Every company that sells to, hires, or does business with other companies in Brazil eventually needs to verify who's on the other side. The CNPJ — Cadastro Nacional da Pessoa Jurídica, Brazil's national company registration number — is the key document for that. But there's a world of difference between looking up CNPJs manually, one by one, on the Receita Federal (Brazil's federal tax authority) website, and automating that process via API inside your own system.
In this guide, we explain how each approach works, why manual lookups don't scale, and how to use a CNPJ lookup API to automate verifications reliably. If you run an operation that does KYB (Know Your Business), supplier onboarding, business credit analysis or fraud prevention, this is for you.
What a CNPJ lookup at the Receita Federal is
The CNPJ is issued and maintained by the Receita Federal do Brasil (RFB). Each number identifies a legal entity and is tied to a set of registration data: legal name, trade name, incorporation date, legal nature, company size, economic activity (CNAE, Brazil's standard industry classification), address, the table of partners and officers (QSA), enrollment in Simples Nacional (Brazil's simplified tax regime for small businesses), and — perhaps the most decision-critical field — the registration status, which can be Active, Suspended, Inapt, Closed or Null.
The Receita offers a public lookup at the Comprovante de Inscrição e de Situação Cadastral. The process is simple: you enter the CNPJ number, solve a captcha, and receive a certificate with the company's registration data.
That lookup is free and works well for one-off checks — verifying a single supplier's registration before signing a contract, for example. But when the need is business-critical and recurring, the problems show up fast.
Why manual lookups don't scale
In practice, anyone who tries to use the Receita Federal's manual lookup as part of a business process runs into structural limitations.
Mandatory captcha. Every lookup requires solving a captcha, which blocks direct automation and forces human intervention on every single check.
One lookup at a time. There is no batch feature. Validating 300 CNPJs from new suppliers in a day means 300 manual visits, 300 captchas and 300 copy-pasted results.
No system integration. The result is an HTML page — a visual certificate. There is no structured output your system can process automatically to approve or reject a registration.
No guaranteed availability. The Receita's website has no SLA for external use. It can be down or slow at peak hours, with zero predictability.
No logging or traceability. A manual lookup produces no standardized record. In an audit or dispute, reconstructing the verification history is laborious and error-prone.
For any operation validating more than a handful of CNPJs per day, manual lookup is an operational bottleneck.
What changes with a CNPJ lookup via API
A CNPJ lookup API performs the same verification as the manual lookup, but programmatically. Your system sends the CNPJ number and receives, in milliseconds, a structured response with the registration data, the ownership table and the document's status — machine-to-machine, with no captcha and no copy-pasting between screens.
With that structured response, your system decides automatically: approve the registration if the company is Active, block it if it's Closed or Inapt, or route it to human review if the legal name doesn't match. The QSA fields let you cross-check who the partners are, and the size and CNAE data help you segment the customer or calibrate credit limits.
In practice, integration is simple: an authenticated HTTP request with your API key returns everything as JSON. Complete request and response examples — in cURL, Python, Node.js and other languages — are in the FonteData documentation, ready to copy and adapt.
Check-digit validation vs. official lookup: don't confuse the two
A common mistake is thinking that validating a CNPJ just means checking whether the check digits are correct. The mod-11 algorithm exists to catch typos — it answers the question "is this number mathematically possible?". But it doesn't tell you whether the CNPJ actually exists, whether the company is active, what the current registration status is, or who the partners are. Fraudsters generate mod-11-valid CNPJs at scale, because the algorithm is public.
The API lookup solves the second problem: it goes to the official source and confirms existence and status. In a good architecture, the two steps work together — check digits on the front end for instant feedback, and the official lookup on the back end before releasing any sensitive action like account activation, credit approval or order release.
Watch out for the alphanumeric CNPJ. Starting in July 2026, new CNPJs will contain letters as well as digits, and the check-digit calculation changes. If your front-end validation uses an old regex or check-digit algorithm, it will start rejecting legitimate CNPJs. We cover the timeline, the new format and updated code in the Alphanumeric CNPJ 2026 guide.
What a CNPJ lookup returns
Unlike the CPF (Brazilian individual taxpayer ID), the CNPJ carries a much richer set of information, because it describes an entire organization. It's worth understanding the fields that matter most when it's time to decide:
Registration status. The most important field. Active means a company in regular operation. Suspended usually indicates a registration issue. Inapt appears when the company has stopped filing mandatory declarations. Closed is a company that has shut down. Null indicates an annulled registration, frequently tied to fraud. For most workflows, only Active should pass automatically.
Partners and officers table (QSA). Who the partners are, their roles and the date they joined the company. Essential for due diligence, KYB and ultimate beneficial owner identification.
CNAE (economic activity). Defines the line of business. Useful for segmenting customers, applying sector-specific rules or spotting activities incompatible with your product.
Size and revenue bracket. MEI (individual micro-entrepreneur), ME (micro), EPP (small) or larger. Helps calibrate credit limits, commercial terms and volume expectations.
Simples Nacional enrollment. Affects taxation and invoicing — frequently needed by the tax team.
Address, phone numbers and emails. Contact and location data, useful both for record enrichment and cross-validation.
Use cases: where a CNPJ lookup API is indispensable
B2B onboarding and KYB. Marketplaces, SaaS platforms, acquirers and fintechs that sell to companies need to verify every business customer before enabling operations. The CNPJ lookup is the first layer: it confirms the company exists, is active, and identifies its partners.
Supplier registration and qualification. Before adding a supplier and releasing payments, confirm the registration status, a compatible CNAE and the ownership structure. An Inapt or Closed CNPJ showing up at registration is an immediate red flag.
Business credit analysis. Before running a score or querying credit bureaus, check whether the CNPJ is in good standing and what the company's size is. If the status is already disqualifying, the credit pipeline stops before incurring the cost of more expensive queries.
Fraud prevention. Shell companies have recognizable patterns: very recent incorporation combined with high-value orders, an incompatible CNAE, or an irregular registration status. Validating at signup reduces fraud and defaults.
Invoice issuance. To issue an NF-e (Brazil's electronic invoice) to a business recipient, the data must be correct and the registration active. Checking before issuing avoids rejection by SEFAZ (the state tax authority) and fiscal rework.
Due diligence and market intelligence. Cross-referencing QSA, equity stakes and registration status lets you map corporate groups, spot conflicts of interest and assess counterparty risk — including signs of financial distress such as court-supervised reorganization.
Compliance with the new Pix rules. Since 2025, Pix keys belonging to legal entities require CNPJ validation with the Receita Federal. We cover this in our guide to the new Pix rules for 2026.
FonteData's business-entity solutions
FonteData aggregates more than 100 data sources into a unified API — with the same integration and the same key, you access the entire ecosystem of business-entity lookups, without maintaining multiple contracts with different vendors. Each use case calls for a different depth of data, so we offer a range of endpoints so you can pick the best balance of information and cost:
- Cadastro PJ Plus — full registration data, partners and enrichment (phone, email, revenue bracket) in a single call. Ideal for onboarding and record enrichment.
- Cadastro PJ Básica — essential registration data, the most economical path for simple validation.
- Consulta CNPJ Receita — full registration data with the QSA in the Receita's format, great for high-volume validation.
- Participação Societária — which companies the partners hold stakes in. Essential for due diligence and mapping corporate groups.
- Vínculos Societários — the network of relationships between partners and companies.
- Beneficiário Final — ultimate beneficial owner identification, a compliance and anti-money-laundering requirement.
- Relação de Filiais — headquarters and branches tied to the CNPJ.
For deeper due diligence, these endpoints combine naturally with the compliance, sanctions and credit lookups in the same hub. The full documentation has the parameters, response format and ready-made examples for each one.
Best practices
Validate on the front end, look up on the back end. Check digits can be verified on the front end for instant feedback; the official lookup should happen on the back end, where you protect your key and control the decision. Remember to update your check-digit algorithm for the alphanumeric format that takes effect in July 2026.
Cache deliberately. CNPJ registration data doesn't change often, so a 24-hour to 7-day cache cuts down repeated calls. For credit decisions or high-value contracts, always look up in real time — registration status can change from one day to the next.
Have a fallback. The API may be temporarily unavailable; decide in advance what to do (queue for retry, allow with provisional restrictions, or block and notify). Never silently approve on top of an error.
Keep structured logs. Record every lookup with timestamp, CNPJ, result and decision. In an audit, that log is your evidence of due diligence.
Manual lookup vs. API: side-by-side summary
| Aspect | Manual lookup (Receita) | Lookup via API |
|---|---|---|
| Speed | 30s–2min per lookup | < 1 second |
| Captcha | Mandatory | None |
| Response format | Visual HTML | Structured JSON |
| System integration | None | Direct via HTTP |
| Volume | One at a time | Thousands per minute |
| Ownership table (QSA) | Limited | Structured and cross-referenceable |
| Operational cost | Analyst time | Cents per lookup |
| Traceability | Manual | Automatic logs |
| Availability | No SLA | Contractual SLA |
What about the LGPD?
CNPJ lookups deal mostly with legal-entity data, which is not personal data under the LGPD (Brazil's data protection law). However, the ownership table contains names and documents of individuals — and those are personal data. Processing therefore needs a legal basis and a defined purpose: KYB, fraud prevention, compliance with a legal obligation or performance of a contract are all adequate bases. You should not look up CNPJs and their partners indiscriminately, with no connection to a concrete operation.
FonteData operates in compliance with Brazilian law, acting as a technology intermediary. Data is obtained from official public sources and/or third-party providers, and it is up to the user to ensure the processing purpose has an adequate legal basis.
Next step
If you need to validate CNPJs in your system — for B2B onboarding, supplier qualification, credit analysis, invoicing or due diligence — the most efficient way is to integrate via API.
FonteData offers a complete set of CNPJ lookups as part of a hub with more than 100 data sources, including CPF, KYC, Receita Federal, compliance and sanctions. You pay per lookup, with no monthly fee, and R$50 in free credits to get started.
Want to see every business-entity endpoint with parameters and sample responses? Go to the documentation →
Try the FonteData API
Query Brazilian company and individual data via API — CNPJ, CPF, KYC, compliance and more. R$50 in free credits to test.
Create free account →