/api/katalog/
Every country: data points, documents, refresh frequency, notes. Add ?dil=en for English.
Product · API and integration
Sourced company data, in your own system.
REST API, signed webhooks, a sandbox that never touches real data and an MCP server for AI assistants. Every fact you see on screen is in the JSON, with its source.
- Source on every row
- Category filter
- Sandbox key
First request
One request, a sourced answer.
Ask for changes, officers or the whole profile; every row comes with the notice date, type, verbatim quote, gazette PDF and highlight boxes on the page.
curl https://ulawk.com/api/v1/sirketler/24/degisiklikler/?kategoriler=yetkililer \ -H "X-API-Key: ulk_…" \ -H "X-API-Secret: ulsk_…"
import requests
r = requests.get(
"https://ulawk.com/api/v1/sirketler/24/degisiklikler/",
params={"kategoriler": "yetkililer,sermaye"},
headers={"X-API-Key": "ulk_…", "X-API-Secret": "ulsk_…"},
)
for d in r.json()["degisiklikler"]:
print(d["tarih"], d["kategori"], d["ozet"], d["kaynak"]["gazete_pdf"])
200 OKGET /api/v1/sirketler/24/degisiklikler/Sample · fictional company and data
{ "sirket": { "id": 24, "unvan": "DEMİRTAŞ HOLDİNG A.Ş.", "sicil_no": "412907-5" },
"adet": 2, "kategoriler": ["sermaye", "yetkililer"],
"degisiklikler": [
{ "tur": "yetkili-atama", "kategori": "yetkililer", "tarih": "2026-10-02",
"ozet": "Selin Demirtaş göreve başladı (YK Başkanı · münferiden)",
"kaynak": { "ilan_tarihi": "2026-10-02", "ilan_turu": "Yönetim kurulu seçimi",
"alinti": "Selin Demirtaş'ın şirketi münferit imzası ile temsil ve ilzama yetkili kılınmasına",
"alinti_dogrulandi": true,
"gazete_pdf": "https://ulawk.com/api/v1/ilanlar/9182/pdf/",
"vurgu": { "sayfa": 1, "kutular": [[0.07, 0.41, 0.48, 0.50]] } } },
{ "tur": "sermaye", "kategori": "sermaye", "tarih": "2026-07-22",
"ozet": "Sermaye artırımı: 80.000.000 TL → 120.000.000 TL", "kaynak": { … } } ] }Was the quote verified?
The alinti_dogrulandi field says whether the quote was found word for word in the gazette text.
Highlight boxes
The place on the page comes as relative coordinates; mark it in your own viewer.
Two-part key
X-API-Key and X-API-Secret. We store only a hash of the secret.
Limits in the headers
600 requests per hour per key; above that, 429 with Retry-After.
Endpoints
Whatever is in the panel is in the API.
Each customer sees only the companies they follow. Companies are called by the Ulawk id returned in the list and when adding.
| Endpoint | Returns |
|---|---|
| GET /api/v1/sirketler/ | Companies you follow |
| POST /api/v1/sirket-ekle/ | Adds a company to monitoring |
| GET /api/v1/sirketler/{id}/ | The full sourced profile |
| GET /api/v1/sirketler/{id}/durum/ | Profile preparation stage, notice and archive counts |
| GET /api/v1/sirketler/{id}/yetkililer/?tarih= | Officers; for a past date too |
| GET /api/v1/sirketler/{id}/degisiklikler/ | Every change, with category filter |
| GET /api/v1/sirketler/{id}/ilanlar/ | Notice list |
| GET /api/v1/sirketler/{id}/pdfler/ | All gazette PDFs as one ZIP |
| GET /api/v1/sirketler/{id}/kap/ | KAP information |
| GET /api/v1/degisiklikler/ | Latest changes across your list |
| GET /api/v1/gorev-bitisleri/ | Terms approaching or expired |
| GET /api/v1/ilanlar/{id}/pdf/ | Gazette PDF of one notice |
| GET /api/v1/raporlar/ | Prepared reports and their files |
| POST /api/v1/yaptirim/tara/ | Screens a name on sanctions lists (exact) |
| /api/v1/webhooklar/ | Webhook set-up, test delivery |
| GET /api/katalog/ | Coverage by country (keyless) |
The detailed reference with request and response examples is in the developer hub.
Webhook
Don’t poll, let it come to you.
When a change is read, a signed JSON delivery goes to your system. If we cannot reach you we retry at growing intervals.
POST https://your-system.example/ulawk
X-Ulawk-Olay: sirket.degisiklik
X-Ulawk-Teslim: msg_3f9c…
X-Ulawk-Imza: t=…,v1=… (HMAC-SHA256)
{ "olay": "sirket.degisiklik", "surum": 1, "teslim_id": "msg_3f9c…",
"sirket": { "id": 24, "unvan": "DEMİRTAŞ HOLDİNG A.Ş.", "sicil_no": "412907-5",
"profil": "https://ulawk.com/api/v1/sirketler/24/" },
"kategoriler": ["yetkililer"],
"degisiklikler": [ { "kategori": "yetkililer", "kategori_ad": "Yetkililer ve temsil",
"tarih": "2026-10-02", "ozet": "Selin Demirtaş göreve başladı …",
"ilan": { "ilan_turu": "Yönetim kurulu seçimi", "alinti": "…münferit imzası ile temsil…" },
"gazete_pdf": "https://ulawk.com/api/v1/ilanlar/9182/pdf/" } ] }
import hashlib, hmac, time
def signature_ok(body: bytes, header: str, secret: str) -> bool:
# X-Ulawk-Imza: t=<unix seconds>,v1=<hex> (several v1 during key rotation)
parts = [p.split("=", 1) for p in header.split(",")]
t = next(v for k, v in parts if k == "t")
if abs(time.time() - int(t)) > 300: # stale delivery: reject
return False
expected = hmac.new(secret.encode(), f"{t}.".encode() + body,
hashlib.sha256).hexdigest()
return any(hmac.compare_digest(expected, v) for k, v in parts if k == "v1")
Events
sirket.degisiklik and test. Send a test delivery from the panel or the API.
Delivery ID
X-Ulawk-Teslim stays the same across retries; you never process a change twice.
Self-protecting
After twenty failed deliveries in a row the webhook is paused; you see it in the panel.
Sandbox
Try it safely first.
A sandbox key sees only fictional DENEME- companies. Responses have the same shape as the real API; real data, quota and the registry are never touched.
# With a sandbox key: no real data, no quota, no registry lookups curl https://ulawk.com/api/v1/sirketler/DENEME-KAYNAK-KAPALI/ \ -H "X-API-Key: ulk_test_…" -H "X-API-Secret: ulsk_…" # 503 · what does your code do when the source is down? # DENEME-YAVAS · DENEME-TASFIYE · DENEME-TERKIN # DENEME-COK-ILAN · DENEME-UNICODE · DENEME-UZUN-UNVAN
Same shape
Sandbox and real responses carry the same fields; switch without changing your code.
Edge cases
Slow profile, source down (503), liquidation, struck off, a company with 250 notices, Unicode and a 300-character name.
Get it in the panel
Create a sandbox key in the API section of your panel.
AI assistants
Connect to Claude and Cursor as a tool.
The Ulawk MCP server opens the profiles, notices and changes of the companies you follow to your assistant as tools. The assistant sees only your companies.
# Claude Code
claude mcp add --transport http ulawk https://ulawk.com/mcp/ \
--header "Authorization: Bearer ulk_…:ulsk_…"
# Cursor · .cursor/mcp.json
{ "mcpServers": { "ulawk": {
"url": "https://ulawk.com/mcp/",
"headers": { "Authorization": "Bearer ulk_…:ulsk_…" } } } }
Eight tools
sirket_ara, izlenen_sirketler, sirket_profili, degisiklikler, ilanlar, istek_durumu, kapsam, sirket_takibe_al.
No adding without approval
Adding to monitoring uses your quota; the assistant asks with a two-step confirmation code. The other tools are read-only.
Guide
Step-by-step set-up for Claude Code, Claude Desktop and Cursor in the MCP guide (after signing in).
Coverage catalogue
Let machines read the coverage.
Which data and documents come back in each country is in a public JSON; no key needed.
/api/katalog/GB/
One country; add its code.
CSV
The same table as an Excel-friendly CSV on the coverage and pricing page.
Error and status codes
If something goes wrong, whose side is it on?
Response codes tell you whether the issue is on your side, the source’s or ours.
| Code | Meaning | What to do |
|---|---|---|
| 400 | Bad parameter (e.g. date format) | Fix the field named in the error message |
| 401 | Key missing or invalid | Check the key and the secret |
| 402 | Your plan’s company allowance is used up | Upgrade the plan or remove companies |
| 404 | Company not on your watchlist | Add it to monitoring first |
| 429 | Hourly limit exceeded | Wait for Retry-After |
| 200 · profil_hazir: false | Profile being prepared | Follow the stage on the /durum/ endpoint |
Integration security
Key, address, access: tight from the start.
An integration opens a door; we write down from the start how that door is protected.
Secret stored as a hash
The API secret is shown only once; we never keep it in plain text.
Only your companies
Each key sees only the companies its owner follows; so does the assistant connection.
HTTPS only
API and webhook addresses over encrypted connections; no deliveries to private network addresses.
Signed deliveries
Webhook bodies are signed with HMAC-SHA256; we store the secret encrypted.
Getting started
Live in four steps.
The code is short; the real work is deciding which workflow an alert should start on your side.
Sandbox key first, real key second.
Both answer in the same shape; switch without changing code.
Sandbox key
Get it in the panel’s API section; build your flow with DENEME- companies.
Real key
Create the key and secret; the secret is shown only once.
Add companies
From the API, Excel or the panel; the status endpoint tells you when the profile is ready.
Webhook
Define your address and categories, send a test delivery.
Keep reading
Read next
The other parts of the product, plus coverage, pricing and service status.
How do I get API access?
Create a key pair in the API section of the panel. Send the X-API-Key and X-API-Secret headers with requests. We suggest starting with a sandbox key.
Do responses include the source?
Yes. Every row comes with notice date, notice type, verbatim quote, whether the quote was verified, gazette PDF link and, where available, highlight boxes on the page.
Is there a rate limit?
600 requests per hour per key. Above that, 429 with a Retry-After header.
Does the sandbox touch real data?
No. A sandbox key sees only fictional DENEME- companies; it uses neither your quota, nor the registry, nor real data.
Can my AI assistant add companies?
Yes, but only with your approval: because adding uses your quota, the MCP tool asks for a two-step confirmation code. The other tools are read-only.
Let us plan the integration together.
In a short technical call we will listen to your workflow and show which endpoints and events help.
Enterprise quote
Get a quote for your portfolio.
Plans differ only in the number of companies you follow; every feature and every country is included. Fill in the form and we will prepare the right offer together.
- Try it with your own companies in a demo
- We upload your Excel list
- Help setting up API and webhook
Write to us:
[email protected]