BUMIT

npx add-mcp 'https://bumit.ai/mcp'

Skip to content

BUMIT.

Docs MCP Capabilities Status OpenAPI

Developer documentation

Integrate deterministic Swiss business verification.

REST and JSON under /api/v1. Start with the generated OpenAPI document; this page explains how to interpret its contract.

On this page

• Getting started
• Endpoints
• Decisions
• Provenance
• Availability
• Errors
• MCP

Getting started

Use a structurally valid Swiss UID. The production base URL is deployment-specific; all API paths are versioned.

POST /api/v1/verify-business
{ "uid": "CHE-000.000.000" }

Endpoints

Company search

GET /api/v1/company/search?q={name}

Business verification

POST /api/v1/verify-business { uid, name?, address? }

LEI lookup

POST /api/v1/lei-lookup { uid }

VAT status

POST /api/v1/vat-verify { uid }

Registry events

POST /api/v1/registry-events { uid, limit? }

Business identifiers go in the request body, never the URL. The older GET /api/v1/company/ {uid} routes are deprecated (sunset 2027-03-31) and name their replacement in a Link header. Fixture-only paths remain documented but unavailable for production use. See capabilities.

Decision semantics

PASS

REVIEW

FAIL

UNKNOWN

Every applicable mandatory check of the configured verification profile obtained sufficient usable evidence and none produced REVIEW or FAIL. PASS does not mean safe to transact, complete KYB, legal approval, risk-free, ownership/control screened, or signatory authority confirmed.

Profile: SWISS_BUSINESS_BASELINE_V1 / 1.0.0. Mandatory: existence, active status, direct sanctions screening. Optional evidence cannot compensate for mandatory UNKNOWN.

Data sources

BUMIT derives its answers from Swiss public and authoritative sources. Each source is used in a different way, and not every implemented source is active in this deployment. The status page and capabilities page show what is available right now.

Zefix — Swiss commercial register

Queried during verification when no stored copy is held (cache-first). A stored copy of a previously retrieved register record may be used instead of a new request. Upstream traffic is limited by a shared safeguard; if Zefix is unavailable, the result says so.

SECO — Swiss sanctions list

Answered from a dataset ingested by an operator, not queried during verification. Automatic acquisition is disabled. Checks are available only while an accepted dataset is active.

FINMA — authorisation and warning lists

Authorisation checks are answered from a dataset ingested by an operator, not queried during verification. Automatic acquisition is disabled. Absence from a list never proves absence of authorisation.

SHAB / SOGC — registry events

Adapter implemented; production acquisition is disabled by default. Availability is shown on the status page.

GLEIF (LEI), UID/VAT register, swisstopo (addresses)

Fixture-only: implemented for deterministic tests, not operationally available. Checks depending on them return an unavailable or unsupported result, never a positive one.

Freshness and provenance

There is no single "last updated" time for all BUMIT data. Freshness depends on the source: a register record reflects when it was retrieved from Zefix, and list checks reflect when the accepted dataset was retrieved (shown as its retrieval time on the capabilities page). Source publication timing, ingestion timing, availability and upstream changes all affect results.

Claims distinguish SOURCE_FACT, NORMALIZED, DERIVED, INFERRED, and UNAVAILABLE. Responses expose source, observation time, freshness, evidence class, and ruleset version, so consumers can see the evidence behind each result. The deterministic baseline uses no inference.

Capability availability

SUPPORTED means BUMIT implements the contract. AVAILABLE means this deployment can serve it using configured operational evidence. NOT_AVAILABLE means it cannot currently be served. FIXTURE_ONLY means deterministic test support exists but production evidence does not.

MCP

AI agents can call BUMIT over the Model Context Protocol at https://bumit.ai/mcp (Streamable HTTP). There is currently one tool, verify_business, covering Swiss businesses only. No sign-in or API key is currently required, and no payment is currently required.

A successful MCP tool call does not mean the business is VERIFIED. Read result.outcome: UNAVAILABLE, REVIEW_REQUIRED, NOT_FOUND, AMBIGUOUS, NOT_VERIFIED and UNSUPPORTED are valid business results, not transport errors. The authoritative semantics are the OpenAPI business-verification contract. An experimental descriptor is at /server-card; it is a convenience and not required by the protocol.

Errors and reason codes

Machines should branch on stable reason_code values, never mutable message prose. Errors identify whether retrying may succeed and never expose internal exception details.

INVALID_UID``COMPANY_NOT_FOUND``SOURCE_NOT_CONFIGURED``SOURCE_UNAVAILABLE``SOURCE_TIMEOUT``SOURCE_RATE_LIMITED``STALE_EVIDENCE``INSUFFICIENT_EVIDENCE``CAPABILITY_NOT_AVAILABLE``AUTHENTICATION_REQUIRED``ACCESS_DENIED``UPSTREAM_DEGRADED

BUMIT.

Privacy Terms Support

Authoritative evidence · Deterministic rules