CBE2JSON API Documentation
CBE2JSON gives you official Belgian company data from the Crossroads Bank for Enterprises (CBE / BCE / KBO) through a simple REST API. The interactive reference below documents every endpoint, its parameters, and example JSON responses.
Quickstart
1. Get your API key
Create a free account (50 credits a month, no credit card), then generate a key in your dashboard. A key is a clientId and a secretKey.
Create a free account I already have an account2. Make your first request
Every endpoint takes a POST with a JSON body: your credentials plus a data object. This example looks up Proximus by its enterprise number. Dots and the BE prefix are optional: 0202239951 and BE0202.239.951 work too.
curl -X POST https://api.cbe2json.be/byCBE \
-H "Content-Type: application/json" \
-d '{"clientId": "YOUR_CLIENT_ID", "secretKey": "YOUR_SECRET_KEY", "data": {"cbe": "0202.239.951"}}'To search by name, POST to /byDenomination with "data": {"denomination": "Proximus", "limit": 10, "offset": 0}.
To look companies up by activity (NACE), postcode, municipality, street and house number, legal form or legal situation, POST to /search with, for example, "data": {"zipcode": "1000", "street": "Rue de la Loi", "houseNumber": "16"}. NACE and address filters must match the same registered office or establishment. Results are ordered by ascending enterprise number, so offset and limit page through them in a stable order. Use it to look up or verify companies, for instance who is registered at an address or whether a supplier has a given activity code — the KBO Open Data licence excludes direct marketing.
/search/numbers takes the same filters and returns only enterprise numbers, up to 1000 per page, in the same ascending order.
CBE2JSON JavaScript & TypeScript SDK
3. Handle the response
A successful call returns JSON. From API version 2, the response is { data, meta }: data holds the enterprise (or the list of enterprises), and meta gives the date of the CBE dataset served, the credits the call used and the credits left. Check the HTTP status first: API errors come with a JSON body such as {"errorCode": "…", "message": "…"}, using one of these codes:
| HTTP status | errorCode | Meaning |
|---|---|---|
400
| VALIDATION_FAILED |
The request body is malformed: a missing or unknown field, or an invalid enterprise number.
|
400
| QUOTA_EXHAUSTED |
Your credits for this month are used up, or this request would return more results than the credits you have left (lower data.limit). Upgrade your plan or wait for the monthly reset.
|
401
| BAD_CLIENT_SECRET |
The clientId and secretKey do not match an API key.
|
403
| ORIGIN_NOT_ALLOWED |
The request came from a website that is not on this key's allowed origins. Browsers report this as a CORS error; blocked origins are listed in your dashboard.
|
404
| ENTERPRISE_NOT_FOUND |
No enterprise matches this number or name. On version 1, byDenomination also returns it for a page past the last result; version 2 answers with an empty list instead.
|
400
| UNSUPPORTED_API_VERSION |
The CBE2JSON-Version header names a version that does not exist.
|
byCBE uses 1 credit per enterprise found. byDenomination and search use 1 credit per enterprise returned. search/numbers uses 1 credit per page with results. Failed requests and empty results use no credits. Responses also carry your credits in headers: CBE2JSON-Credits-Used, -Remaining, -Limit and -Reset.
API versions
Each API key is pinned to a response format, so the JSON you parse never changes under you. New keys start on the latest version; you can switch a key in your dashboard at any time, and switch back.
- Version 1 — the original format. Every key created before versioning uses it.
- Version 2 — wraps every response in { data, meta }: data holds the enterprise or the list of enterprises; meta gives the dataset date (dataUpdatedAt), the credits (creditsUsed, creditsRemaining, creditsLimit, creditsResetAt) and, for byDenomination, the page (total, limit, offset, hasNext). byDenomination accepts a limit of at most 100 and answers a search without results with an empty list instead of a 404.
To try another version for a single request, send the CBE2JSON-Version header (for example 2). Every response carries the same header, naming the version it used.
Any change to an existing response format ships as a new version. Older versions stay supported for at least 12 months after a newer one is released, and we email you before one is retired.
API reference
CBE2JSON API 1.0.0
OAS3
/swagger.jsonOfficial Belgian company data from the Crossroads Bank for Enterprises (CBE / BCE / KBO) as JSON.
Authentication. Every endpoint is a POST with a JSON body holding your credentials and a data object: {"clientId": "…", "secretKey": "…", "data": { … }}. Generate a key in your dashboard.
Credits. byCBE uses 1 credit per enterprise found; byDenomination and /search use 1 credit per enterprise returned; /search/numbers uses 1 credit per non-empty page of up to 1,000 numbers. Each is refused (400 QUOTA_EXHAUSTED, nothing charged) when it would exceed the credits left. Failed requests and empty results use no credits; total is always free. Every response to an identified key carries the credits in headers: CBE2JSON-Credits-Used, CBE2JSON-Credits-Remaining, CBE2JSON-Credits-Limit and CBE2JSON-Credits-Reset (the last three are left out when they do not apply).
Errors. Check the HTTP status first. API errors return {"errorCode": "…", "message": "…"} with the status listed under each endpoint; other failures (malformed JSON, server errors) can return a different body.
Versions. Each API key is pinned to a response format: version 1 is the original format; version 2 wraps every response in { "data": …, "meta": { … } }, where meta gives the dataset date, the credits and, for searches, the page. Version 2 also caps limit at 100 for byDenomination and /search (1000 for /search/numbers) and answers an empty search with 200 and an empty list. New keys start on the latest version; switch a key in your dashboard. Send the CBE2JSON-Version header to use another version for one request; every response carries that header with the version used. Older versions stay supported for at least 12 months after a newer one ships.
Browser access (CORS). By default an API key works from any website. In your dashboard you can restrict a key to a list of origins, or block browser access entirely. Origins are matched as globs: https://app.example.com matches exactly that origin; https://*.example.com matches app.example.com and a.b.example.com but not the bare https://example.com; http://localhost:* matches any local port. A request from a disallowed origin returns 403 ORIGIN_NOT_ALLOWED and consumes no quota.
CORS is enforced by browsers only — a script, server or mobile app can still use the key, so keep your secret key secret.