too: "Most states require you to register with the Secretary of State's office, a Business Bureau, or a Business Agency."^[1] Any integration that hardcodes a single office name per state will break the first time it hits one of the outliers.

Did the Corporate Transparency Act Create a National Registry?

It did not, and after March 2025 it is even further from one. FinCEN's interim final rule narrowed beneficial ownership reporting "to require only entities previously defined as 'foreign reporting companies' to report BOI."^[4] The revised definition of a reporting company covers an entity that is "(A) A corporation, limited liability company, or other entity; (B) Formed under the law of a foreign country; and (C) Registered to do business in any State or tribal jurisdiction by the filing of a document with a secretary of state or any similar office under the law of that State or Indian tribe."^[4] Entities created domestically by filing with a secretary of state received a new exemption. The rule took effect on the date of publication, March 26, 2025.

Read the regulatory text closely and the point of this article is embedded in it. Even the federal government defines a company by reference to "a secretary of state or any similar office." The state filing office remains the record of authority. The pillar guide to Secretary of State API solutions walks through the vendor landscape that grew up around that fact.

What Is a Corporate Registry API, and What Sits Underneath It?

A corporate registry API is an abstraction over the state filing offices. You send one request describing the business you want; the service resolves which state system to query, executes the lookup against that state's live records, parses the response, and hands back a normalized object. The API does not own the underlying data. It owns the routing, the parsing, the normalization, and the retry behavior.

What Does the API Layer Actually Do?

Five jobs, and they are the five jobs an in-house team would otherwise own:

• Routing. Map a state code to the correct office, portal, and query form, including the states where the office is not the Secretary of State.^[3]

• Query translation. Convert one request shape into the exact-match, fuzzy, or entity-ID search each portal supports.

• Parsing. Extract structured fields from portals designed for human reading rather than machine consumption.^[5]

• Normalization. Reconcile fifty status vocabularies, address formats, and date conventions into one schema.

• Evidence capture. Preserve the source URL and, where offered, a timestamped screenshot of the state page at the moment of the lookup.

That last item is the one lenders undervalue until an audit. A link alone does not prove what the state page said on the day you funded.

What Does a Request and Response Look Like?

Cobalt Intelligence exposes a single search endpoint that takes the state and one identifier:

curl --location 'https://apigateway.cobaltintelligence.com/v1/search?searchQuery=Acme%20Corp&state=delaware&liveData=true&screenshot=true' \
--header 'x-api-key: Your_API_Key' \
--header 'Accept: application/json'

The response returns the normalized entity record rather than the state's raw markup:

{
  "status": "complete",
  "statusCode": 200,
  "requestId": "abc123-def456",
  "results": [
    {
      "title": "ACME CORPORATION",
      "filingDate": "2015-03-15",
      "stateOfFormation": "Delaware",
      "status": "Active",
      "entityType": "Corporation",
      "registeredAgent": {
        "name": "CT Corporation System",
        "address": "1209 Orange St, Wilmington, DE 19801"
      },
      "sosUrl": "https://icis.corp.delaware.gov/ecorp/...",
      "screenshotUrl": "https://screenshots.cobaltintelligence.com/..."
    }
  ],
  "possibleAlternatives": []
}

Search accepts a business name, an entity ID, or a person's first and last name, with optional street, city, and ZIP filters to narrow noisy results. If you are deciding between exact-identifier retrieval and name-based discovery, the tradeoffs are covered in the company lookup API versus company search API comparison.

Why Does the Same Data Field Look Different in Every State?

Because each state wrote its own statute, built its own portal, and chose its own words. Nothing coordinated them.

How Do Status Values Diverge?

One state's "Active" is another state's "In Good Standing," a third state's "Existence Active," and a fourth state's blank field with an implied meaning. Delaware makes the ambiguity explicit on its own free search page: "The search results will return both active and inactive entities from our database. This is not an indication of the current status of an entity."^[6] The free Delaware search returns "The entity name, file number, incorporation/formation date, registered agent name, address, phone number and residency," and anything beyond that, including a certificate of status, costs money.^[6]

A team that scrapes Delaware's free search and treats a returned record as proof of good standing has built a false positive into its underwriting. Cross-state status interpretation is its own discipline, handled in the guide to reading registration statuses across states via API.

Why Do Officer and Agent Fields Disappear in Some States?

Because the statutes require different disclosures. California Corporations Code section 1502 obliges every corporation to file a statement "within 90 days after the filing of its original articles and annually thereafter," listing the names and addresses of directors and the chief executive officer, secretary, and chief financial officer, the principal executive office address, the general type of business, and the agent for service of process.^[7] Other states require far less, or publish far less of what they collect. An aggregating API can return only what the state makes available, which means officer coverage is genuinely uneven and any vendor claiming uniform officer data across fifty states is describing something the source records do not contain.

What Does It Cost to Query 51 Registries Yourself?

More than the line item you would expect, and the expensive part is not the per-search fee.

What Are the Direct Access Costs?

• Per-search charges. Texas SOSDirect states that "There is a $1.00 statutorily authorized fee associated with each search," and access requires a funded SOS Client Account.^[8]

• Status-check charges. Delaware detailed entity status reports are the paid tier, not the free tier.^[6]

• Account and credential overhead. Several states gate access behind registered accounts with stored payment methods.^[8]

• Automation restrictions. Delaware's Division of Corporations "strictly prohibits mining data" and warns that "Use of automated tools in any form may result in the suspension of your access to utilize this service."^[6]

• Wildly uneven baselines. OpenCorporates measured the spread bluntly: "in open-data states you can get everything for $0; in restrictive states you might pay per record."^[5]

The automation restriction is the one that should stop a build-it-yourself plan at the whiteboard. A scraper aimed at a portal whose terms prohibit automated tools is an access risk sitting inside a production credit workflow.

"Most state systems are designed for manual human lookups, not automated querying." Only select states provide bulk access, and the assessment of US company data accessibility scored an average of only 31 out of 100.^[5]

What Are the Maintenance Costs Nobody Budgets For?

Fifty-one parsers, each pointed at a government web application that can be redesigned without notice, with no deprecation policy and no changelog. The build effort is finite; the maintenance is permanent. The full arithmetic, including engineer-hours and failure modes, is broken out in the SOS API versus building in-house cost comparison.

Volume makes it worse. Delaware alone reported 2,287,728 registered business entities and 334,461 new formations in 2025, "a more than fifteen percent increase over 2024."^[9] One state, one year, a third of a million new records to keep current.

How Does an Aggregating API Handle Slow and Restricted States?

By treating latency as a design constraint rather than an error condition.

What Happens When a State Takes Minutes, Not Seconds?

Most states return in 10 to 30 seconds on a live lookup. Oregon can take up to five minutes. Delaware runs 15 to 30 seconds. A synchronous HTTP call cannot absorb that spread, so the API returns a `retryId` for polling or accepts a `callbackUrl` and posts results when the state finally answers. Two patterns, one endpoint:

• Polling. Take the `retryId` from the initial response and re-query until `status` returns `complete`.

• Callback. Pass `callbackUrl` on the original request and receive the result asynchronously.

• Cached pre-screen. Set `liveData=false` for a sub-second response drawn from a monthly refresh, then escalate to `liveData=true` only for records that clear the pre-screen.

• Test mode. Use the `test` parameter to exercise `complete`, `incomplete`, `failed`, and `badRequest` paths before you touch production traffic.

• Address narrowing. Add `street`, `city`, or `zip` in states that return large candidate sets for common names.

The waterfall pattern is the one that changes unit economics. Cached first for volume, live only where the decision depends on it. If you are designing the receiving end of the callback, the async webhook architecture guide for long-running SOS lookups covers the queue and idempotency mechanics.

How Do You Keep an Audit Trail When the Source Is a Web Page?

Set `screenshot=true` and the response includes a timestamped image of the state page as it appeared at verification time, alongside the `sosUrl` pointing at the state record itself. The limitation is real and worth stating: those screenshot URLs are valid for a limited window of roughly 3 to 30 days, so the file has to be pulled down and stored in your own system of record. An API that hands you evidence you never download has not given you an audit trail.

What Can a US Corporate Registry API Not Tell You?

This is where honest vendors and optimistic ones separate. A registry API reports what the state holds, nothing more.

• It does not price risk. The API returns `status`, `filingDate`, and `entityType`. Deciding what an inactive status means for a $180,000 advance is your credit policy's job, not the data provider's.

• It does not see unfiled reality. A business that stopped operating in January but has not been administratively dissolved still reads Active until the state acts.

• It does not carry uniform officer data. Officer and director availability varies by state because state disclosure rules vary.^[7]

• It does not eliminate state fees. Delaware sells online entity status in a $10 tier and a $20 tier, and that state-imposed charge passes through at cost.^[15] New Jersey status data is restricted by statute with a small fee attached.

• It does not verify tax identity. The EIN is "a federal tax ID number for businesses, tax-exempt organizations and other entities" issued by the IRS, and it lives in an entirely different system from any state registry.^[10]

Cobalt's Find Related Businesses feature, which surfaces other entities linked to the agents and officers on a result, is currently in beta and can add 1 to 2 seconds at the top end of response time. Useful for fraud pattern detection, not yet something to build a hard decision rule around.

Even a state's own filing does not guarantee accuracy, and the point is not unique to the US. The UK's single national registry carries the same caveat on its search service: "Companies House does not check the accuracy of the information filed."^[11] Registry data is authoritative about what was filed. It is not an audit.

Where Should the Registry Call Sit in an Underwriting Decision?

Early, cheap, and before anything expensive runs.

Which Signals Actually Change a Credit Decision?

Four fields carry most of the decision weight. `filingDate` establishes time in business, which drives minimum-tenure rules across nearly every MCA and revenue-based product. `status` flags dissolved, inactive, and administratively terminated entities before capital moves. `stateOfFormation` reveals whether the applicant is operating outside its formation state without foreign qualification, which the SBA describes as filing "a Certificate of Authority with the state" and often producing "a Certificate of Good Standing from your state of formation."^[1] Multi-state exposure detection is treated at length in the foreign qualification verification guide. And `registeredAgent` gives a cheap consistency check against the application.

Delaware supplies a concrete example of why status deserves monitoring rather than a single check. Under Delaware Code title 8, every corporation must file an annual franchise tax report to the Secretary of State "annually on or before March 1," and a corporation that neglects for a year to pay franchise tax or file a complete report loses its charter, with the Governor issuing an annual proclamation declaring that "the charters of these corporations are repealed."^[12] An entity that was clean at origination can lose its charter on a statutory calendar you can predict.

How Do You Handle a No-Result Without Declining a Real Business?

A null result is not proof of nonexistence. It usually means one of four things: a name variation the portal did not match, a formation in a different state than the application claims, a filing too recent to appear in the state database, or a search that would have succeeded on entity ID rather than name. The `possibleAlternatives` array returns up to ten close matches for exactly this reason, and the confidence score attached to each result gives operations a threshold to route on rather than a binary. High-confidence matches auto-clear, mid-range matches queue for human review, low-confidence matches do not get treated as the applicant at all. Coverage depth by state, including which states run thin, is mapped in the SOS API data coverage checklist.

How Does the US Model Compare to Countries With a Single Registry?

Badly, if you are the one integrating. The European Union interconnected its member state registers years ago: "As of June 2017 the business registers of all EU countries have been interconnected and become searchable."^[13] The UK runs one national register with a public search service covering filing, company data, document images, and disqualified director records.^[11] Globally, the Legal Entity Identifier offers "a unique 20-character alphanumeric code that enables anyone, anywhere in the world, to access clear, unique identification data about a legal entity."^[14] LEI coverage skews toward entities with financial market obligations, so it does not substitute for state registration data on a small trucking company in Ohio.

The practical consequence for a US lender is that no roadmap item will consolidate these registries for you. The fragmentation is statutory, a product of fifty legislatures that each own their corporate code, and there is no pending mechanism that merges them. FinCEN's 2025 rule moved in the opposite direction by exempting domestically formed entities from federal beneficial ownership reporting.^[4]

So the choice is binary. Either your team owns 51 integrations against government portals that change without warning and sometimes prohibit automation, or you buy the abstraction and spend your engineering time on credit logic instead of HTML parsing. For a comparison of the specific verification services available, see what Cobalt Intelligence offers, and for the manual baseline any API is competing against, the California Secretary of State business search guide shows what a single state lookup costs an analyst in clicks.