BUMIT
İsviçre şirketlerini UID veya adlarına göre resmî sicil, yaptırım ve FINMA yetkilendirme verilerini kullanarak doğrulayın; yapılandırılmış sonuçlar, kaynak bilgileri ve veri güncelliği sunar. Hesap veya API anahtarı gerekmez.
Barındırılan MCP Sunucusu
npx add-mcp 'https://bumit.ai/mcp'Claude Code, Codex, Cursor ve daha fazlasına kurulur
Dokümantasyon
Docs MCP Capabilities Status OpenAPI
Developer documentation
Integrate deterministic Swiss business verification.
REST and JSON under /api/v1. Start with the generated OpenAPI document; this page explains how to interpret its contract.
On this page
Getting started
Use a structurally valid Swiss UID. The production base URL is deployment-specific; all API paths are versioned.
POST /api/v1/verify-business
{ "uid": "CHE-000.000.000" }
Endpoints
Company search
GET /api/v1/company/search?q={name}
Business verification
POST /api/v1/verify-business { uid, name?, address? }
LEI lookup
POST /api/v1/lei-lookup { uid }
VAT status
POST /api/v1/vat-verify { uid }
Registry events
POST /api/v1/registry-events { uid, limit? }
Business identifiers go in the request body, never the URL. The older GET /api/v1/company/ {uid} routes are deprecated (sunset 2027-03-31) and name their replacement in a Link header. Fixture-only paths remain documented but unavailable for production use. See capabilities.
Decision semantics
PASS
REVIEW
FAIL
UNKNOWN
Every applicable mandatory check of the configured verification profile obtained sufficient usable evidence and none produced REVIEW or FAIL. PASS does not mean safe to transact, complete KYB, legal approval, risk-free, ownership/control screened, or signatory authority confirmed.
Profile: SWISS_BUSINESS_BASELINE_V1 / 1.0.0. Mandatory: existence, active status, direct sanctions screening. Optional evidence cannot compensate for mandatory UNKNOWN.
Data sources
BUMIT derives its answers from Swiss public and authoritative sources. Each source is used in a different way, and not every implemented source is active in this deployment. The status page and capabilities page show what is available right now.
Zefix — Swiss commercial register
Queried during verification when no stored copy is held (cache-first). A stored copy of a previously retrieved register record may be used instead of a new request. Upstream traffic is limited by a shared safeguard; if Zefix is unavailable, the result says so.
SECO — Swiss sanctions list
Answered from a dataset ingested by an operator, not queried during verification. Automatic acquisition is disabled. Checks are available only while an accepted dataset is active.
FINMA — authorisation and warning lists
Authorisation checks are answered from a dataset ingested by an operator, not queried during verification. Automatic acquisition is disabled. Absence from a list never proves absence of authorisation.
SHAB / SOGC — registry events
Adapter implemented; production acquisition is disabled by default. Availability is shown on the status page.
GLEIF (LEI), UID/VAT register, swisstopo (addresses)
Fixture-only: implemented for deterministic tests, not operationally available. Checks depending on them return an unavailable or unsupported result, never a positive one.
Freshness and provenance
There is no single "last updated" time for all BUMIT data. Freshness depends on the source: a register record reflects when it was retrieved from Zefix, and list checks reflect when the accepted dataset was retrieved (shown as its retrieval time on the capabilities page). Source publication timing, ingestion timing, availability and upstream changes all affect results.
Claims distinguish SOURCE_FACT, NORMALIZED, DERIVED, INFERRED, and UNAVAILABLE. Responses expose source, observation time, freshness, evidence class, and ruleset version, so consumers can see the evidence behind each result. The deterministic baseline uses no inference.
Capability availability
SUPPORTED means BUMIT implements the contract. AVAILABLE means this deployment can serve it using configured operational evidence. NOT_AVAILABLE means it cannot currently be served. FIXTURE_ONLY means deterministic test support exists but production evidence does not.
MCP
AI agents can call BUMIT over the Model Context Protocol at https://bumit.ai/mcp (Streamable HTTP). There is currently one tool, verify_business, covering Swiss businesses only. No sign-in or API key is currently required, and no payment is currently required.
A successful MCP tool call does not mean the business is VERIFIED. Read result.outcome: UNAVAILABLE, REVIEW_REQUIRED, NOT_FOUND, AMBIGUOUS, NOT_VERIFIED and UNSUPPORTED are valid business results, not transport errors. The authoritative semantics are the OpenAPI business-verification contract. An experimental descriptor is at /server-card; it is a convenience and not required by the protocol.
Errors and reason codes
Machines should branch on stable reason_code values, never mutable message prose. Errors identify whether retrying may succeed and never expose internal exception details.
INVALID_UID``COMPANY_NOT_FOUND``SOURCE_NOT_CONFIGURED``SOURCE_UNAVAILABLE``SOURCE_TIMEOUT``SOURCE_RATE_LIMITED``STALE_EVIDENCE``INSUFFICIENT_EVIDENCE``CAPABILITY_NOT_AVAILABLE``AUTHENTICATION_REQUIRED``ACCESS_DENIED``UPSTREAM_DEGRADED
BUMIT.
Authoritative evidence · Deterministic rules