Every global company-data API stops at Europe.
Stripe's data products, OpenCorporates, the big aggregators — none of them cover Saudi Arabia, UAE, Kuwait, Qatar, Bahrain, Oman, or Lebanon. The data exists, but it's scattered across seven government portals, most of them Arabic-only, some permission-only. For a developer, "verify this Gulf company" means manually hunting through portals and PDFs.
So I built the thing that should have existed.
What I built
One endpoint:
POST /api/v1/verify-company
{ "country": "SA", "trn": "310000000000000", "name": "Acme Trading LLC" }
returns:
{
"country": "SA",
"trn_format_valid": true,
"verdict": "likely",
"risk_tags": [],
"checks": {
"registry_live": "not_queried_no_feed",
"sanctions_match": "not_queried_no_feed"
}
}
It validates TRN/VAT format against each country's rules (Saudi 15 digits starting 3, UAE 15 starting 1, Kuwait/Bahrain 9, Qatar 10, Oman 8, Lebanon 5-8), surfaces risk heuristics from the name (offshore, generic-shell, newly-registered), and does it all through one deterministic contract.
The design decisions I'm actually proud of
1. Copy-once API keys
The raw key is shown to the user exactly once. From then on we store only:
SHA-256(key + pepper) and a display prefix like "lb_test_..."
Not the key itself. So a leaked key reveals nothing about the customer, and a lost key can never be recovered — you revoke it and mint a new one. This is the pattern Stripe and OpenAI use, and it's the whole game: the real key exists in exactly one place, the customer's clipboard.
2. Honest status codes
400 malformed request
401 missing / invalid / revoked key
403 email not confirmed yet
409 email already has a verified key
429 quota, rate limit, or too many signups from this IP
Each one means a real thing. No vague 500s. If you're a developer integrating this, the error tells you exactly what to fix.
3. A gatekeeper that actually gates
Every call goes through a middleware that checks the key hash, enforces a per-key quota (500 calls on the founder tier), a per-key rate limit (60 req/min, derived from the usage log so it holds across serverless instances), and traces every request with an x-request-id.
4. Anti-abuse signup
Email double opt-in (keys return 403 until confirmed), disposable-domain blocking, and per-IP caps. A squatted email can always be reclaimed by its real owner.
The decision I want feedback on most: honest scope
This is the part I'd genuinely like the community to weigh in on.
Today the API validates TRN/VAT format and returns risk heuristics. It does not query live government registries or sanctions lists. Every response carries this flag:
{ "registry_live": "not_queried_no_feed" }
I chose to ship a tool that tells you exactly what it cannot verify rather than one that silently fakes "registered" — because if someone builds a compliance decision on a fabricated verdict, that's on the tool.
The hard part is next: live registry verification. The Gulf data providers (CRIF / D&B Gulf, Kyckr) quote enterprise pricing (around 0.24 USD per lookup). At a consumer API price that wipes the margin out. So I'm stuck on the classic data-moat pricing problem — and I'd love to hear how other dev-tool builders have solved licensing expensive registry data.
Try it at:https://mena-biz-api-nassims-projects-08916750.vercel.app/**_
-
_**
About 60 seconds: enter your email, click the sign-in link, create a key, then run curl:
KEY="lb_test_"
HDR="x-api-key"
curl -X POST https://mena-biz-api-nassims-projects-08916750.vercel.app/api/v1/verify-company \
-H "$HDR: $KEY" \
-H "Content-Type: application/json" \
-d '{"country":"SA","trn":"310000000000000","name":"Acme Trading LLC"}'
Founder offer: 500 free calls for the first 50 signups, no credit card.
Site: https://mena-biz-api-nassims-projects-08916750.vercel.app/
If you work with Gulf companies, KYC, or vendor onboarding — what data would you actually pay for? I'd genuinely like to know.
This is build-in-public. I'll follow up with the live-registry pricing saga and whatever the community tells me.
Top comments (0)