// OPEN_API · v2

One header.
Every endpoint.

The R-Score, risk narratives, verified contacts and batch enrichment for 3.4 million England & Wales companies. Authenticate with one header, call the endpoint you need. Free trial key, no card.

FIRST CALL. NO SIGNUP FORM.
curl -H "X-API-Key: ***" \ https://blackflagalert.com/api/v2/company/04466987 # → R-Score, 5y financials, CCJs, charges, # narrative, suggested credit exposure
5 DATA ENDPOINTS · WATCHLIST + ALERTS · BATCH UP TO 50 · MCP SERVER · llms.txt
Companies
5.1M+
R-Scores
3.4M
Auth
1 Header
Trial
£0
// 01 · GET A KEY

Your free key, self-serve.

No card. No sales call. 14 days, 100 calls a day, 20 contact lookups a day. Your key is shown once below and emailed to you as a backup. One trial key per email.

// 02 · QUICKSTART

Three lines to production.

1 · Authenticate: one header on every request
X-API-Key: bfa_live_••••••••••••••••••••••••
2 · Fetch a company: full profile with risk narrative
curl -H "X-API-Key: $BFA_KEY" \ https://blackflagalert.com/api/v2/company/04466987
3 · Batch enrich: up to 50 companies in one call
curl -X POST -H "X-API-Key: $BFA_KEY" -H "Content-Type: application/json" \ -d '{"company_numbers": ["04466987", "00445790", "SC724798"]}' \ https://blackflagalert.com/api/v2/batch

For LLM agents: a machine-readable summary lives at blackflagalert.com/llms.txt. For Claude / Cursor / Windsurf, see the MCP server.

// 03 · REFERENCE

Endpoints.

GET /api/v2/company/{company_number} Auth: X-API-Key · Metered: calls

Full company profile: R-Score, risk band, five years of financials, filing history, charges, CCJs, directors, active alerts, suggested credit exposure, plus a plain-English risk narrative.

company_number8-character Companies House number, e.g. 04466987
200Full profile JSON (see example below)
score_changeChange between the two most recent filed accounting periods: delta, current, previous, band before and after (current_band / previous_band), as_of (latest period end), moved (band change or ≥5 points). Absent when the company has filed one period or fewer. Also present on batch result rows.
404Company not found (includes Scottish / NI / overseas numbers; E&W coverage only)
401 / 429Missing or invalid key / over daily limit
# Example response — core fields. The full profile also carries # financials, score_history, charges, directors, alerts and narrative. { "company": { "company_number": "09687391", "company_name": "PLAINVIEW VENTURES LIMITED", "company_status": "Active", "incorporation_date": "2015-07-15", "post_town": "Ware", "postcode": "SG12 0EF", "latest_mars_score": 16.94 }, "latest_score": { "period_end_date": "2025-07-31", "r_score": 16.94, "risk_rating": 8, "risk_label": "High" }, "score_change": { "delta": 0.0, "current": 16.94, "previous": 16.94, "current_band": "High", "as_of": "2025-07-31", "previous_band": "High", "moved": false } }
GET /api/v2/company/{company_number}/narrative Auth: X-API-Key · Metered: calls

Plain-English risk summary only — fast and cheap, no external credit fetch. Generated deterministically from the data: reproducible, zero hallucination.

GET /api/v2/contacts/{company_number} Auth: X-API-Key · Metered: contact lookups

Verified contact details: SMTP-validated email addresses, phone, website domain. Only deliverable addresses are served; invalids are filtered out.

POST /api/v2/batch Auth: X-API-Key · Metered: calls

Enrich up to 50 companies in one call. Request body: {"company_numbers": ["04466987", ...]}. Each result carries status, R-Score, overdue flags, charges, CCJs, net assets and suggested credit exposure. Unknown numbers return "found": false.

# Example result item (live response shape) { "company_number": "04466987", "company_name": "KIMMERIDGE PROJECTS LIMITED", "company_status": "Active", "latest_r_score": 93.87, "latest_score_band": "Very Low", "risk_label": "Very Low", "accounts_overdue": false, "accounts_next_due": "2026-12-31", "cs_overdue": false, "charges_outstanding": 0, "charges_satisfied": 0, "ccj_count": 0, "external_rating": "ONE_RED_FLAG", "external_rating_label": "1 Red Flag", "net_assets": 254456.0, "suggested_credit_exposure": 24000, "found": true, "score_change": { "delta": -0.03, "current": 93.87, "previous": 93.9, "current_band": "Very Low", "as_of": "2025-03-31", "previous_band": "Very Low", "moved": false } }
GET /api/v2/usage Auth: X-API-Key · Not metered

Your key's rolling-24h usage against its limits — calls made, calls allowed, contact lookups used. Use it to throttle your integration before you hit a 429.

POST /api/v2/signup

Self-service trial key. Body: {"email": "...", "company_name": "optional"}. One active trial per email (409 on duplicate). No auth required.

GET /api/v2/health

Liveness probe. Returns {"status": "ok"}. No auth needed. Use it in your monitoring.

GET /api/v1/watchlist Auth: Bearer JWT · Not metered

Your starred companies with current R-Score and band, newest star first. Signed-in accounts only: these endpoints take a session token from POST /api/v1/auth/login, not an X-API-Key.

200Array of company_number, company_name, status, score (0–100, null if unscored), band (five-band label, null if unscored), created_at (starred time). Empty array when nothing is starred.
401Missing, invalid or expired token
POST /api/v1/watchlist/{company_number} Auth: Bearer JWT · Not metered

Star a company. Idempotent: starring an already-starred company returns 200 and changes nothing. The first sweep after a new star records a baseline and sends no email; alerts start from the next change.

201Starred: {"company_number": "04466987", "watched": true}
200Already starred (idempotent re-star)
404Company not in the register
422Not a valid Companies House number, or watchlist full (500 companies)
401Missing, invalid or expired token
DELETE /api/v1/watchlist/{company_number} Auth: Bearer JWT · Not metered

Unstar a company and stop its alerts. Idempotent: an unstarred company can be deleted again; the endpoint always returns 200, never 404.

200{"company_number": "04466987", "watched": false}, whether or not it was starred
422Not a valid Companies House number
401Missing, invalid or expired token
GET /api/v1/watchlist/{company_number}/is-watched Auth: Bearer JWT · Not metered

Cheap poll for the star state of one company; the company page uses it to draw the star button.

200{"company_number": "04466987", "watched": true|false}; no 404 for unstarred companies
422Not a valid Companies House number
401Missing, invalid or expired token

When a starred company changes, we email the account: R-Score moves of 5 points or more, any band change, or a change in active insolvency events (winding-up petition, administration, liquidation, dissolution notices, receivership, CVA). Event-driven changes are alerted within about 15 minutes of landing in the public record; account-driven score changes are alerted the night after the nightly rescore.

// 04 · ERRORS & LIMITS

Risk bands.

Every scored company carries an R-Score (0–100), an internal risk rating (1–10) and a public five-band label in risk_label / latest_score_band. The bands are strictly ordered:

Band        Score      Rating   Share of companies
Very Low    75–100    1–2      18.5%
Low         55–74     3–4      22.7%
Moderate    35–54     5–6       8.4%
High        15–34     7–8      10.2%
Critical    0–14      9–10     40.2%

“Distressed” is not a band — it is an event flag for live insolvency actions (winding-up petition, strike-off, administration) which override the band and zero the suggested credit exposure.

Speak fluent 429.

401Missing, invalid, revoked or expired key. Check the X-API-Key header.
409Signup: an active trial key already exists for that email.
422Bad company number format, empty batch, or more than 50 companies in one batch call.
429Rolling-24h limit reached. Back off and retry. Limits reset continuously, not at midnight.
404Company not in coverage. Scottish (SC), Northern Irish (NI) and overseas (OC) numbers are not covered.

Trial: 100 calls + 20 contact lookups per rolling 24 hours. For production volume, Email [email protected].

// 05 · AI AGENTS

Plug straight into your agent.

We ship a Model Context Protocol (MCP) server, the standard that Claude, Cursor and Windsurf speak natively. Give your agent England & Wales credit intelligence as a first-class tool.

# Claude Desktop / Cursor config { "mcpServers": { "black-flag-alert": { "command": "uvx", "args": ["--from", "/path/to/bfa-mcp", "bfa-mcp"], "env": { "BFA_API_KEY": "bfa_live_..." } } } }

Setup guide: blackflagalert.com/mcp/bfa_mcp/README.md. Source and per-client guides (Claude, ChatGPT, Gemini, Cursor): github.com/lorquaid/black-flag-alert-mcp. Listed in the official MCP Registry: com.blackflagalert/mcp. Tools exposed: search, get company, narrative, contacts, batch, usage.