ThaiQuest Corporate Data Services API

1. Overview
2. Authentication
3. Rate limits
4. Get a juristic person
5. Response fields
6. Errors
7. Code examples
8. Data notes

1Overview

The CDS API is a read-only REST API. Every request is an HTTPS GET; every response body is UTF-8 JSON (application/json; charset=utf-8), including errors. Thai text is returned as UTF-8 characters, not escaped.

2Authentication

Every /api/v1/ request must carry an API key in the X-API-Key header. The header name is case-insensitive.

X-API-Key: cds_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

• Keys are issued by the CDS team; each key belongs to one client application.
• Keep keys server-side. Never embed them in browser JavaScript or mobile apps, and never put them in a URL.
• A key may carry an expiry date. Expired or disabled keys return 403.
• Key changes (new keys, revocations, new limits) take effect within seconds, without downtime.

The documentation pages (/api/spec, /api/docs, /api/openapi.yaml) do not require a key.

Demo key

To try the API before you have your own key, use the public demo key cds_testKey. It returns the complete record for ThaiQuest (0105543033451) only; any other request with it returns 401 invalid_api_key.

curl https://cds-demo.thaiquest.net/api/v1/juristics/0105543033451 \
  -H "X-API-Key: cds_testKey"

Your own key returns the complete record for every juristic person.

3Rate limits

Limits are applied per API key, across all endpoints, in fixed calendar windows using Thailand time (UTC+7). Each window resets at its boundary — the start of the next minute, hour, day (00:00) or month (1st, 00:00). A request must fit within every window.

Your key may have a custom plan. The response headers always tell you the limit that currently applies:

Global limit per IP address

Independently of your plan, all traffic is subject to a global rate limit of 30 requests per 10 seconds per client IP address, enforced at the network edge. Exceeding it returns 429 from the edge (not the JSON error format above, and without X-RateLimit-* headers) and blocks that IP for a short period. Spread bursts out, and keep concurrent workers sharing one IP below this rate.

4Get a juristic person

Returns the registration profile of one juristic person (company or partnership) and the headline figures from its most recent filed financial statement.

curl https://cds-demo.thaiquest.net/api/v1/juristics/0105543033451 \
  -H "X-API-Key: $CDS_API_KEY"

{
  "name_th": "บริษัท ไทยเควสท์ จำกัด",
  "name_en": "THAIQUEST LIMITED",
  "juristic_id": "0105543033451",
  "juristic_type": "บริษัทจำกัด",
  "status": "ยังดำเนินกิจการอยู่",
  "address": "888/180 อาคารมหาทุนพลาซ่า ชั้น 18 ถนนเพลินจิต แขวงลุมพินี เขตปทุมวัน กรุงเทพมหานคร 10330",
  "tsic": "63111",
  "purpose": "ให้บริการข่าวสารข้อมูล และอุปกรณ์ในการรับส่งข่าวสา",
  "registration_date": "2000-04-03",
  "last_filing_year": 2025,
  "last_filing_year_be": 2568,
  "last_filing_date": "2026-05-14",
  "lfy_revenue": 166573112,
  "lfy_profit": 28418355
}

5Response fields

All fields are always present. Fields marked nullable are null when the juristic person has never filed a financial statement.

6Errors

Errors use standard HTTP status codes and a JSON body with a stable machine-readable error code and a human-readable message. Branch on error, not on message.

{ "error": "not_found", "message": "juristic 0105500000009 not found" }

7Code examples

Python (requests)

import os, time, requests

def get_juristic(juristic_id: str) -> dict | None:
    r = requests.get(
        f"https://cds-demo.thaiquest.net/api/v1/juristics/{juristic_id}",
        headers={"X-API-Key": os.environ["CDS_API_KEY"]},
        timeout=10,
    )
    if r.status_code == 404:
        return None
    if r.status_code == 429:
        time.sleep(int(r.headers["Retry-After"]))
        return get_juristic(juristic_id)
    r.raise_for_status()
    return r.json()

JavaScript (Node 18+)

const res = await fetch(
  `https://cds-demo.thaiquest.net/api/v1/juristics/${juristicId}`,
  { headers: { "X-API-Key": process.env.CDS_API_KEY } },
);
if (res.status === 404) return null;
if (!res.ok) {
  const { error, message } = await res.json();
  throw new Error(`${res.status} ${error}: ${message}`);
}
const juristic = await res.json();

Go

req, _ := http.NewRequest("GET", "https://cds-demo.thaiquest.net/api/v1/juristics/"+id, nil)
req.Header.Set("X-API-Key", os.Getenv("CDS_API_KEY"))
res, err := http.DefaultClient.Do(req)

8Data notes

• Source. Public registration and financial-statement data of the Department of Business Development (DBD), Ministry of Commerce, refreshed continuously.
• Years. DBD publishes fiscal years in the Buddhist Era. The API returns both: last_filing_year in the Gregorian calendar (2025) and last_filing_year_be as published (2568). Use the CE value for date arithmetic and sorting. All dates are ISO 8601 (YYYY-MM-DD), Gregorian.
• Last filed year. The most recent fiscal year with a non-empty statement. Companies file about five months after year end, so the latest year may lag by more than a year.
• Money. Amounts are in Thai baht as JSON numbers. Revenue is total revenue (sales/services plus other income); profit is net profit after tax.
• IDs. Always treat juristic_id as a string — it has leading zeros.