The Polish VAT white list API moved. wl-api.mf.gov.pl stops on 1 December 2026

#api #poland #fintech #webdev

If your app checks Polish companies against the VAT white list (Wykaz podatników VAT, "Biała lista"), it most likely calls wl-api.mf.gov.pl. On 15 October 2026 the Ministry of Finance moved the API to a new host. The old one redirects for now and, according to the ministry, works only until 1 December 2026. The TLS certificate changed too.

I run this API in production for a public company lookup and a Pipedrive app, so here is what changed, what the limits are, and how I split calls after the move.

New hosts

Service	Before	From 15.10.2026
API, production	`wl-api.mf.gov.pl`	`wykazpodatnikowvat.mf.gov.pl/api/`
API, test	`wl-test.mf.gov.pl`	`wykazpodatnikowvat-test.mf.gov.pl/api/`
WL2, production	none	`wykazpodatnikowvat.mf.gov.pl/api2`
WL2, test	none	`wykazpodatnikowvat-test.mf.gov.pl/api2`

Paths are unchanged. /api/search/nip/{nip}?date=YYYY-MM-DD and /api/check/nip/{nip}/bank-account/{account}?date=YYYY-MM-DD work as before, only on the new host. Current docs are API 1.6.1 from 12 October 2026 (Swagger, PDF, error codes, test data) on the ministry page. No API key is needed.

Three methods, three limits

Method	You send	You get	Limit (per the ministry)
`search`	NIP, REGON or account, plus a date	full entry: name, addresses, VAT status, bank accounts, registration dates	100 requests a day, up to 30 entities per request
`check`	NIP or REGON, an account and a date	`TAK` or `NIE`: is this account assigned to this entity on that date	"5000 entities"
WL2 `/api2/status/nip/{nip}`	NIP, optional date	VAT status only: `Czynny`, `Zwolniony` or `Niezarejestrowany`	50 000 requests a day

A WL2 response looks like this:

{
  "result": {
    "subject": {
      "nip": "1111111111",
      "statusVat": "Czynny",
      "requestedDate": "25-10-2026",
      "responseDateTime": "25-10-2026 18:57:15",
      "requestId": "xxxxx-xxxxxxx"
    }
  }
}

Every response carries a requestId that proves the check was made on a given date. Store it next to the counterparty or the payment.

Two things the ministry page leaves open: the check limit says "5000 entities" without "per day", and the midnight block is described for search, check and the web search, with no word about WL2. I treat both limits as daily and do not assume WL2 survives a block.

What happens when you hit the limit

Access may be blocked until midnight (Warsaw time), and not only for the API: the block covers search, check and the search form on the ministry website. The error code list has "Limit żądań dla tego adresu IP został na dziś wyczerpany", so the limit is per IP. One feature that burns the pool cuts off every other feature on the same server.

100 search calls go fast when a public lookup page, CRM autofill and a nightly check all ask separately.

How I split calls now

nightly job, per watched company:
  status   = WL2 /api2/status/nip/{nip}          # 50 000/day
  if status changed:
      entry = search(nip)                         # 100/day, refresh accounts
  else:
      for account in known_accounts:
          if check(nip, account) == "NIE":
              entry = search(nip); break
new company:
  entry = search(nip)

VAT status via WL2. Checking every counterparty every night fits the 50 000 limit easily.
Known accounts via check. No need to pull the full entry to learn the account is still listed.
search only when it matters: a new company, a status change, or a NIE from check.
Separate pools. The public lookup, interactive CRM calls and the nightly job each get their own share of the 100 search calls, counted per Warsaw day. When search runs out, the user still gets the VAT status from WL2, with a note that accounts are unavailable until midnight.
Flat file at scale. The ministry publishes a daily file of hashed NIP and account pairs at wykazpodatnikowvat.mf.gov.pl/plik-plaski. No limits, but it only confirms pairs you already know.

Migration checklist before 1 December 2026

Grep code, env vars, firewall rules and allowlists for wl-api.mf.gov.pl and wl-test.mf.gov.pl.
If you pin certificates or run an old runtime with its own truststore, test the new host now.
Test against wykazpodatnikowvat-test.mf.gov.pl with the ministry's test data, not real customer NIPs.
Move plain VAT status checks to WL2 and known-account checks to check.
Store requestId and the response date.
Handle the limit error with a message, not an empty result.
If you use a plugin or invoicing tool, ask the vendor when it moves to the new host.

The full Polish guide, with the same tables and FAQ, is on polaczone.pl. If you just need to look a company up, the NIP lookup there already runs on the new host and WL2.

DEV Community