I hit a wall a few weeks ago while working on a Gulf compliance problem:
Every global company-data API stops at Europe.
Stripe's data products, OpenCorporates, the big aggregators — none of them cover Saudi Arabia, UAE, Kuwait, Qatar, Bahrain, Oman or Lebanon. The data exists, but it's scattered across seven government portals, most of them Arabic-only. For a developer, "verify this Gulf company" means manual hunting through portals and PDFs.
So I built the thing that should have existed — and today it's live on Product Hunt.
What it does
One endpoint:
POST /api/v1/verify-company
{ "country": "SA", "trn": "310000000000000", "name": "Acme Trading LLC" }
returns:
{
"country": "SA",
"trn_format_valid": true,
"verdict": "likely",
"risk_tags": [],
"checks": {
"registry_live": "not_queried_no_feed",
"sanctions_match": "not_queried_no_feed"
}
}
It validates TRN/VAT format against each country's rules, returns risk heuristics from the company name, and does it through one deterministic contract.
The decisions I care about most
Copy-once API keys. The raw key is shown exactly once. After that we store only SHA-256(key + pepper) plus a display prefix. A leaked key reveals nothing about the customer; a lost key is never recoverable.
Honest status codes. 401, 403, 409, 429 each mean a real thing. No vague 500s.
Deliberately honest scope. Today it validates TRN/VAT format and risk heuristics. It does not fake "registered" — every response carries registry_live: not_queried_no_feed until we license a real Gulf data feed. I'd rather ship a tool that tells you what it can't verify than one that silently invents a verdict someone builds a compliance decision on.
Anti-abuse by default. Email double opt-in, disposable-domain blocking, per-IP caps, per-key quotas and rate limits, and request-level tracing.
Try it
About 60 seconds: enter your email, click the sign-in link, create a key, then run curl.
KEY="lb_test_"
HDR="x-api-key"
curl -X POST https://mena-biz-api-nassims-projects-08916750.vercel.app/api/v1/verify-company \
-H "$HDR: $KEY" \
-H "Content-Type: application/json" \
-d '{"country":"SA","trn":"310000000000000","name":"Acme Trading LLC"}'
500 free calls for the first 50 signups — no card.
And we're live on Product Hunt today:
[PASTE YOUR PRODUCT HUNT EMBED CODE HERE]
The part I'm stuck on
Live registry verification. The Gulf data providers (CRIF / D&B Gulf, Kyckr) quote enterprise pricing — around $0.24 per lookup. At a consumer API price that erases the margin.
So: how have other dev-tool builders licensed expensive registry data without losing money on every call? And if you work with Gulf companies or KYC — what data would you actually pay for?
Genuinely want to hear it.
Top comments (0)