Tvarka Due Diligence

Due diligence on Lithuanian legal entities: company profile and management, shareholders and participants, beneficial owners, real property, property seizure acts, court case involvement, and a composite report.

The service is provided as a legal service by a certified Lithuanian attorney-at-law (advokatas), who legally and officially attests the provenance and integrity of the data – optionally with a qualified electronic signature on the response. It is not public: production keys are issued once the engagement agreement is signed. Sandbox keys are self-serve and answer synthetic data, so you can build the integration before any paperwork.

What you can ask about a company

Everything is keyed by the Lithuanian legal-entity code (juridinio asmens kodas).

Prices exclude VAT. You are billed per answered call. A no-data answer and an upstream register failure are never billed – you only pay for an answer we could actually give.

Authentication

curl -H "Authorization: Bearer $TVARKA_DD_KEY" \
     https://api.tvarka.pro/v1/entities/133663153

Sandbox keys start ddk_test_, production keys ddk_live_. Sandbox never reaches a register and costs nothing.

Beneficial ownership

Legal interpretation

Add ?interpret=1 and the answer additionally carries its standardized legal interpretation: what the data means under Lithuanian law, item by item, each with statute citations. Interpretation is authored and versioned by the responsible advokatas as a reviewed library (the version travels in interpretation.policyVersion), and the engine only selects the entries the data supports – the same data always yields the same interpretation. It is a standardized automated interpretation provided as part of the legal service, not a bespoke legal opinion, and it never aggregates into a score or rating.

Available on the company profile, beneficial owners, seizure acts and the composite report, at a flat €0.29 per call on top of the data price (introductory price). On MCP tools, pass "interpret": true.

Signed responses

Add ?sign=jades-t or ?sign=jades-lt and the same JSON comes back wrapped in a JAdES signature (ETSI TS 119 182-1, flattened JWS JSON serialization), created with the qualified electronic signature of the responsible advokatas plus a qualified timestamp. The LT level also embeds the certificate chain and revocation data, so the artifact still validates years later without a live responder. ?format=asice returns an ASiC-E container holding the normalized JSON, the raw register response and the same qualified signature.

What the signature certifies is provenance and integrity: that the named advokatas relayed this data unmodified from the named official source at the stated time, as part of a legal service. It is not a document issued by the register itself.

If a signature cannot be produced, the request fails with 503 and is not billed. You will never receive an unsigned body at a signed-tier price.

Identification package (KYC)

The registers say who holds a role. The identification package makes the person prove they are that role-holder: you order it for an entity code and a claimed role, the subject signs the composed dossier with their own qualified electronic signature, and the platform machine-verifies that the identity certified in their signature corresponds to the register record. The responsible advokatas then attests exactly that correspondence, and you receive one ASiC-E evidence container.

Statutory basis: a qualified electronic signature is a permitted means of establishing a client's identity without the client being physically present, because the certificate behind it was issued after physical-presence identity proofing. No video call, no selfie matching, no biometric processing at any point.

POST /v1/kyc-packages
{"entityCode": "133663153", "subjectRole": "vadovas", "purpose": "AML_KYC",
 "delivery": "link", "callbackUrl": "https://your.app/hooks/tvarka"}

202 {"orderId": "…", "status": "awaiting_subject", "ceremonyUrl": "https://…"}

Give the subject the ceremonyUrl (or pass "delivery": "email" with a subjectEmail and we deliver it). The outcome arrives on your callbackUrl, HMAC-signed with your webhook secret; polling GET /v1/kyc-packages/{orderId} is the equivalent fallback. Fetch the container from GET /v1/kyc-packages/{orderId}/artifact once the status is delivered.

The container holds the signed dossier, the machine-readable payload, that same payload independently signed JAdES-LT (so the evidence survives extraction from the container), the human-readable attestation, and the raw register responses.

Price: €24.99 per delivered package, €14.99 to re-verify a subject and entity you have already had identified. Excludes VAT. Charged on delivery only – an order refused because nobody holds the claimed role, an abandoned ceremony, an identity mismatch and any failure on our side all cost you nothing. No monthly minimum, no commitment.

An identity mismatch is reported as a status, not sold as an attested adverse finding, and no container is produced. Subjects whose qualified certificate carries a non-Lithuanian national identifier are out of scope for now.

Errors

Every non-2xx is RFC 9457 application/problem+json. The two that matter operationally are 404 …/no-data (the register answered and holds nothing – not billed) and 502 …/upstream-unavailable (the register did not answer – not billed, retry).

402 …/payment-required means the entity behind your production key cannot be billed right now, so nothing was pulled and nothing was charged. Four causes, and the detail field says which: no entity is linked to the key, the entity has no enrolled payment method, an invoice is overdue and the account is locked, or the usage ceiling is reached while an earlier payment settles. Only the last one clears by itself – retry that once the payment has cleared. The other three need someone to act, so retrying is pointless. Sandbox keys never see this.

MCP

The same products are available to agents over the Model Context Protocol at https://api.tvarka.pro/mcp (Streamable HTTP), using the same key and the same pricing.

Connecting a client

Any client that speaks MCP over Streamable HTTP works: point it at the endpoint and send your key in the Authorization header. Two spellings cover almost everything.

Claude Code, one line:

claude mcp add --transport http tvarka-due-diligence https://api.tvarka.pro/mcp \
  --header "Authorization: Bearer $TVARKA_API_KEY"

Claude Desktop, Cursor, Windsurf, VS Code and the other config-file clients take the same server as JSON. The key name of the config block differs by client (mcpServers in most, servers in VS Code); the server object does not:

{
  "mcpServers": {
    "tvarka-due-diligence": {
      "type": "http",
      "url": "https://api.tvarka.pro/mcp",
      "headers": { "Authorization": "Bearer YOUR_KEY" }
    }
  }
}

In workflow tools, use the generic MCP client step – the MCP Client Tool node in n8n, for example – with the same URL, Bearer authentication and your key.

Contract

OpenAPI 3.1 (YAML) · OpenAPI 3.1 (JSON)

Terms

Use of the API and the MCP server is governed by the Tvarka Due Diligence Terms of Service. Production access additionally requires the signed engagement agreement, which is a legal services agreement with the responsible advokatas.

Get access

Write to dd@tvarka.pro for a sandbox key. Sandbox keys need nothing else: no agreement, no payment method, no entity.

A production key additionally needs all three of the following, and the key answers 402 until they are in place: acceptance of the Terms of Service, the signed engagement agreement, and a linked Tvarka entity that can be billed – either with an enrolled payment method or on individually agreed terms. Build against the sandbox first; the contract and the data are identical, so nothing has to be rewritten when the production key arrives.