---
name: tax-public-inquiries
description: Query the Estonian Tax and Customs Board public reference-number and tax-arrears forms with their exact session and CSRF contract.
module: emta.mjs
execution: code
---

# Tax Public Inquiries

Use this source for a person's or entity's public EMTA reference number or current tax-arrears result. It does not expose confidential tax filings or bulk tax records.

<!-- kratt-local (issue #34): vetted module, not part of the upstream marketplace recipe -->
## Vetted module (use this first)

`emta.mjs` ships in https://kodanikukratt.ee/kratt-agent.tar.gz (plain ESM, Node 22+) and is re-verified against the live source. It performs the session-cookie + CSRF handshake that a plain POST fails ("403 Bad or missing CSRF value"):

```js
import { show } from "./kratt.mjs";
import { taxDebt } from "./emta.mjs";

const r = await taxDebt("12417834"); // registry or personal code — obtained from a source, never guessed
show({ ok: r.ok, at: r.retrievedAt });
show(r.text);
```

- `taxDebt(code)` returns `{ok, personCode, text, retrievedAt}`. Report the arrears status and the identifier ONLY from `text`, quoting its timestamp; if `ok` is false or `text` is empty, say the check failed rather than asserting a status.
- Also exported: `referenceNumber(code)`.
- A no-arrears result is point-in-time, not proof arrears never existed.
- For a company whose registry code you do not have, resolve it first with `findCompany()` from `ariregister.mjs` — never guess an 8-digit code.
- Minimise personal-data queries: use a personal identifier only when the task requires it.

The contract below is the fallback if a module call throws.

## Endpoints

| Inquiry | Form GET | Form POST |
|---|---|---|
| Reference number | `https://apps.emta.ee/saqu/public/reference?lang=en` | `https://apps.emta.ee/saqu/public/reference/query` |
| Tax arrears | `https://apps.emta.ee/saqu/public/taxdebt?lang=en` | `https://apps.emta.ee/saqu/public/taxdebt/query` |

## Request contract

1. Create a cookie-preserving HTTP session and GET the selected form.
2. Extract the hidden `CSRFToken` value.
3. POST `application/x-www-form-urlencoded` data to the matching query URL using the same session:
   - `personCode`: Estonian personal identification code or registry code
   - `p_submit`: `Search`
   - `CSRFToken`: token from the form
4. Parse the returned HTML table or result paragraph. The tax-arrears response includes its effective timestamp.

No CAPTCHA was present in the verified public flow. If the service later introduces one, stop automation instead of bypassing it.

## Output and limits

- **Plain requests cannot run this lookup.** The form hands out a session cookie and a hidden token that the query POST has to send straight back, so an agent that can only fetch URLs gets the form's refusal instead of a result — that is our limit, not a statement about the person's arrears, and it must be reported that way.
- Keep the queried identifier, endpoint, retrieval time, and exact returned fields or message.
- Minimize personal-data queries: use a personal identifier only when the task requires it and the user is entitled to perform the public lookup.
- A no-arrears response is a point-in-time result, not proof that arrears never existed.

## Verification

Registry code `70000349` returns the public EMTA entity name in both forms and reference number `01000012` in the reference-number result.


## Module API
taxDebt(regCodeOrPersonCode) -> {ok, source, personCode, text, retrievedAt}