The need for Diavgeia 2.0:
Hundreds of thousands of direct awards go unchecked every year, with suspicious patterns hidden behind messy data.

Everything in this piece comes out of a single public source, and you need no account, no API key, and no one’s permission to pull it yourself. Diavgeia (the government transparency portal) exposes an unauthenticated OpenData search endpoint that hands back the same structured records I worked from, as JSON. Here is the exact recipe I used to turn it into a local database of every direct award.

1. Start at the search endpoint, filtered to direct awards. Every record sits behind one URL, https://diavgeia.gov.gr/luminapi/opendata/search.json, which you filter to Δ.1 (the direct-award decision type) over a date range. A real, runnable first call is …/search.json?type=Δ.1&from_issue_date=2025-01-01&to_issue_date=2025-02-01&size=500&page=0. It answers as JSON: an info block with the total count, then a decisions array. By default the endpoint returns only published decisions (status=Αναρτημένη), which already excludes any award later revoked.
2. Use the long date-parameter names, and walk one month at a time. Two silent traps live here. First, the date parameters are from_issue_date and to_issue_date, not from_date / to_date. The short names are accepted and return a 200, but they filter the publication date rather than the issue date, so you get a differently bounded (often empty) set. Second, a single query silently covers at most about six months; ask for a whole year and you still get a 200, but it stops half-way. So I walk the year in twelve one-month windows. Because the upper bound is read as 00:00 Athens time (a half-open interval), I set each window’s to_issue_date to the first day of the next month, so the month’s last calendar day is not dropped.
3. Page through each window until a short page comes back. Set size=500 (the maximum) and start at page=0, incrementing until a page returns fewer than 500 records, that is the last page of the month. 2025 alone holds roughly 341,000 Δ.1 records, so expect to page through a lot of them; a half-second pause between calls keeps it polite, and I never hit a rate limit.
4. Download the organisation catalogue once, to turn IDs into names. Each decision names its buyer only as a numeric organizationId. The full roster of 5,400+ public bodies comes from one call to https://diavgeia.gov.gr/luminapi/opendata/organizations.json?size=15000, which maps each uid to a readable name (plus its supervising ministry and ΑΦΜ). A handful of renamed or retired bodies are missing from that dump; for those I look the uid up one at a time at …/opendata/organizations/{uid}.json.
5. Keep the structured fields that matter, per decision. For every record I store the ΑΔΑ (the public posting id, in ada); the buyer (organizationId); the decision type (decisionTypeId, always Δ.1); the issue date (issueDate, as Unix milliseconds); the amount, which lives inside extraFieldValues as a single (optional) awardAmount field (labelled “Ποσό”, meant to be net of VAT); the supplier’s name and ΑΦΜ (from extraFieldValues.person); the CPV procurement codes (extraFieldValues.cpv); the free-text subject; and the documentUrl pointing at the signed PDF. Be ready for the amount to be missing, about 42% of 2025’s records carry none.
6. Optionally, follow each documentUrl to the signed PDF. The metadata alone is enough to count and rank, but the real contract is the document. Each record’s documentUrl links straight to its PDF (the human-readable page is https://diavgeia.gov.gr/decision/view/{ada}). I fetch these only for the awards I actually mean to read.
7. Load it into SQLite and start asking questions. I write one row per ΑΔΑ into a local SQLite file (decisions.db), with the organisation catalogue in a sidecar table joined on the uid, plus small log tables recording what was fetched and which decisions were revoked. After that it is ordinary SQL: sum each buyer’s awards by month, rank suppliers by how often they land just under a threshold, and so on. The whole 2025 corpus (about 341,000 awards, 1,544 active buyers, 37,576 distinct supplier ΑΦΜs, €16.3 billion of apparent spend) fits comfortably in one file on a laptop. (The headline 1.06 million awards and ~€46 billion of apparent spend elsewhere in this piece is the same pull extended across 2023–2025.)

Or, if that sounds like an afternoon you would rather skip: paste this entire recipe into Claude (Opus 4.8, with its 1 million-token context window) and you should be up and running in a few hours.

The analysis in this piece ran on a paid, state-of-the-art model (Opus 4.8), the right call for accuracy but costly to run across a whole national dataset. So I also tested a free alternative: I re-scored a sample of about 500 direct awards with GLM 5.2, one of the newest open-source models, and compared it against Opus on the same records.

The two broadly agreed. The open model’s average suspicion score was 3.0, against Opus’s 3.2 on the same scale. They scored within a single point of each other on two out of three records, and within two points on 87% of them. Most useful for a real filter, the open model caught more than nine in ten of the awards Opus rated most suspicious.

Better still, because an open model can be fine-tuned, its accuracy can be pushed higher still by training out specific blind spots.

The point is the cost. GLM 5.2 is open-source, so it can be run on an organisation’s own hardware with no per-record fee, and pointed at every award the portal has ever published, and every new one as it arrives, at effectively zero marginal cost.

To judge a supplier rather than a single award, I matched each vendor’s tax ID (ΑΦΜ) against Γ.Ε.ΜΗ. (the General Commercial Registry, Greece’s company registry). The same data is public, and the cross-check is reproducible: here is how to pull a company’s registry profile yourself, starting from nothing but an ΑΦΜ read off a Diavgeia award.

1. Start from the supplier’s tax ID. Every direct award names its contractor’s ΑΦΜ in the API metadata. That nine-digit number is the key that ties an award to a real company. Γ.Ε.ΜΗ. is the register every Greek company is enrolled in, so that number is what I take there next.
2. Request an access code first. The data is free, but gated. You apply for a key at the Open Data Γ.Ε.ΜΗ. access-request form, the Central Γ.Ε.ΜΗ. Authority approves it (a business day or two), and your personal api_key then arrives by email, to be sent as a raw api_key request header on every call, not a Bearer token. The default budget is modest, about eight requests a minute (I asked them to raise mine to roughly thirty). The full method list, schemas and a try-it-yourself console live in the Swagger API docs (a shared api-docs-key lets you poke at it before you register), with more in the technical documentation.
3. Query the open-data API by ΑΦΜ. The registry runs a JSON open-data service at opendata-api.businessportal.gr, and a lookup is a single GET /companies?afm=<ΑΦΜ> with your api_key header attached. The search response already carries the full record, so you rarely need the follow-up GET /companies/<αριθμός Γ.Ε.ΜΗ.> detail call.
4. Throttle, and stay polite. That budget is small, so space your request starts a couple of seconds apart and back off whenever the service answers 429. There is no rush here: this is a slow read of public records, not a scrape.
5. Read the company’s shape, age and size. Each profile returns the επωνυμία (legal name), the νομική μορφή (legal form), the κατάσταση (status: active, dissolved, or under liquidation), the σύσταση (incorporation date) and the κεφάλαιο (share capital). The most telling single field is the age: compare σύσταση to the date of the firm’s first award. A company set up only weeks before it starts winning public money, or one with token capital against large contracts, is not proof of anything, but it is worth a second look.
6. Read the fields that connect firms to each other. The same profile carries the έδρα (registered seat), the ΚΑΔ (activity codes) and the εκπρόσωποι (the managers and representatives). These are the network leads: two “rival” winners sharing one registered address, a single firm registered for hundreds of unrelated trades, or a manager who also turns up among the buyer’s own people. None of these is a verdict (there is an innocent explanation for each), but every one is a thread worth pulling.
7. Cache every answer to SQLite. I wrote each result into a local SQLite database (one table keyed by ΑΦΜ for the lookup, one for the resolved company) with a short time-to-live, so re-checking a company I had already seen costs no API call at all. With tens of thousands of suppliers to match, the cache is most of what keeps you inside the rate limit.
8. Know the two honest limits. First, in my sample, roughly 15–20% of vendors are not in Γ.Ε.ΜΗ. at all, most of them natural persons and freelancers who fall outside the registry’s duty (and, in some cases, an ΑΦΜ mistyped into Diavgeia’s metadata), so their absence is usually normal and rarely a red flag on its own. Second, the API gives you the registry profile but not the filed accounts: the annual ισολογισμοί (financial statements) live only on the registry’s web portal, so you cannot read a company’s numbers this way. Even so, matching these signals across thousands of awards is exactly what turns a list of names into a network.

The EU’s Open Data Maturity (ODM) assessment is an annual exercise, run by data.europa.eu (the Publications Office of the European Union), that measures the progress of European countries in promoting and facilitating the availability and reuse of public-sector information. Its methodology evaluates developments in open data across four thematic dimensions: policy, portal, quality and impact. Maturity in these four dimensions is aggregated into a single overall score that shows a country’s open-data maturity.

In the 2025 edition, Greece came last in the union: 27th of 27 EU member states, and well below the EU average. A year earlier it ranked 26th.

A quick reference for the Greek terms and code names that recur through this piece, so a reader can dip in without hunting back for where each was first defined.

• Diavgeia, Greece’s mandatory transparency portal: every public-spending decision is published there as a signed PDF plus structured API metadata before it takes legal effect.
• Δ.1 (απευθείας ανάθεση, direct award), the decision type for a no-bid award: a public body picks a supplier directly, with no open tender, allowed only up to €30,000 net for supplies and services (€60,000 for works / έργα).
• ΑΔΑ, the unique posting id every Diavgeia decision carries, as in a diavgeia.gov.gr/doc/<ΑΔΑ> link.
• ΑΦΜ, a Greek tax ID; here, the number that identifies the supplier behind an award.
• Γ.Ε.ΜΗ., the General Commercial Registry, where Greek companies record their legal form, age (σύσταση), seat, activity codes (ΚΑΔ) and managers.
• CPV / ΚΑΔ, two classification systems: CPV is the EU procurement vocabulary for what was bought; ΚΑΔ is the Greek activity-code system for what a company is registered to do.