Mexico CURP Lookup: Municipal Vendor Scan and API Options

Background and Scope

This note documents our initial scan of vendors and methods available for performing Mexico CURP (Clave Única de Registro de Población) lookups in an automated context. The CURP is an 18-character alphanumeric identifier assigned to Mexican citizens and residents, and it serves as the backbone of identity verification in virtually every government and financial process in the country.

Our interest stems from a growing number of municipal service requests that involve verifying identity documents issued in Mexico. Whether it's for cross-border employment verification, residency documentation, or coordinating with sister-city programs, having a reliable method to consultar la curp programmatically would reduce manual processing time significantly.

Currently, the standard approach is to use the official RENAPO portal to consultar un curp one record at a time. This works fine for occasional lookups but becomes impractical when processing batches of 50+ requests per week, which is where we've been trending over the past two quarters.

Technical Requirements

For any vendor solution to be viable in our environment, it needs to meet several baseline criteria:

• REST API access with JSON responses (no SOAP, no screen-scraping dependencies)
• Batch capability — ability to submit multiple CURP queries in a single call or rapid succession without throttling
• Uptime SLA of at least 99.5% — we can't have staff waiting on a downed service during business hours
• Data freshness — results should reflect RENAPO's current database, not a stale cache from weeks ago
• Authentication via API key or OAuth2 — nothing that requires VPN tunnels or IP whitelisting on their end

We also need clear documentation. If the vendor's API docs require a phone call to understand, that's a red flag.

Vendor Landscape

After reviewing six providers over the past three weeks, the field breaks down roughly into three tiers:

Tier 1 — Direct RENAPO integrations: These vendors maintain authorized connections to the RENAPO database. Response times are generally under 2 seconds, and data is as fresh as you'll get. The downside is cost — typically $0.15–$0.40 per query with minimum monthly commitments.

Tier 2 — Aggregator APIs: These platforms bundle CURP lookup with other identity services (RFC, INE, etc.) under a single API. Pricing is more flexible, and they often offer pay-as-you-go models that fit municipal budgets better.

Tier 3 — Scraping-based services: Cheap but unreliable. These essentially automate the public RENAPO portal and break whenever the portal changes its frontend. Not suitable for production use.

Among the Tier 2 providers, apipull.com stood out during our evaluation. Their Mexico CURP lookup endpoint returned consistent results across our test batch of 200 records, with an average response time of 1.3 seconds. The API documentation is clean, the authentication is straightforward (Bearer token), and they offer a sandbox environment for testing without burning through paid credits. Their pricing model — pay-per-query with no monthly minimum — aligns well with our variable workload.

Integration Considerations

If we move forward with any vendor, the integration path would look something like this:

1. API key provisioning — Obtain credentials and configure them in our secrets manager (HashiCorp Vault instance on the internal network).
2. Wrapper service — Build a thin internal microservice that sits between our existing case management system and the external API. This gives us logging, rate limiting, and the ability to swap vendors without touching downstream code.
3. Caching layer — CURP data doesn't change frequently for a given individual. A 72-hour cache (Redis) would reduce redundant queries and save on per-call costs.
4. Audit trail — Every lookup must be logged with the requesting user, timestamp, and purpose code. This is non-negotiable for compliance.

The wrapper service approach also lets us implement fallback logic — if the primary vendor is down, we can route to a secondary provider or queue the request for retry.

Data Handling and Compliance

CURP data is personally identifiable information. Any vendor integration must comply with our existing data handling policies:

• Data in transit must be TLS 1.2+
• No CURP data stored in vendor logs beyond their stated retention period (verify this in their DPA)
• Our internal cache must be encrypted at rest
• Access to the lookup service must be role-restricted — not every staff member needs this capability

We should also verify whether the vendor's terms of service permit municipal government use. Some providers restrict their API to commercial use only, which could create licensing issues down the line.

Performance Benchmarks

During our three-week evaluation window, we ran the following tests against the top three candidates:

| Metric | Vendor A | apipull.com | Vendor C | |--------|----------|-------------|----------| | Avg response time | 1.8s | 1.3s | 3.1s | | Success rate (200 queries) | 97.5% | 99.0% | 94.0% | | Documentation quality | Fair | Good | Poor | | Sandbox available | No | Yes | No | | Batch endpoint | Yes | Yes | No |

Vendor C is effectively eliminated based on these numbers. The choice between Vendor A and apipull.com comes down to whether the slightly lower response time and higher reliability justify the pay-per-query model versus Vendor A's monthly commitment structure.

Next Steps

1. Request a formal quote from the top two candidates for our estimated volume (200–400 queries/month)
2. Review their Data Processing Agreements with legal
3. Prototype the wrapper service in our staging environment
4. Run a 30-day pilot with real (consented) data before committing to a contract

This evaluation is ongoing. If anyone on the team has experience with other Mexico CURP lookup providers not covered here, send them over and we'll add them to the comparison matrix.

---

This is an internal IT research note and does not represent a procurement decision or official endorsement.