ThaiData Open API developer preview

Verify a Thai company by its 13-digit registration number. Free, no API key. Public, read-only.

Base URL (current): https://thaidata.com/open-verify
Developer portal: https://open.thaidata.com.
Access model: Origin-bound. Register your site domain, then call from that exact browser origin. This is not proof of DNS/domain ownership and is not strong authentication — a non-browser client can forge an Origin header. CORS here is browser access control only. All traffic is HTTPS/TLS.

Quotas

Per bound domain: 30 requests/minute and 500 requests/day.
The daily window resets at midnight Asia/Bangkok (UTC+7); it persists across restarts.
On limit, the response is 429 with a Retry-After header (seconds).
Registration is rate-limited per IP (2/min, 5/day). Request body ≤ 4096 bytes; concurrency is capped.

POST /v1/verify-company

Call from your registered origin (browser). A missing or unregistered Origin returns 403.

Request

Field	Required	Description
`registration_number`	required	13-digit Thai company registration number.
`company_name`	required	Name to match against the registered name (English or Thai).

curl -X POST https://thaidata.com/open-verify/v1/verify-company \
  -H "Content-Type: application/json" \
  -H "Origin: https://example.co.th" \
  -d '{"registration_number":"0105556012345","company_name":"Example Trading Co., Ltd."}'

Response

Field	Type	Meaning
`result`	enum	`matched` · `mismatch` · `pending` · `invalid_input` · `source_unavailable`
`company_verified`	boolean	`true` only when `result` is `matched`.
`registration_status`	string	Registry status, e.g. Active / dissolved.
`matched_on`	string?	Which registered name matched: `registered_name_en` / `registered_name_th`.
`source`	string	`ThaiData`.
`source_updated_at`	date	Source record date stored by ThaiData, when available. It is not the date of a live lookup or a legal effective date.
`checked_at`	datetime	When this API request checked the local record (UTC). It does not mean that the source was refreshed at this time.
`request_id`	UUID	Unique response reference; also returned in X-Request-Id. Retain it when reporting a failed request.
`api_version`	string	Response contract: `1`.
`reason`	string?	Present on pending / invalid_input / source_unavailable.

{
  "result": "matched",
  "company_verified": true,
  "registration_status": "Active",
  "matched_on": "registered_name_en",
  "source": "ThaiData",
  "source_updated_at": "2026-11-02",
  "checked_at": "2026-11-03T09:14:07Z"
}

The verification cURL example requires your already-bound Origin. Register through the platform first. Origin binding is a usage control, not a secret credential or proof of company ownership.

Errors, request references and usage

Every JSON response includes request_id and api_version. A matched result confirms a name and number in ThaiData's database; it does not prove the submitter is authorized to represent that company.

HTTP status	Handling
400 / 413 / 415	Correct the input, size or JSON content type before retrying.
403	Origin is absent or not allowed. Do not automatically retry.
429	Wait for the `Retry-After` number of seconds. Do not parallelize retries.
503	Temporary service or quota-storage failure. Wait, then use a small bounded retry with backoff. Never treat it as approval.

For bound domains, accepted quota checks include RateLimit-Remaining and RateLimit-Reset. Reset is the number of seconds until the next Asia/Bangkok midnight. The daily quota is shared across the domain and persists through restarts. Accepted quota checks consume an attempt even if the company is not matched. Platform demo origins have separate controls.

ตรวจสอบจากฐานข้อมูล ThaiData เท่านั้น ไม่เรียกข้อมูลทะเบียนภายนอกแบบสดต่อคำขอ วันที่ checked_at คือเวลาตรวจสอบคำขอ ไม่ใช่เวลาปรับปรุงข้อมูลต้นทาง หากไม่พบข้อมูลหรือระบบขัดข้องจะไม่อนุมัติอัตโนมัติ โปรดเก็บ request_id เพื่อแจ้งปัญหา

Status semantics

`matched`	Number resolves and the registered name agrees. `company_verified: true`.
`mismatch`	Number resolves but the registered name does not agree.
`pending`	No matching record yet, or the registered name is privacy-withheld. Never a silent pass.
`invalid_input`	Registration number not 13 digits, or company name missing.
`source_unavailable`	Upstream 4xx/5xx/timeout/number conflict. Never auto-approved.

Verification uses ThaiData's existing company records and their dates — it does not refresh the underlying record live per request. Directors, personal contacts and financial statements are never returned.

POST /v1/register

Self-serve, instant. Call from the platform page. Binds a domain only after the company verifies as matched.

Request

Field	Required	Description
`registration_number`	required	13-digit registration number of the company you represent.
`company_name`	required	Registered name to match.
`domain`	required	Your site domain to bind, e.g. `example.co.th` (https assumed; public domain, not IP/localhost).

curl -X POST https://thaidata.com/open-verify/v1/register \
  -H "Content-Type: application/json" \
  -H "Origin: https://open.thaidata.com" \
  -d '{"registration_number":"0105556012345","company_name":"Example Trading Co., Ltd.","domain":"example.co.th"}'

Response — bound (201)

{
  "application_id": "REG-20261103-ab12cd34",
  "origin": "https://example.co.th",
  "bound": true,
  "company_verified": true,
  "limit_per_min": 30,
  "limit_per_day": 500,
  "api_key": null,
  "preview": true
}

Response — not bound (200)

When the company does not verify (mismatch / pending / source_unavailable): bound: false, company_verified: false, no binding created.

Errors

`400 invalid_domain` / `scheme_not_allowed` / `host_denied`	Bad or disallowed domain (IP, localhost, our own hosts, wildcard, path, non-https).
`400 invalid_input`	Registration number / company name invalid.
`409 domain_exists`	Domain already registered.
`429 rate_limited` / `rate_limited_daily`	Per-IP registration limit; see `Retry-After`.
`503 registry_full`	Registration capacity reached.

POST /v1/access-requests

Legacy contact form. Server re-verifies the company; stores minimal details only on a verified match; still returns api_key: null in preview. Unchanged in this release.

ภาษาไทย (สรุป)

ตรวจสอบบริษัทไทยด้วยเลขทะเบียน 13 หลัก ฟรี ไม่มี API key เป็นบริการสาธารณะแบบอ่านอย่างเดียว

Base URL ปัจจุบัน: https://thaidata.com/open-verify (พอร์ทัลนักพัฒนา open.thaidata.com)
การเข้าถึงผูกกับ โดเมน (Origin) ที่ลงทะเบียน ต้องเรียกจากโดเมนนั้น — ไม่ใช่การพิสูจน์ความเป็นเจ้าของโดเมนและไม่ใช่การยืนยันตัวตนที่เข้มแข็ง (ไคลเอนต์ที่ไม่ใช่เบราว์เซอร์ปลอม Origin ได้) CORS เป็นการควบคุมการเข้าถึงฝั่งเบราว์เซอร์เท่านั้น
โควตาต่อโดเมน: 30 ครั้ง/นาที และ 500 ครั้ง/วัน รีเซ็ตเที่ยงคืนเวลาไทย (UTC+7) เกินโควตาได้ 429 พร้อม Retry-After
/v1/register จะผูกโดเมน ต่อเมื่อ ตรวจบริษัทแล้วเป็น matched เท่านั้น ไม่ออก API key
ผลลัพธ์ matched / mismatch / pending / invalid_input / source_unavailable — ไม่มีการอนุมัติเงียบ ๆ