Ticker to CIK API for SEC company lookup

THE SHORT ANSWER

Search the SEC ticker directory with GET /api/v1/companies?query=AAPL. Matching rows include the ticker, company name, and ten-digit CIK. Use that CIK to request company profiles, filing metadata, or reported XBRL facts.

Make a real request

Create an API key in your account and set SEC_API_KEY in your shell environment. Keep it server-side. These examples call the authenticated production route; the optional Node base URL override is useful for a separate development environment.

cURL

curl --fail-with-body \
  "https://sec-api.dev/api/v1/companies?query=AAPL&limit=5" \
  -H "Authorization: Bearer $SEC_API_KEY"

Node.js

// Node.js 22+. Set SEC_API_KEY in your environment.
const key = process.env.SEC_API_KEY;
if (!key) throw new Error("Set SEC_API_KEY first");
const base = process.env.SEC_API_BASE_URL || "https://sec-api.dev";
const response = await fetch(
  base + "/api/v1/companies?query=AAPL&limit=5",
  { headers: { Authorization: `Bearer ${key}` } }
);
if (!response.ok) throw new Error(`HTTP ${response.status}: ${await response.text()}`);
const payload = await response.json();
console.log(payload.data.map(({ticker, cik, name}) => ({ticker, cik, name})));
console.log(payload.meta);

The examples print the actual response; no sample financial values or filing dates are fabricated.

Resolve a ticker, then confirm the entity

Company search accepts a ticker or a company-name fragment. Matching is case-insensitive, and an exact ticker match is ordered before partial matches. The endpoint returns an array because a search term can match several directory entries. For a ticker-specific workflow, select the row whose ticker exactly matches your normalized input instead of blindly choosing the first partial result. An empty array means this current directory search found no match; it is not proof that the organization has never filed with the SEC.

Keep CIKs as strings

Returned CIKs use ten digits with leading zeros. Keep that representation when saving identifiers or joining records. Both 320193 and 0000320193 are accepted by the company-profile path, but retaining the padded string avoids losing formatting through a spreadsheet or numeric serialization. Request GET /api/v1/companies/320193 to retrieve the name, associated ticker and exchange arrays, SIC information, and fiscal-year-end information when present. A ticker and a CIK identify different things, so preserve both fields rather than treating them as interchangeable database keys.

Understand the directory boundary

This search operates on the SEC company ticker directory. It is not a historical ticker-assignment database, a CUSIP lookup, or a comprehensive search of every person, fund, and organization that has ever filed. The query must contain 1–100 characters after trimming. The result limit defaults to 20 and accepts values from 1 to 100. Search returns the first matching page only; it does not accept an offset. If a broad company-name query is truncated, narrow the query instead of assuming you have enumerated every match.

Record when the mapping was retrieved

Each response includes the original SEC resource URL, the cache retrieval time, a stale indicator, and a request ID. Our directory cache normally lasts 24 hours. In a mapping-sensitive workflow, inspect fetchedAt and stale before persisting a result. Preserve the name and ticker alongside the CIK so a later discrepancy can be investigated. The source directory can change; this service does not turn a current mapping into an assertion about historical ownership or security identity.

Fields to keep

FIELD	HOW TO USE IT
`data[].cik`	Ten-digit filer identifier, returned as a string.
`data[].ticker`	Ticker from the current SEC directory.
`data[].name`	Company name supplied by the source directory.
`pagination.total`	Total matches for the query before the result limit.
`meta.source / fetchedAt / stale`	Source URL, retrieval timestamp, and stale-response flag.

Authentication, limits, and errors

Every request uses an Authorization: Bearer header. Missing or revoked credentials return 401. Invalid parameters return 400, account limits return 429, and service or source failures return 5xx. Inspect the status before processing data, respect retry guidance, and avoid unbounded retry loops. API responses include a request ID for troubleshooting. Account allowances are listed on pricing; endpoint limits and response definitions are in the API reference.

Source and implementation boundary

The underlying data comes from SEC company ticker directory. The public SEC data source can be accessed directly; sec-api.dev adds its documented authentication, caching, response structure, and integration workflow. Source retrieval time describes our cache, not a guarantee of source publication latency. We are independent of the SEC and sec-api.io.