Primary BUMIT operation. No authentication, no API key, no account; no payment is currently required. Request bodies are not logged and no caller identity is stored.

Send Content-Type: application/json (otherwise 415). Maximum body 8192 bytes (otherwise 413). Body: any supported combination of uid, name and address; only these fields are accepted (unknown fields → 400). A UID must carry the CHE prefix and a valid mod-11 check digit, otherwise the request is rejected (422) before any source lookup.

Resolution: a UID resolves cache-first against the commercial register. A name alone is enough to start: BUMIT searches the commercial register (discovery), then resolves identity conservatively. Exactly one exact normalized legal-name match resolves its UID and runs the same verification as a UID request. Several exact matches (optionally narrowed by address.locality = seat) return AMBIGUOUS / MULTIPLE_EXACT_NAME_MATCHES. No exact match but register candidates (even one) return AMBIGUOUS / NAME_CANDIDATES_REQUIRE_SELECTION — partial or similar names are never auto-selected, and locality never narrows them. No candidates → NOT_FOUND. A partial local cache never proves absence, uniqueness or identity (UNAVAILABLE / REGISTER_SEARCH_UNAVAILABLE). To continue after AMBIGUOUS, choose a candidate and call again with {"uid": "<candidate uid>"}. Address alone is UNSUPPORTED for resolution.

Overall outcome is derived deterministically from REQUIRED checks (register existence, register status, direct SECO screening against the accepted production baseline, and name match when uid and name are both supplied): any NOT_VERIFIED → NOT_VERIFIED; else any REVIEW_REQUIRED → REVIEW_REQUIRED; else any other non-VERIFIED → UNAVAILABLE; else VERIFIED. An unresolved business returns the resolution outcome (NOT_FOUND, AMBIGUOUS, UNAVAILABLE, UNSUPPORTED). FINMA authorisation-list membership is reported but never required. VAT, address, LEI and FINMA warning checks have no production source and are reported as UNSUPPORTED (NOT_REQUESTED when the input was not supplied). See x-agent-guidance.

Interpreting the evidence: read result.outcome first, then each checks[] entry. sources names the source (ZEFIX = commercial-register index; SECO_SANCTIONS and FINMA = operator-ingested datasets), data_basis says whether it is a cache-first register lookup, an accepted production dataset, a synthetic fixture or NONE, provenance carries the source record or dataset reference, and freshness carries the times BUMIT actually holds (observed_at, retrieved_at, source_timestamp) plus served_from_cache and stale. A null timestamp is unknown; there is no universal last-updated time.

SECO and FINMA are never contacted by this operation, and it cannot trigger any acquisition. Responses are Cache-Control: no-store. Not a complete KYB result.

{
  "coverage": {
    "derivation": "PROJECTION_OF_CHECKS",
    "performed": [
      {
        "capability": "REGISTRY_EXISTENCE",
        "requirement": "REQUIRED",
        "outcome": "VERIFIED",
        "reason_code": "REGISTER_ENTRY_FOUND"
      }
    ],
    "not_performed": [
      {
        "capability": "VAT_VERIFY",
        "requirement": "NOT_REQUIRED",
        "outcome": "UNSUPPORTED",
        "reason_code": "PRODUCTION_SOURCE_NOT_AVAILABLE"
      }
    ]
  }
}