# Australian Business Verification APIs Research
## For Construction Labour Marketplace

**Research Date:** 5 February 2026  
**Researcher:** Subagent for Rivet

---

## 1. ASIC Connect API

### Overview
ASIC (Australian Securities and Investments Commission) provides APIs for accessing business names and companies registers.

### Key Findings

**Can we verify company directors/officeholders?**
- **Yes**, but with limitations. ASIC provides company registration APIs that can access director information.
- Director Identification Numbers (DINs) are not publicly visible in ASIC extracts but can be verified against identification documents.
- The ASIC Connect portal allows searching for personal names with director roles.

**Is there a public API? Cost?**
- **Yes**, ASIC provides APIs for business names and companies registers.
- **Cost**: No fee to access the APIs (free for approved digital service providers).
- **Access Requirements**: Must apply to be an ASIC digital service provider:
  1. Read and understand ASIC's digital services access terms and conditions
  2. Review API technical specifications
  3. Contact `webservices@asic.gov.au` for application information
  4. Complete application and submit for approval

**How to check if a person is actually a director of a company**
- Through ASIC Connect portal: Search by person name with "director" role type selected
- Through APIs: Access companies register data including director details
- Alternative: Use third-party APIs like vigil.sh that provide ASIC company data

### Technical Details

**Endpoint URLs:**
- **Official ASIC APIs**: Requires application and approval
- **Third-party API (vigil.sh)**: `https://api.vigil.sh/asic/company/`
  - Find endpoint: `GET /asic/company/find/?query={query}`
  - Retrieve endpoint: `GET /asic/company/?id={id}`

**Authentication Method:**
- **Official ASIC**: Application-based access with credentials
- **vigil.sh**: API key in `x-api-key` header

**Cost:**
- **Official ASIC**: Free (after approval)
- **vigil.sh**: Subscription-based (pricing not publicly listed)

**Data Returned:**
- Company name, ABN, ACN
- Company type and description
- Registration status and date
- Director details (through company records)
- Corporate structure information

### Code Example (vigil.sh API)

```javascript
// Search for company
const searchCompany = async (companyName) => {
  const response = await fetch(
    `https://api.vigil.sh/asic/company/find/?query=${encodeURIComponent(companyName)}`,
    {
      headers: {
        'x-api-key': 'YOUR_API_KEY'
      }
    }
  );
  return await response.json();
};

// Get company details including directors
const getCompanyDetails = async (companyId) => {
  const response = await fetch(
    `https://api.vigil.sh/asic/company/?id=${encodeURIComponent(companyId)}`,
    {
      headers: {
        'x-api-key': 'YOUR_API_KEY'
      }
    }
  );
  return await response.json();
};
```

### Feasibility Rating: **Medium**
- **Pros**: Official government data, comprehensive company information
- **Cons**: Requires application and approval process, director verification limited
- **Alternative**: Third-party APIs like vigil.sh provide easier access but at cost

---

## 2. NSW Fair Trading Builder Licence

### Overview
NSW Fair Trading provides licensing information for builders and tradespeople through their public registers and APIs.

### Key Findings

**Can we verify builder licence numbers?**
- **Yes**, through multiple channels:
  1. NSW Fair Trading Public Register (web interface)
  2. API.NSW Trades API (programmatic access)
  3. Verify.licence.nsw.gov.au portal

**Is there an API or only web scraping?**
- **Yes, there is an official API**: API.NSW Trades API
- **URL**: `https://api.nsw.gov.au/Product/Index/25`
- **Alternative**: Web scraping possible but API recommended

**What data does it return?**
- Licence holder name and details
- Licence number and type
- Licence status (current/expired)
- Authorised work categories
- Expiry dates
- Conditions and restrictions

### Technical Details

**Endpoint URLs:**
- **API Base**: `https://api.nsw.gov.au/`
- **Trades API Product**: `https://api.nsw.gov.au/Product/Index/25`
- **Verify Portal**: `https://verify.licence.nsw.gov.au/home/Trades`

**Authentication Method:**
- OAuth 2.0 with API key/secret
- Free tier: 2,500 calls/month with API key
- Premium tier: Custom calls/month with subscription

**Cost:**
- **Free tier**: 2,500 calls/month
- **Premium tier**: Custom pricing (contact API.NSW)
- No cost for basic verification through web portal

**Data Returned:**
```json
{
  "licenceNumber": "123456",
  "holderName": "John Smith",
  "licenceType": "Builder",
  "status": "Current",
  "expiryDate": "2026-12-31",
  "workCategories": ["Residential building", "Commercial building"],
  "conditions": ["Supervision required for certain works"]
}
```

### Code Example

```javascript
// Using API.NSW Trades API
const verifyBuilderLicence = async (licenceNumber) => {
  // First get OAuth token
  const tokenResponse = await fetch('https://api.nsw.gov.au/oauth/token', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded',
      'Authorization': 'Basic ' + btoa('API_KEY:API_SECRET')
    },
    body: 'grant_type=client_credentials'
  });
  
  const { access_token } = await tokenResponse.json();
  
  // Then query licence
  const licenceResponse = await fetch(
    `https://api.nsw.gov.au/trades/licences/${licenceNumber}`,
    {
      headers: {
        'Authorization': `Bearer ${access_token}`
      }
    }
  );
  
  return await licenceResponse.json();
};
```

### Feasibility Rating: **Easy**
- **Pros**: Official API available, free tier sufficient for moderate usage
- **Cons**: Rate limits apply, requires API key registration
- **Best approach**: Use API.NSW for programmatic access

---

## 3. SafeWork NSW White Card Verification

### Overview
White Cards (General Construction Induction Cards) are required for construction workers in NSW.

### Key Findings

**Can we verify construction induction (white card) numbers?**
- **Yes**, through Service NSW online verification
- **URL**: `https://www.service.nsw.gov.au/transaction/check-a-general-construction-induction-card-white-card`
- **Alternative**: `https://verify.licence.nsw.gov.au/home/GCIT`

**Any API available?**
- **No official public API found**
- Verification appears to be web-based only
- May require web scraping or manual verification

### Technical Details

**Endpoint URLs:**
- Web portal: `https://verify.licence.nsw.gov.au/home/GCIT`
- Service NSW: `https://www.service.nsw.gov.au/transaction/check-a-general-construction-induction-card-white-card`

**Authentication Method:**
- Web form submission (no authentication required for public verification)

**Cost:**
- Free for public verification

**Data Returned:**
- Card holder name
- Card number
- Issue date
- Status (valid/expired)
- Training provider details

### Code Example (Web Scraping Approach)

```javascript
// Note: Web scraping may violate terms of service
// Check terms before implementing

const puppeteer = require('puppeteer');

const verifyWhiteCard = async (cardNumber, lastName) => {
  const browser = await puppeteer.launch();
  const page = await browser.newPage();
  
  await page.goto('https://verify.licence.nsw.gov.au/home/GCIT');
  
  // Fill form and submit
  await page.type('#cardNumber', cardNumber);
  await page.type('#lastName', lastName);
  await page.click('#verifyButton');
  
  // Wait for results
  await page.waitForSelector('.results-container');
  
  const results = await page.evaluate(() => {
    return {
      name: document.querySelector('.holder-name')?.textContent,
      cardNumber: document.querySelector('.card-number')?.textContent,
      status: document.querySelector('.status')?.textContent,
      expiry: document.querySelector('.expiry-date')?.textContent
    };
  });
  
  await browser.close();
  return results;
};
```

### Feasibility Rating: **Hard**
- **Pros**: Free public verification available
- **Cons**: No official API, web scraping required (may violate terms)
- **Alternative**: Manual verification or partner with training providers

---

## 4. Workers Compensation Verification (iCare NSW)

### Overview
iCare NSW manages workers compensation insurance for NSW employers.

### Key Findings

**Can we check if a contractor has current workers comp insurance?**
- **Yes**, through iCare Employer Lookup tool
- **URL**: `https://www.icare.nsw.gov.au/employer-lookup`
- **Note**: Contractors are not typically required to have workers comp for themselves, but businesses using contractors may need coverage

**Verification Method:**
- Online lookup by ABN or ACN
- Provides instant confirmation of Workers Compensation policy
- Data refreshed weekly (each Monday)

### Technical Details

**Endpoint URLs:**
- Web portal: `https://www.icare.nsw.gov.au/employer-lookup`
- Self-service portal: `https://policyportal.icare.nsw.gov.au/`

**Authentication Method:**
- Public web form (no authentication required)

**Cost:**
- Free for public verification

**Data Returned:**
- Employer/business name
- Policy status (active/inactive)
- Policy number
- Coverage period
- Certificate of Currency availability

### Code Example (Manual Verification Process)

```javascript
// Since no API is available, implement a manual verification flow
// This would guide users to verify on iCare website

const guideICareVerification = (abn) => {
  return {
    steps: [
      `Visit: https://www.icare.nsw.gov.au/employer-lookup`,
      `Enter ABN: ${abn}`,
      `Record verification result`,
      `Upload screenshot of verification for audit trail`
    ],
    notes: [
      'Data is refreshed each Monday',
      'For Certificate of Currency, employer must login to Self-Service portal',
      'Contact iCare at 13 44 22 for discrepancies'
    ]
  };
};

// Alternative: Consider commercial insurance verification services
// that may offer API access to multiple insurers
```

### Feasibility Rating: **Medium**
- **Pros**: Free public verification tool available
- **Cons**: No API, manual verification required, data only weekly updates
- **Best approach**: Guide users to verify and provide evidence, or use commercial verification services

---

## 5. Google Places API for Address Verification

### Overview
Google Places API provides address validation and verification services globally, including Australia.

### Key Findings

**How to use it for Australian address validation**
- Use Address Validation API with `regionCode: "AU"`
- Supports structured and unstructured address input
- Returns validated, formatted address with confidence scores

**Cost per lookup**
- **Address Validation API**: ~$0.017 per request (58 requests/$1)
- **Monthly credit**: $200 credit applies until February 28, 2025
- **Autocomplete sessions**: Free when linked with Place Details or Address Validation

**Integration with Next.js**
- Client-side: Load Google Maps JavaScript API
- Server-side: Use Places API Web Service
- Recommended: Use `@react-google-maps/api` or `use-places-autocomplete` for React/Next.js

### Technical Details

**Endpoint URLs:**
- **JavaScript API**: `https://maps.googleapis.com/maps/api/js?key=YOUR_KEY&libraries=places,addressValidation`
- **Web Service**: `https://places.googleapis.com/v1/places:searchText`
- **Address Validation**: `https://addressvalidation.googleapis.com/v1:validateAddress`

**Authentication Method:**
- API key (client-side and server-side)
- Recommended: Restrict API key to your domain and specific APIs

**Cost:**
- **Address Validation**: ~$0.017 per request
- **Autocomplete (per request)**: ~$0.00283
- **Autocomplete (session)**: Free with Place Details/Address Validation
- **Monthly credit**: $200 (until Feb 2025)

**Data Returned:**
- Formatted address
- Address components (street, suburb, state, postcode)
- Validation verdict (granularity, completeness)
- Geocode information
- UspsData (for US addresses)

### Code Example (Next.js Integration)

```javascript
// pages/_document.js - Load Google Maps API
import { Html, Head, Main, NextScript } from 'next/document';
import Script from 'next/script';

export default function Document() {
  return (
    <Html>
      <Head>
        <Script
          src={`https://maps.googleapis.com/maps/api/js?key=${process.env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY}&libraries=places,addressValidation`}
          strategy="beforeInteractive"
        />
      </Head>
      <body>
        <Main />
        <NextScript />
      </body>
    </Html>
  );
}

// components/AddressValidator.js - Client-side validation
import { useLoadScript } from '@react-google-maps/api';
import { useState } from 'react';

export default function AddressValidator() {
  const { isLoaded } = useLoadScript({
    googleMapsApiKey: process.env.NEXT_PUBLIC_GOOGLE_MAPS_API_KEY,
    libraries: ['places', 'addressValidation']
  });

  const validateAddress = async (address) => {
    if (!isLoaded) return;
    
    try {
      // @ts-ignore
      const result = await google.maps.addressValidation.AddressValidation.fetchAddressValidation({
        address: {
          regionCode: 'AU',
          addressLines: [address.street],
          locality: address.suburb,
          administrativeArea: address.state,
          postalCode: address.postcode
        }
      });
      
      return {
        formattedAddress: result.address.formattedAddress,
        isValid: result.verdict.validationGranularity === 'PREMISE',
        components: result.address.addressComponents
      };
    } catch (error) {
      console.error('Address validation failed:', error);
      return null;
    }
  };

  // Component implementation...
}

// Server-side validation (API route)
// pages/api/validate-address.js
export default async function handler(req, res) {
  if (req.method !== 'POST') {
    return res.status(405).json({ error: 'Method not allowed' });
  }

  const { address } = req.body;
  
  const response = await fetch(
    'https://addressvalidation.googleapis.com/v1:validateAddress',
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'X-Goog-Api-Key': process.env.GOOGLE_MAPS_API_KEY
      },
      body: JSON.stringify({
        address: {
          regionCode: 'AU',
          addressLines: [address.street],
          locality: address.suburb,
          administrativeArea: address.state,
          postalCode: address.postcode
        }
      })
    }
  );

  const data = await response.json();
  res.status(200).json(data);
}
```

### Feasibility Rating: **Easy**
- **Pros**: Comprehensive address validation, good Australian coverage, reasonable pricing
- **Cons**: Requires API key management, costs scale with usage
- **Best approach**: Use Address Validation API with session tokens to minimize costs

---

## Summary and Recommendations

### Priority Implementation Order

1. **Google Places API** (Easy) - Critical for address validation
2. **NSW Fair Trading Builder Licence API** (Easy) - Official API available
3. **ASIC Company Verification** (Medium) - Important for business verification
4. **iCare Workers Comp Verification** (Medium) - Manual process recommended
5. **White Card Verification** (Hard) - Consider manual verification or partnerships

### Cost Considerations

1. **Free options available** for most government verifications (web portals)
2. **API costs** for Google Places (~$0.017 per address validation)
3. **Third-party services** like vigil.sh for ASIC data (subscription-based)
4. **Development costs** for implementing multiple verification systems

### Technical Implementation Strategy

**Phase 1 (MVP):**
- Implement Google Places API for address validation
- Integrate NSW Fair Trading API for builder licence verification
- Manual processes for other verifications with user uploads

**Phase 2 (Enhanced):**
- Implement ASIC company verification (via vigil.sh or direct API)
- Automate iCare verification through web scraping (if terms allow)
- Build admin dashboard for manual verification review

**Phase 3 (Full Automation):**
- Explore commercial verification services that aggregate multiple sources
- Implement comprehensive audit trails for compliance
- Add real-time verification webhooks

### Compliance Notes

1. **Data Privacy**: Ensure compliance with Australian Privacy Principles
2. **Terms of Service**: Respect API usage limits and web scraping policies
3. **Audit Trails**: Maintain records of all verifications for compliance
4. **User Consent**: Obtain clear consent for verification checks

### Alternative Services to Consider

1. **Vix Verify** - Commercial Australian business verification service
2. **GBG Identity Verification** - Comprehensive identity and business verification
3. **Australia Post Digital ID** - Government-backed identity verification
4. **Credit reporting agencies** - May offer business verification services

---

**Next Steps:**
1. Create proof of concept for Google Places API integration
2. Apply for API.NSW developer access
3. Evaluate vigil.sh pricing for ASIC data
4. Design user flows for manual verification processes
5. Implement audit logging system for compliance