The Companies House API, explained: auth, rate limits and the gotchas

The free official API to the UK register: how the authentication actually works, what the 600-per-5-minutes rate limit means at register scale, which endpoints matter, and the gotchas we hit building on it for years.

The Companies House API is the free, official, machine-readable door to the UK company register. Leadistry is built on it, and has been hammering it daily for a long time, so this is the guide we wish had existed when we started: what the API is, how the authentication actually works, what the rate limit means in practice, and the gotchas that only show up at scale.

What it is, and what it is not

The API serves the live public register as JSON: company profiles, officers, filing history, registered addresses, charges and people with significant control. Anything you can see on a company's public Companies House page, you can fetch programmatically, for free, including for commercial use.

What it does not contain matters just as much. The public record holds no email addresses, no websites and no phone numbers, and it never has. Companies file legal facts, not marketing contact details. Every tool that offers "Companies House data with emails" is doing its own detective work on top, which is exactly the layer Leadistry adds and documents.

Getting a key

Sign up at the Companies House developer hub (developer.company-information.service.gov.uk), create an application, and it issues an API key. There are live keys and test keys; the sandbox is worth using for write-side APIs, but for reading the public record you will live entirely on the live key.

Authentication: the bit everyone gets wrong first

It is HTTP Basic auth with the API key as the username and an empty password. Not a bearer token, not a query parameter. With curl, that means the key followed by a colon:

curl -u YOUR_KEY: https://api.company-information.service.gov.uk/company/00000006

In JavaScript, set the Authorization header to Basic with the base64 of "YOUR_KEY:" (key, colon, nothing). Nearly every first-timer sends the key as a bearer token, gets a 401, and spends an hour on it. You have now spent zero.

The rate limit, and what it means at register scale

The documented limit is 600 requests per 5 minutes per key. Exceed it and you get 429s until the window rolls.

Do the arithmetic before designing anything: 600 per 5 minutes is 172,800 requests a day flat out. The public record holds around five million active companies, so a full one-request-per-company sweep takes about a month of continuous polling, and that is with nothing left over. If your plan involves "just fetch everything", the API is the wrong tool for the first load; see bulk data below. Use the API for targeted reads and freshness, not for exhaustive harvesting.

The endpoints you will actually use

• Search: /search/companies for name search, and the advanced search endpoint for filtering by SIC code, incorporation date and status, which is the closest the API gets to finding companies by industry.
• Company profile: /company/(number), the core record: status, type, incorporation date, SIC codes, registered office, accounts and confirmation statement due dates. Those due dates are a prospecting signal in their own right, as our guide to filing deadlines explains.
• Officers: /company/(number)/officers, paginated, current and resigned.
• Filing history: /company/(number)/filing-history, everything the company has ever filed.
• PSC: /company/(number)/persons-with-significant-control, the ownership layer.

Streaming, for when polling stops scaling

Companies House also runs a separate streaming API: long-lived HTTP connections that push register changes to you as they happen, one stream per resource type. If you care about freshness across many companies, streaming plus an initial bulk load beats polling by miles, and it is how you find out about a brand-new incorporation the same morning it happens rather than whenever your crawler next wanders past.

Bulk data, for the first load

The free monthly snapshot (the basic company data product) is a CSV of every live company on the public record, downloadable without any API involvement. The pattern that works at scale is: bulk snapshot for the initial load, streaming for changes, API for targeted detail reads. That pattern is not in any official tutorial, and discovering it the slow way costs weeks.

Gotchas from running this for real

• Everything is nullable. Dissolved companies missing addresses, profiles missing SIC codes entirely or carrying the literal string "None supplied", dates absent on old records. Code that assumes fields exist dies within the first thousand companies.
• SIC codes are strings, not numbers, with leading zeros that matter. Treat 01110 as text or lose it.
• Company status has more values than you think: active, dissolved, liquidation, receivership, administration, converted-closed and more, and your handling of each is a policy decision, not a parsing detail.
• Pagination is mandatory discipline. Officers and filing history page at their own sizes; search endpoints cap how deep you can paginate, so exhaustive pulls belong in bulk data, not search.
• Budget the rate limit per feature, not per app. One runaway backfill starves every other consumer of the same key. We learned to give every job an explicit request budget.

When the API is the wrong tool

If what you actually want is a prospect list, the API gives you half of one: the right companies, with no way to contact them. The other half, finding each company's website, the director's name and a verified email, is a crawling and verification problem the public record cannot solve for you. That is the product line between raw register access and lead generation built on the public record; our honest take on when you need which is in the API alternative guide.

Questions people ask

Is the Companies House API free?

Yes, including for commercial use. Register data is public information; attribution under the Open Government Licence is good practice, and it is what we do.

What is the rate limit?

600 requests per 5 minutes per key, with 429 responses beyond it. There is no paid tier to raise it, which is why the bulk snapshot and streaming exist.

Does it include email addresses or websites?

No. The public record has never held them. Any dataset offering them has added its own enrichment layer on top, and the right question to ask any vendor is how that layer is built and verified.

API, streaming or bulk download?

First load: bulk. Staying current: streaming. Looking things up on demand: API. Most serious consumers of the public record use all three.