What changed in the REST API, the MCP tools, the data and the app, newest first, with the day each change went live.
Questions about a change: contact@adrianhomelab.com.
/terms gains the sections a paid service needs, in Romanian and English: what you may do with the data (#licence: internal use, up to 1,000 company records a day kept in your own systems, short excerpts with attribution, no resale; your rights in the official open data are untouched), what we do not allow (#prohibited: automated decisions about a person, tracing or surveilling people, re-identification, a competing database), your key and account (#key), indemnity for professional customers (#indemnity), invoices and VAT (#invoices), how the contract is made (#conclusion), suspension (#suspension: at once only for abuse, security or a legal duty, otherwise 15 days' notice with the reason) and final provisions (#final).#changes); the liability cap applies to professional customers only, consumers keep what the law gives them (#liability)./terms/versions (English: /en/terms/versions), each with its SHA-256 fingerprint printed under the title, so you can check the text never changed. Your order records the version you accepted, the contract email attaches that text, and the subscription management page links it./start or by signing in to the app with your email, says that it accepts the terms, and we keep which version you accepted./docs, the MCP server's page, the plans page, the order page, the app's upgrade offer and the confirmation and contract emails. You are still charged in euro; if no rate is known, only the euro price is shown./news, English at /en/news): your email address and the same unticked box, then a link we email you to confirm. No key, no account; until you click, nothing is recorded.warnings (English text) and adds warningDetails: each note with a code, its values and the message, so your code can show it in any language (CSV: the X-Leadgen-Warning-Details header). The app shows these notes in Romanian on Romanian pages./coverage tables become cards on a phone; code samples scroll inside their own box; /docs has clearer headings and its interactive reference follows the light or dark theme./start does one job, getting a free key. Recovering, replacing or deleting a key sit under "Ai deja o cheie?" / "Already have a key?"; the old links to them still open the right form./api-date-firme (English: /en/company-data-api): what the API answers, verifying a firm by CUI, exporting a CAEN list, a worked request with its answer, and the way to a free key.lookup_companies and match_companies (REST and MCP) larger than what is left of today's allowance now answer the rows that fit and mark the rest not_processed, not counted, instead of refusing the whole batch. Every batch answer carries partial, processed and remaining; a partial one adds dailyLimit (when the allowance resets, how to get more)./firme link "Ești în registru?" next to the data./terms#refunds opens with the model withdrawal information and the model withdrawal form set by Romanian law (OUG 34/2014, annex, parts A and B), filled in with the operator's details; /subscribe links both before you pay, and the contract email carries the form./terms#warranty says what it covers and what you can ask for; /privacy and /subscribe point to it./terms adds that a monthly or annual subscription is not fully performed within the 14 days. Consent version 2026-10-19; the contract email quotes the version you accepted./privacy#visits says what our proxy log holds for each request, that it is deleted after 30 days, and that the per-site counts made from it hold no address, no browser string and no identifier. No cookie and no script are added, so there is still no cookie banner./start and the app's email sign-in have an optional, unticked box: "Vreau să primesc pe email noutăți despre Leadgen (rar; te poți dezabona oricând)." Getting a key or signing in never depends on it./start we then email you a link to confirm it (in the app, the sign-in link already does); until you click, you get no news./privacy#news describes it, with your consent as the basis./privacy#registry explains to people listed in the trade register what we take (ONRC, the Ministry of Finance, ANAF), why, for how long, and how to object; every footer and company page links to it ("Ești în registru?").phoneSource ("ANAF, declared by the taxpayer"); the machine CSV gains it as its last column./terms#personal-data: what customers must do with personal data (their own legal basis, consent for marketing email and SMS, honouring objections, no bulk republishing)./privacy names who else handles data, including our accounting and invoicing provider.unwatch is marked as removing data (destructiveHint)./usage and get_usage: billing.subscription.ended_at).upgrade link is the signed subscribe link for your key, on REST and MCP./privacy has a Cookies section and says who else sees visitors' data.returned (rows sent) next to total, whose meaning per tool is unchanged./company/<CUI> with a wrong check digit answers 404.leadgen-beta.adrianhomelab.com is retired; the app is at leadgen-app.adrianhomelab.com.poll_watchlist lists every watch your key holds (active), and the new unwatch tool (cui, or code with its county) removes one, like REST DELETE /watches. 17 tools.county is checked: an unknown one is error: unknown_county with suggestions, not 0 firms; a county town (Cluj-Napoca), Bucharest or Sector 3 is read as its county and said in warnings. Where the county only ranks names (lookup_business, match_companies) a typo is dropped with a warning. watch_caen refuses a code that is no CAEN class (unknown_caen).availableTopicNames maps each id in availableTopics to its name. find_company_by_domain offers domain-name candidates (with a confidence, at most 0.7) even when the site cannot be read. compact=true keeps risk.notChecked.invalid_arguments, without framework details). max_results of 0 is read as 1 and says so.detail mirror stays (deprecated)./firme/4321-lucrari-de-instalatii-electrice and a page per county (42 live): how many active firms do electrical installation work there, the five newest active SRLs and SAs with town, registration date, size and risk, the snapshot date, and a link that opens the full list in the app with the filters set. Rebuilt nightly from the registry, linked from the landing and the app's footer./sitemap.xml is now a sitemap index (sitemap-pages.xml, sitemap-firme.xml)./skills/leadgen-romania.zip: an Agent Skill for Claude that says which Leadgen tool fits which job (lead lists, due diligence, list matching, monitoring) and how to answer (cite asOf, say what is not checked, credit the data, respect the limits). Install steps in /docs#skill.url, its public record page (/record/{cui}), to share with the user; it is null for sole traders and other natural persons. compact=true keeps it; with fields it is kept when asked for.lookup_by_category) carries appUrl, the same list opened in the app with its CAEN codes, county, legal form, active and main-activity filters (null past 10 codes).get_a_key, pricing, docs, /usage and get_usage, plan refusals, the MCP instructions, url, appUrl) carry a ?src= label saying where they came from (mcp-<context> or api-<context>). Signed links are unchanged.attribution) ends with the site's address: "…via Leadgen (leadgen.adrianhomelab.com)". No other field changed.Authorization: Bearer <key> as well as X-API-Key (what MCP clients send). An empty Bearer is no key.POST /watches/seen returns the drained changes (the same answer as MCP poll_watchlist) next to cleared, so a REST client reads and marks in one call.structuredContent (the same JSON as the text block, which is unchanged). Clients that validate against the output schema can rely on it; the schemas are open (no required keys, extra fields allowed).4689 now has its title and is treated as a new Rev.3 class.GET /extract_contacts?website=&max_pages=, GET /enrich_company?cui=&website=&max_pages=&refresh= and GET /lookup_domain?domain=&include_dns=&include_security=: the REST twins of the MCP tools of the same names, with the same parameters, defaults and answer. Every MCP lookup tool now has a REST route.RateLimit-* headers; a key works from any website's page (CORS), an anonymous call from another site is refused. An answer with an error (a site that cannot be read, an invalid or unknown CUI, a name that is not a public domain) is a 400 and is not counted.localhost, a private IP or an internal name is refused before any connection. lookup_domain now refuses a private IP literal too (not a public domain name), on both doors./subscribe on the checkout, or the signed upgrade link a keyed 429 carries once sales open). A company enters its CUI and its details are filled in from the registry. The subscription portal (/manage, the app's "Manage plan", /start) changes the plan or the card, cancels, and lists invoices; a failed renewal sends one email and keeps the plan while Stripe retries. The prepaid credit packs are retired. Sales are not open yet: until then every buy door answers checkout_closed and the plan pages show the plans only./terms#refunds (RO/EN) carries the cancellation, withdrawal and refund terms; while paid plans are not on sale it says so above them. A move to a smaller plan or from annual to monthly takes effect at the end of the paid period; upgrades apply at once.2026-10-16./manage, in the email, in the app and on /start while the 14 days run; /withdraw in two steps ending in "Confirmați retragerea". The statement is recorded and acknowledged by email at once (with its date and time); a consumer inside the 14 days is cancelled at once and refunded pro rata by days. Company, unmatched and late statements are acknowledged and answered by a person within 2 working days./usage billing.subscription.pending shows a downgrade waiting for the period end, and billing.withdraw the withdrawal link while the window is open.match_companies / lookup_business: hyphens separate words ("AUTOMOBILE-DACIA SA" matches "AUTOMOBILE DACIA SA"); an exact full registry name outranks a differently named live firm (a closed firm keeps its identity, with its status); same-name firms are ambiguous with all of them as candidates, each with its status; a given county wins, and a match in another county loses confidence and carries countyMismatch: true with a warning. A one-word brand query keeps live firms first.lookup_by_category: on a match set too big to read whole, inactiveFilteredOut is now an estimate from a systematic sample, with inactiveFilteredOutApproximate, inactiveFilteredOutMargin (95%) and inactiveFilteredOutMethod (it was null).lookup_companies, match_companies and find_company_by_domain carry attribution.find_company_by_domain: a site whose title is just its domain gets candidates from the domain's words.issuance_limit refusal is one top-level body (no detail copy)./lookup_companies and /match_companies, linked from /docs (/integrations/n8n-workflow.json)./match download's "CUI Leadgen" column and never watches every number of a file with a header row (it asks for the column); "Watch the matched firms" on /match; "Find contacts" also crawls the sites "Check websites" found from the name (marked as guessed); common CRM headers ("Cont", "Judet", "Cod fiscal", "Web") map themselves.asOf {registry, financialYear, anaf}; the MCP instructions tell agents to cite it.RO, spaces, leading zeros) and a wrong control digit is reason: "invalid_cui", not a miss, and not counted.lookup_director warns that the registry has no personal identifier: homonyms, the firms per county (byCounty) and a note.cross_origin_requires_key.format=csv&lang=ro (BOM, ; separators, Romanian headers, phone numbers that keep their leading 0); lang=en gives the English twin./start shows curl, Python and JavaScript examples with your key; the MCP landing has the setup for Claude Code, claude.ai, Cursor and VS Code./llms.txt lists common tasks; an unknown page is an HTML 404 with the site's footer; a trailing slash redirects; the site has an icon; the MCP host serves /.well-known/mcp.json.GET/POST/DELETE /watches, the twin of the MCP watch tools./match: upload a CSV of names, websites or CUIs, map the columns, preview the first 10 matches, match the rest in the background on your own key (one lookup per row, planned within today's allowance), download it with CUI, status, risk, size and phone added and unmatched rows flagged. Uses the API's POST /match_companies.enrich_company, at most 50 per list, three at a time, one lookup each on your own key); emails with a confidence on the rows and in the CSV; a dead domain says "site unreachable"./health data.counts (the snapshot's row counts).active_only (REST /lookup_by_category, the CSV, MCP lookup_by_category) now also drops firms ANAF declares fiscally inactive, by default, like the app: it keeps exactly the firms whose risk block calls them a lead (isLead). active_only=false still returns everything; exclude_anaf_inactive stays accepted (on its own it drops only the ANAF-inactive firms).inactiveFilteredOut: the firms of the match set active_only removed, when the driving set is read whole (at most 60k rows); null for a bigger set, which is walked newest first and has no cheap count. The app shows it in category mode.legal_form (REST and MCP lookup_by_category, the CSV too) takes one form or a comma-separated list: legal_form=SRL,SA. The API's own default is unchanged (every form), so existing callers see the same rows; the app sends SRL,SA.POST/GET /lookup_companies and the MCP tool lookup_companies, up to 100 CUIs, one row per input in input order with found per row.POST /match_companies and MCP match_companies, up to 500 records of name, county, domain or CUI. Each row: match {cui, companyName, confidence, matchedOn} and the record, or no_match with up to 3 candidates. A valid CUI wins (1.0); names get a confidence with a 0.6 threshold; ambiguous flags a runner-up just as good.-32002 with requested and remaining); input-error rows are handed back (metering: {rows, counted, notCounted}).GET /find_company_by_domain and MCP find_company_by_domain: the registry website first, else the CUI or registration number read off the site's home and legal pages (site_cui), else no_cui_on_site with candidates from the page title.fields= (dotted paths too) and compact=true on every list answer, both doors; unknown names are warned, none known is invalid_fields (not counted)./record/{cui} (RO), /en/record/{cui}, ?format=json: one A4 sheet to print or save as PDF with the record, latest filing, risk reasons, dated sources, the snapshot, what is not checked, a stable URL and a SHA-256. "Print record" on the app's company page./docs (RO, EN) documents them./start (RO and EN) → Delete my data: POST /delete-data mails a one-time confirmation link (same answer whether or not the address is known; 5/hour per IP, 3/day per address). The link's page lists what goes and what stays; its button deletes the key (refused at once on both doors), usage and plan rows, watches, alert subscription, digest lists, the email log and feedback, and suppresses the address./privacy (RO and EN) states it, and what is kept and why: payment records for 10 years (Law 82/1991), request logs until they rotate out after 12 weeks, the do-not-email entry and a hashed record of the deletion. It also says what a feedback message stores.POST /register from a network that already took its 3 keys today no longer refuses an address that can receive mail: it answers 202 confirm_by_email and mails a one-time link (2 hours). The link's page (/start/confirm, /en/start/confirm) issues the key past the per-IP cap on its button and shows it. At most 20 such links per network and 3 per address a day.Retry-After) and how to reach us (feedback page, contact address)./feedback (RO) and /en/feedback (linked from every footer of the API pages, the MCP landing, the app and the checkout), REST POST /feedback, and the MCP tool report_issue (free, not counted). The app's company page links "Report a wrong record" with the CUI prefilled./changelog (RO) and /en/changelog list every change with its day, under the policy: additive changes ship without notice; a breaking change is listed here and emailed at least 14 days ahead, once, to every key holder who called the affected endpoint or tool in the last 30 days; security fixes may ship at once. Linked from every footer and from /docs#changelog./coverage (RO) and /en/coverage: each source (ONRC, Ministry of Finance, ANAF, the firm's website) with its freshness read from the served data, and the layers not covered (the insolvency bulletin BPI, ANAF tax debts, court cases, shareholders and beneficial owners, SEAP, Monitorul Oficial, emails, changes between snapshots), each with where to check it. In the sitemap; /docs#coverage points at it.risk block carries notChecked: ["insolvency_bulletin", "anaf_debts", "court_cases", "shareholders"].instructions tell an agent that ok is not "clean" and never to call a firm clean, safe or solvent on this data alone./docs (RO and EN) has a "Licence and attribution" section (#licence): the sources, the licences (CC BY 4.0, OGL-ROU-1.0 for FY2008–2010) and a ready line to copy crediting ONRC, the Ministry of Finance, ANAF and Leadgen.lookup_business, lookup_director and lookup_by_category answers (REST and MCP) carry the same line as attribution; /llms.txt quotes it.lookup_business with 0 rows for a query like dent targu neamt carries hint: {tool: "lookup_by_category", topic: "dentists", county: "Neamț", arguments, message}; a name with hits never does. The tool description now says "For 'firms that do X in Y', use lookup_by_category".lookup_by_category (REST category, MCP topic) also takes the activity in plain words, Romanian or English: a trade name (dentists, stomatologie, avocat, restaurante, IT outsourcing, about 50 trades) or a CAEN class title, whole or by its words (Activități de asistență stomatologică, Dental practice activities). The codes used are named in caenCodes, a warnings line and the new matched field.error: ambiguous_topic with candidates (codes, Romanian and English titles). Not counted./start (RO and EN) → My key leaked — give me a new one: POST /rotate-key mails a one-time confirmation link (same answer whether or not the address has a key; 5/hour per IP, 3/day per address); the link's page rotates on its button only and emails the new key.GET /usage (REST, tag Account): the caller's own plan, daily limit, lookups used today, remaining, next reset (00:00 UTC) and prepaid credit balance (null when the key never held credits), with links to the free key and pricing. With X-API-Key it describes that key (shown as an 11-character prefix, never in full); without one, the caller's anonymous allowance (IPv6 counted per /64, as the wall counts it). Not a lookup: it never counts.get_usage: the same object for the MCP caller, free, not counted, never paid. The server card lists it.RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset (seconds to 00:00 UTC) and X-RateLimit-* twins; the wall's 429 also carries Retry-After./docs (RO and EN) documents the endpoint and the headers./billing page is gone)./docs and the app say the day resets at 00:00 UTC.active_only (firms in liquidation no longer slip through).The first complete release: one product across the API, the MCP server, the lead-list
app and the checkout, on one design, in English and Romanian.
/financials/{cui}, /financials/{cui}/ratios, MCP lookup_financials / lookup_financial_ratios).topic accepted as an alias of category on REST; Rev.2/Rev.3 activity twins collapsed./company/<CUI>: history chart, health score, peer standing, registry record, contacts crawl./docs, MCP landing in the same design, titles, structured data, FAQ and sitemaps.Kept current after the release.
plan_required) is handed back and does not count against the daily allowance./terms carries the paid-plan terms; /privacy no longer mentions credits (fixed 2026-10-17)./register tells an address that it already has a key (and mails it there); /topics counts as one lookup. (Lead lists are newest-first over the whole match set since 2026-10-16.)2026-10-15 — New addresses: the API and site at leadgen.adrianhomelab.com, the app at leadgen-app.adrianhomelab.com (the old onrc-api and leadgen-beta addresses redirect); one design across every site.
2026-10-11 — Snapshot rebuild; financial statements kept across rebuilds after a regression.
2026-10-03 to 2026-10-10 — MCP server, REST API, free-key door, lead lists by CAEN, watchlists, website enrichment.