---
title: "Run an authenticated KYC documentary lookup"
method: POST
path: "/api/v1/persons/lookup"
tags: ["User"]
---

# Run an authenticated KYC documentary lookup

`POST /api/v1/persons/lookup`

MAX/Enterprise account operation. Requires a declared legitimate purpose, records an audit entry and never creates a public person profile. DNI/NIE belongs only in the encrypted request body, never in URL, logs or public API surfaces.

## Headers

- `X-CSRF-Token` string, required

## Request body

- KycPersonLookupRequest
  - `dni_or_nie` string, required — DNI/NIE supplied for this authenticated KYC request; never use it in public company/person routes.
  - `finalidad` string, required — Declared legitimate purpose recorded in the account audit log.

## Response `200`

Documentary lookup result with disclaimer and usage

- KycPersonLookupResponse
  - `ok` boolean, required
  - `status` string, required
  - `error` string, nullable
  - `message` string, nullable
  - `query_redacted` string, nullable
  - `query_type` string, nullable
  - `matches_count` integer
  - `sources_matched` string[]
  - `results` KycPersonLookupResults
    - `aeat_morosos` JsonValue[], required
      - union — A JSON value used only inside explicitly documented extension maps.
        - JsonValue[]
        - object
    - `claims_evidence` JsonValue[], required
      - union — A JSON value used only inside explicitly documented extension maps.
        - JsonValue[]
        - object
    - `borme_facts` JsonValue[], required
      - union — A JSON value used only inside explicitly documented extension maps.
        - JsonValue[]
        - object
  - `finalidad` string, nullable
  - `usage` KycUsage
    - `used` integer, required
    - `max` integer, required
    - `remaining` integer, required
    - `window_days` integer, required
    - `unlimited` boolean, required
  - `credits_charged` integer
  - `request_id` string, required
  - `disclaimer` string, nullable
  - `correction_url` string, nullable
  - `audit_url` string, nullable

## Other responses

- `400` — Invalid request
- `401` — Authentication required (no active session)
- `402` — Plan or monthly KYC quota does not permit the lookup
- `403` — Invalid CSRF token
- `429` — Rate limit exceeded
- `503` — KYC helper unavailable

---

[API](https://skmtc.net/openmercantil/apis/openmercantil-public-api.md) · [All operations](https://skmtc.net/openmercantil/apis/openmercantil-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openmercantil/openmercantil-public-api/versions/996f96a11758/schema)