Vendor Onboarding Check

Everything a procurement agent needs to onboard a new vendor: company verification, VAT validation, bank account verification, sanctions screening, and address validation. One call replaces a 45-minute manual check.

5 steps x402 eligible vendor-onboard

What it runs

Swedish Company Data
Source: Bolagsverket Värdefulla datamängder API (Swedish Companies Registration Office, EU Open Data Directive HVD)
EU VAT Validation
Source: VIES (EU VAT Information Exchange System, European Commission)
IBAN Validation
Source: Algorithmic validation (ISO 13616 IBAN standard + bank registry)
Sanctions Check
Source: Dilisense consolidated (OFAC SDN, EU FSF, UN SC, UK Sanctions List, CH SECO, BIS, World Bank, EBRD, ADB + 125 national sanctions/debarment lists; full attribution at https://dilisense.com/en/sources/sanction-sources)
Address Validation
Source: OpenStreetMap Nominatim

The answer returns every step’s result, so your agent can show or check each one.

Inputs

Field	Type	Required	What it is
`iban`	string	No	Vendor bank IBAN (optional)
`address`	string	No	Vendor address (optional)
`vat_number`	string	No	Vendor VAT number (optional)
`company_name`	string	Yes	Vendor company name
`country_code`	string	Yes	Vendor country code

How to call it

# Needs an API key. The whole check is charged once, at the listed price.
curl -X POST https://api.strale.io/v1/solutions/vendor-onboard/execute \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "inputs": {
      "iban": "SE3550000000054910000003",
      "vat_number": "SE556012573201",
      "company_name": "Volvo AB",
      "country_code": "SE"
    },
    "max_price_cents": 150
  }'

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i -X POST https://api.strale.io/x402/v2/solutions/vendor-onboard \
  -H 'Content-Type: application/json' \
  -d '{
    "iban": "SE3550000000054910000003",
    "vat_number": "SE556012573201",
    "company_name": "Volvo AB",
    "country_code": "SE"
  }'

The bundle’s published example input.

Limitations

Bolagsverket’s open company data covers names, legal forms, status, addresses, SNI codes, registration dates and insolvency flags. Annual-report figures such as revenue, profit, employee counts and equity are not included.
From step: Swedish Company Data
What to do instead: Order an annual report or financial statement extract from Bolagsverket.
Looks up companies by organisation number only; it does not search by name.
From step: Swedish Company Data
What to do instead: Find the organisation number on an official company document or in the registry, then pass it as `org_number`.
Sole traders (enskild näringsidkare) can have several companies registered under the same personal identity number. Lookup returns only the first entry, so other registrations under that number are not included.
From step: Swedish Company Data
What to do instead: Prefer aktiebolag organisationsnummer (10 digits starting 2–9) for unambiguous single-entry lookups.
Deregistered companies (avregistrerad) still return registry data, but the data reflects the state at deregistration. `is_active` is false and `deregistered_date` is populated.
From step: Swedish Company Data
What to do instead: Always check the `is_active` and `deregistered_date` fields before using returned data for live decisions.
VIES can be unavailable or throttle requests under unpublished per-member-state limits. Transient faults are retried, and cached results, including older fallback results, can be returned during outages.
From step: EU VAT Validation
What to do instead: Lookups within 48 hours can use cached results; if VIES is unavailable and no cached result exists, retry later.
Results can be cached for 48 hours, and national registry changes can take a further 24 hours to appear in VIES. Check the national tax authority directly for same-day registration or deregistration confirmation.
From step: EU VAT Validation
What to do instead: For real-time same-day verification, contact the national tax authority directly.
Swiss UID validation returns valid or invalid only, without a company name or address. This tool does not perform the separate enrichment lookup, whose public service is limited to 20 requests per minute.
From step: EU VAT Validation
What to do instead: For Swiss company name + address, call the swiss-company-data capability.
GB VAT numbers return a credentials-pending error when the HMRC connection is not configured.
From step: EU VAT Validation
What to do instead: Use vat-format-validate for GB format checks; it does not confirm VAT registration.
Validates structure and checksum only — does not confirm the account is open or active
From step: IBAN Validation
What to do instead: Use a SEPA test transaction (€0.01) or bank account verification API to confirm the account is live before large transfers
Covers all SEPA-zone IBANs. Non-SEPA country IBANs validated structurally but bank lookup may be incomplete
From step: IBAN Validation
What to do instead: For non-SEPA IBANs, cross-reference the bank code portion against SWIFT's IBAN Plus directory
Sanctions lists updated daily from OFAC, EU, and UN sources — newly sanctioned entities may take up to 24 hours to appear
From step: Sanctions Check
What to do instead: For same-day compliance, subscribe to OFAC's RSS feed and cross-reference against today's additions
Name matching uses fuzzy logic — common names may produce false positives. Always verify flagged results
From step: Sanctions Check
What to do instead: Filter results by match confidence score and verify flagged entities against the primary sanctions list PDF
Nominatim rate limit of 1 request per second — shared across address-validate and address-geocode
From step: Address Validation
Nominatim uses best-match geocoding — results may not always reflect the exact address
From step: Address Validation