Business Monitoring and Webhooks API
A point-in-time lookup only tells you what a business looked like the day you checked. Businesses change after you onboard them: they deregister, hit a sanctions list, or lose a licence. The Australian business data API watches the entities you care about and pushes a signed webhook the moment something changes.
What you can watch
Subscribe an ABN or ACN to the events that matter for ongoing risk, not just onboarding.
| Event | Signal | Source |
|---|---|---|
| deregistration | Company deregistered | ASIC |
| sanctions_match | Possible match on a consolidated sanctions list | DFAT |
| external_administration | Insolvency notice published | ASIC |
| licensing_change | AFS or credit licence status changed | ASIC |
| charity_status_change | Charity registration status changed | ACNC |
| bankruptcy_petition_filed | Bankruptcy petition filed (a distress signal, not a verdict) | Commonwealth Courts |
A sanctions or banned-persons hit is always reported as a possible match for review, never as "cleared" or "passed." No match found is not a clearance.
How it works
Subscribe an entity once. Receive a signed webhook the moment something changes, and poll as a fallback so nothing is ever lost.
POST https://api.auo.com.au/v1/watch Authorization: Bearer auo_sk_test_... { "events": ["deregistration", "sanctions_match", "external_administration"], "webhook_url": "https://example.com/webhooks/auo", "entities": ["46008583542"] }
The response includes a webhook signing secret, shown exactly once. When an event fires, the delivery arrives signed and replay-safe:
X-AUO-Signature: t=1751600000,v1=5257a869e7... { "event": "deregistration", "entity": { "identifier": "46008583542", "id_type": "abn" }, "source": "asic-companies", "as_of": "2026-07-05" }
If your endpoint is down, delivery retries automatically. You can also poll GET /v1/entity/:id/changes at any time to see every event queued for your account, so a missed delivery is never a lost one.
Two views of one source set
/resolve gives you the point-in-time state of an entity: what it looks like right now, joined across every free register. /watch reports the transitions over that same set of red-flag sources over time. They are two views of one source set: whatever can trigger a "review" on resolve can also fire a webhook on watch.
Whitespace no lookup API covers
Point-in-time lookup APIs answer "what does this business look like today." None of them offer webhook-driven continuous monitoring after that first check. ASIC's own Company Alert Service is manual and per-company, not something you can call from your own systems at scale. This one is built to watch, not just to look up once.
Business monitoring questions.
What events can I subscribe to?
Deregistration, name changes, a sanctions or banned-persons hit, an insolvency notice, a licensing change, and a charity-status change, among others. Each event names the underlying register it came from.
How are webhooks secured?
Every webhook is signed with HMAC-SHA256 over the payload (X-AUO-Signature), and the signature is replay-safe: it includes a timestamp so a captured request cannot be resent later.
What if my endpoint is down?
Nothing is lost. Delivery retries automatically, and you can poll the changes endpoint at any time as a fallback to see everything queued for your account.
Is bankruptcy included?
It surfaces bankruptcy petitions filed with the Commonwealth Courts, a pre-bankruptcy distress signal. That is not the same as an adjudicated bankruptcy, which sits on a paid register outside its scope.