One API endpoint, 18 registries: verifying Australian businesses without the SOAP and CSV mess

Anyone who has tried to verify an Australian business programmatically knows the pain. There isn't one government source you can call - there are at least half a dozen, each with its own format, its own quirks, and in most cases, no API at all.

Three registries, three different problems

The Australian Business Register (ABR) exposes ABN and GST status through a SOAP/XML web service - usable, but dated, and awkward to integrate into a modern REST stack. ASIC, which holds the actual company registrations, doesn't offer an API at all; it publishes a weekly CSV dump of several million rows. ACNC, the charities regulator, is the same story: no API, just a periodic file export. If your product needs sanctions or AML screening on top of that, you're now also pulling from DFAT's consolidated list and ASIC's banned and disqualified registers separately.

For a compliance, onboarding, or billing workflow that just wants to answer "is this a real, active Australian business, and should I be worried about it," that means building and maintaining several ingestion pipelines before you've written a single line of your actual product.

What AUO does differently

AUO is a REST API (plus an MCP server and webhook layer) built as an Australian business data API that collapses this into one call. Send an ABN, ACN, or company name to a single resolve endpoint, and you get back a canonical record joined from eighteen free government sources, ABR, ASIC, ACNC, ORIC, GLEIF, DFAT and others, instead of a pile of registry-specific responses you have to reconcile yourself.

Getting a key takes under a minute: sign up, generate a key from the dashboard, and you're given a test-prefixed key that returns synthetic sandbox data and a live-prefixed key that hits the real registers, both through the same code path. A first call looks like this:

curl https://api.auo.com.au/v1/resolve \
-H "Authorization: Bearer auo_sk_your_key_here" \
-H "Content-Type: application/json" \
-d '{"abn": "51824753556"}'

The response comes back as a list of candidates rather than a single flat object, each with a match confidence and a canonical block where every field, entity name, ABN, ACN, status, GST registration, is tagged with the register it came from and, where available, an as_of timestamp. A screening block on the same response reports DFAT sanctions and ASIC banned-organisation status as no_match or a flagged hit, and a top-level disclaimer spells out that the record excludes directors, shareholders, and beneficial ownership, because that data simply isn't in Australia's free public registers. A name ABR doesn't recognise returns a normal 200 with an empty candidate list rather than an error, so "not found" and "broken" stay distinguishable.

A few other design choices stand out: conflicts between sources are surfaced rather than silently merged; screening results are always "possible match" or "no match," never "cleared," since a clean result against public data isn't a legal clearance; and bankruptcy-related signals are shown as "petition filed" rather than implying an adjudicated status. There's also a monitoring layer - subscribe to an entity and get a signed webhook when something changes, such as a deregistration or a new sanctions hit, instead of polling on a schedule.

Who it's for

The obvious users are AML/CTF and KYB teams who need to verify and screen a business before opening an account or moving money, and fintechs doing onboarding checks. But the same single call is useful anywhere a business identity needs confirming: e-commerce checkouts validating an ABN for tax treatment, real estate and legal practices running due diligence ahead of the Tranche 2 reforms taking effect from 1 July 2026, or a CRM team wanting to de-duplicate and enrich account records against a source of truth.

Getting started

AUO offers a free sandbox with no card required, returning realistic sample data in the same shapes as the live API, so you can build an integration before paying for anything. Paid tiers start at $49/month for 5,000 calls and 250 watched entities, scaling up to 250,000 calls and 15,000 watched entities on the top tier, with overages treated as a soft cap rather than a hard block.

If you're tired of stitching SOAP calls, CSV parsers, and sanctions lists together yourself, it's worth pointing your next lookup at AUO instead of the registries directly.