Companies House API vs CompanyLens

Companies House API 35

Closed service, read on its last API change. The API Changes category of the developer forum posted on 8 October 2026 that the new data item from the April 'Persons with significant control' specification update would start loading from 13 October, adding streaming events for 15 to 20 days. The April notice described that item as new GET response content (a PSC notifications link), so its arrival in responses on 13 October is a change to the API's output, not only a data refresh. 22 days before this check (30). From 6 August the category has two dated entries, 8 October and a 29 September notice of a new received status in the Filing API's transaction resource, which is outside the Public Data API. The api-enumerations repository took untagged commits on 13, 18 and 27 August and 10 and 11 September, which aren't releases (0). Staff post change notices. Whether developer questions get staff replies was not established (5 of 15). No official SDK (0). No package to judge (0). 30 + 0 + 5 + 0 + 0 = 35.

CompanyLens 3

Closed service. No changelog, release notes, dated API change or dated docs page was found; the OpenAPI document carries no date and the sitemap no lastmod (0). So no releases in the last 90 days can be counted (0). A contact address and a demo form, with no public tracker or community channel (3 of 15). No official SDK (0). No package to judge (0). 0+0+3+0+0 = 3. The low figure is the checklist's reading of a service with no dated public record, not evidence of neglect.

Companies House API 72

Closed government service. The developer guidelines set no conditions on reuse, and the personal information charter says commercial organisations build products on register data (15). The charter, updated 7 September 2026, sets retention (live companies indefinitely, dissolved companies 20 years before transfer to the public records office, online records now kept permanently) and names a DPO. It doesn't cover developer account data (22 of 30). The versioning guide's deprecation section says a deprecated resource version carries its expiry date in a CH-Expiry-Date response header, and that it will typically become unavailable three months after the deprecation date, a written policy with a stated period. Dated change notices appear on the forum, such as removal of officer occupation on 16 October 2025 (20). Processors listed by category, with cloud in the UK or EU/EEA and the rest UK-based (15 of 20). 15 + 22 + 20 + 15 = 72.

CompanyLens 41

Closed service with terms dated 8 March 2026 under the laws of England and Wales, which name no legal entity (12 of 30). The privacy policy of 18 March 2026 gives retention by data type (usage logs 90 days, server logs 30 days, account data within 30 days of deletion, payments 7 years, audit logs at least a year) and a GDPR lawful basis for registry personal data, with processors described by type only (22 of 30). No deprecation policy or dated notices found (0 of 20). Servers in the EU, some processors in the United States under SCCs, processor categories listed without names (10 of 20). 12+22+0+10 = 44.

Companies House API 40

No x402, MPP or L402 (0). Free, which is published (20). Free with no card (20). A person has to create a Companies House account and a key in a browser (0).

CompanyLens 30

No x402, MPP or L402 (0). Plan prices with query quotas are public on the pricing page and in llms.txt; there is no per-call price outside a plan (10 of 20). REST free tier of 500 queries a month and MCP free tier of 50, both without a card (20). A person signs up in a browser and buys plans through Stripe checkout (0). 0+10+20+0 = 30.

Companies House API 55

The key goes in the Basic auth header, never the URL, and the developer guidelines say keys can be restricted by IP address and domain, regenerated and deleted. No permission scopes, since the public data API is read-only (25 of 30). Read-only register data (15 of 20). Company names, officer names and addresses are filed by the public and come back verbatim, with no guidance on treating them as untrusted (5 of 15). No request log or usage view found (0 of 15). Companies House publishes a vulnerability disclosure policy on GOV.UK (first published 1 November 2021) with a HackerOne reporting form and a reply within 5 working days. No bug bounty, and no security.txt on find-and-update.company-information.service.gov.uk (404) (10 of 20). 25 + 15 + 5 + 0 + 10 = 55.

CompanyLens 47

REST keys rotate and revoke at once from the dashboard, with a separate sandbox prefix, but carry the whole account with no per-endpoint restrictions. The MCP server uses OAuth through Clerk with dynamic client registration and only openid, profile and email scopes, or long-lived service tokens on Agent plans. No key in the URL (20 of 30). The data surface is read-only; no write actions on registry data (15 of 20). Company names, addresses and officer details are filed by third parties, with no prompt-injection guidance (5 of 15). get_usage and the usage endpoint show plan use; the privacy policy says audit logs are kept at least a year, with no per-call log documented for customers (7 of 15). security.txt answered 403 and no disclosure policy, bug bounty or certification was found (0 of 20). 20+15+5+7+0 = 47.

Companies House API 65

Swagger 2.0 root spec, 'Companies House Public Data API' 1.0.0, with 34 paths pointing to per-resource spec files, linked from the reference page as an OpenAPI specification download (25). No llms.txt (0). Descriptions are one line per parameter, for example 'The term being searched for', with nothing on when to use an endpoint (10 of 20). Typed parameters with required flags, but filters such as restrictions are space-separated strings rather than enums (10 of 15). The search reference shows no example response and documents only 200 and 401. Error strings live in the public api-enumerations repository (5 of 15). The versioning guide says each resource is versioned through the Accept and Content-Type headers, that breaking changes raise the version, and that an unknown version returns 406, and dated change notices are posted in the developer forum's API Changes category (15). 25 + 0 + 10 + 10 + 5 + 15 = 65.

CompanyLens 72

OpenAPI 3.0.4 at api.companylens.io/swagger/v1/swagger.json, behind the Swagger playground linked from the API reference, 20 operations and 55 schemas (25). llms.txt with endpoints, tools and pricing; no Markdown twins of docs pages (7 of 10). Tool descriptions say what each returns and some say when to call it ('use to discover valid jurisdiction slugs before calling other tools'), but llms.txt names four tools (search_entities, get_entity_detail, search_officers, execute_query) and /api/v1 paths that match neither the 16-tool page nor the /v1 paths in the spec, and gives 18 jurisdictions where the site says 19 (11 of 20). 74 parameters, 17 marked required and 12 with enums or schema references (10 of 15). Errors 400, 401, 404, 422, 429, 501 and 503 in the spec, a troubleshooting page, examples pages for REST and MCP and a Postman collection (14 of 15). The path carries v1, but no changelog was found (5 of 15). 25+7+11+10+14+5 = 72.