`company.shareholders.taxNumber.reveal`

View or copy one shareholder's full encrypted tax number for t2_schedule_50 or t5_slip, with holderId, purpose and use (view or copy). Requires a signed-in administrator or an accountant with separately approved, unexpired tax_numbers access. Each call rechecks membership and grants, and records the holder, purpose and use without the value. General exports and year-end packages remain masked. Not available to API keys, MCP or AI tools.

POST/api/v1/accounting/company.shareholders.taxNumber.reveal

Permissions

accounting:readaccounting:write

Who can call it

admin

Retries

No idempotency key

MCP

Not offered over MCP: Full taxpayer numbers require a signed-in person, a stated filing purpose, and a separately granted accountant permission. The terminal and connected AI apps receive masked readiness only.

Fields

holderIdstringRequired
Matches ^[a-z0-9][a-z0-9-]{7,39}$
purposeenumRequired
t2_schedule_50t5_slip
useenumRequired
viewcopy

curl https://app.getoatmilk.com/api/v1/accounting/company.shareholders.taxNumber.reveal \
  -H "Authorization: Bearer $OATMILK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "holderId": "aaaaaaaa",
  "purpose": "t2_schedule_50",
  "use": "view"
}'

const response = await fetch("https://app.getoatmilk.com/api/v1/accounting/company.shareholders.taxNumber.reveal", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.OATMILK_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "holderId": "aaaaaaaa",
    "purpose": "t2_schedule_50",
    "use": "view"
  }),
});
const { data, error } = await response.json();
if (!response.ok) throw new Error(`${error.code}: ${error.message}`);
console.log(data);

import os

import requests

response = requests.post(
    "https://app.getoatmilk.com/api/v1/accounting/company.shareholders.taxNumber.reveal",
    headers={
        "Authorization": f"Bearer {os.environ['OATMILK_API_KEY']}",
    },
    json={
        "holderId": "aaaaaaaa",
        "purpose": "t2_schedule_50",
        "use": "view",
    },
    timeout=30,
)
payload = response.json()
if not response.ok:
    raise RuntimeError(f"{payload['error']['code']}: {payload['error']['message']}")
print(payload["data"])

Response

{
  "data": { … }
}

Try it

Checks your input with this action’s real schema and answers like the API, with synthetic data. No key needed, and nothing changes.

Input

POST/api/v1/accounting/company.shareholders.taxNumber.reveal

curl https://app.getoatmilk.com/api/v1/accounting/company.shareholders.taxNumber.reveal \
  -H "Authorization: Bearer $OATMILK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "holderId": "aaaaaaaa",
  "purpose": "t2_schedule_50",
  "use": "view"
}'

const response = await fetch("https://app.getoatmilk.com/api/v1/accounting/company.shareholders.taxNumber.reveal", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.OATMILK_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    "holderId": "aaaaaaaa",
    "purpose": "t2_schedule_50",
    "use": "view"
  }),
});
const { data, error } = await response.json();
if (!response.ok) throw new Error(`${error.code}: ${error.message}`);
console.log(data);

import os

import requests

response = requests.post(
    "https://app.getoatmilk.com/api/v1/accounting/company.shareholders.taxNumber.reveal",
    headers={
        "Authorization": f"Bearer {os.environ['OATMILK_API_KEY']}",
    },
    json={
        "holderId": "aaaaaaaa",
        "purpose": "t2_schedule_50",
        "use": "view",
    },
    timeout=30,
)
payload = response.json()
if not response.ok:
    raise RuntimeError(f"{payload['error']['code']}: {payload['error']['message']}")
print(payload["data"])

Fields

Example

Try it