Validation

Checks a SWIFT/BIC against ISO 9362 structure (8 or 11 characters), splits bank/country/location/branch, and names well-known institutions.

Payment files reject a BIC that is the wrong length or uses a forbidden character in the location code long before they care which bank it is. This checks the ISO 9362 pattern, flags test BICs (a 0 in the location code), and treats XXX as the primary office. A handful of well-known 8-character bank codes resolve to a name; anything else returns bankName null rather than a guess. This is not a lookup in the SWIFT directory. A structurally valid BIC can still be unissued, deactivated or mistyped by one letter that still fits the pattern.

{
  "bic": "DEUTDEFF"
}

Press Run to try free — no key needed.

Validates an ISO 6346 freight-container number: owner code, category letter, serial and check digit.

Bills of lading and terminal scans mistype container numbers constantly; the check digit (ISO 6346) catches almost all of those before a customs filing. The fourth letter is the category (U freight, J equipment, Z chassis, R reefer). Owner codes are not resolved to a company — BIC's owner-code register is a separate paid product. A valid number is arithmetically self-consistent, not proof the box exists.

{
  "code": "CSQU3054383"
}

Press Run to try free — no key needed.

Validates GTIN-8, UPC-A (12), EAN-13 and GTIN-14 check digits for retail barcodes.

Retail GTINs share one GS1 check-digit algorithm with length-dependent packing (8 / 12 / 13 / 14). This endpoint stays on that retail identity: it does not guess shipping carriers. For 13-digit codes the leading three digits are returned as a GS1 company-prefix hint; 868/869 mark Türkiye. A matching check digit is arithmetic consistency, not proof the SKU is listed in a brand catalogue.

{
  "code": "8690504015154"
}

Press Run to try free — no key needed.

Checks an e-mail address: syntax, whether the domain can actually receive mail, disposable and role-account detection, and typo correction.

No SMTP probing. Most competitors connect to the target server and try RCPT TO, which sounds thorough but produces a confident-looking number you cannot trust: most servers are catch-all, the big providers refuse to answer, and doing it in bulk gets the probing IP blacklisted. We report only what is provable — whether the domain has a mail exchanger, whether it is a known disposable service, whether the mailbox belongs to a role rather than a person, and whether the domain looks like a typo of a common one (gmial.com → gmail.com). Addresses are also normalised, so Gmail dots and +tags stop creating duplicate signups.

{
  "email": "[email protected]"
}

Press Run to try free — no key needed.

Dated EU-27 VAT rates (standard, reduced, super-reduced, parking) plus the Union OSS threshold. Not a goods classification.

Invoice software that hard-codes “Germany is 19%” breaks the day a member state moves a rate, and it never knew the reduced list. This is a point-in-time schedule of published rates for the EU VAT area, keyed by country and asOf. It is a schedule of rates, not which goods fall in which reduced band — there is no HS or NACE mapping. Great Britain, Northern Ireland, Switzerland, Norway and Türkiye are recognised and returned with null rates. If the table has no row for that date the rates are null; the last known line is not reused.

{
  "country": "DE",
  "asOf": "2026-01-15"
}

Press Run to try free — no key needed.

Validates an EU VAT number against the official VIES register, with per-country format checks and honest handling of upstream outages.

VIES is free but unreliable: member-state services drop out individually and a failed lookup can easily be mistaken for a rejection. Treating an outage as "invalid" means charging VAT to a customer who should have been exempt — an error with a price tag. So this endpoint never returns `invalid` when the service could not answer; it returns `unknown` and names the reason, and reports whether that country's service is currently up. Format is checked locally first, so an obvious typo never becomes an upstream call. Results are cached for 24 hours. Note that most member states do not publish the company name; when they do, it is returned.

{
  "vatNumber": "DE811907980"
}

Press Run to try free — no key needed.

Validates an IBAN from any of 70+ countries: checksum, country length and in-country account structure, and resolves the bank and branch codes.

Most free libraries stop at the mod-97 checksum. That only says the digits are self-consistent — not that the number could exist in that country. This checks the country's BBAN structure too, so a wrong-length or wrong-shaped account is rejected before your payment file reaches the bank. When only the two check digits are wrong, the correct ones are computed and returned as a suggestion, because that is what people actually mistype. Turkish, Dutch and Belgian IBANs additionally resolve to a bank name when the national code is in our table; otherwise bankName is null. This is not a SWIFT directory.

{
  "iban": "DE89 3704 0044 0532 0130 00"
}

Press Run to try free — no key needed.

Parses ICAO 9303 TD1/TD3 MRZ and verifies check digits — format check, not identity proof.

Machine-readable zones on passports and ID cards carry ICAO 9303 check digits (weights 7,3,1). This parses TD3 (2×44, typical passport) and TD1 (3×30, typical ID card) and reports each field check. A mismatched check digit is HTTP 200 with valid:false — the string is still an MRZ, just inconsistent. This is a format check, not identity proof: it does not confirm the document was issued or that the holder is who they claim.

{
  "mrz": "P<UTODOE<<JANE<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\nL000000007UTO9001011F3001019AA0000000<<<<<02"
}

Press Run to try free — no key needed.

Validates ISBN-10 and ISBN-13 check digits and converts between them when the 978 prefix allows it.

Catalogue and retail systems still mix ISBN-10 and ISBN-13. This checks the ISBN-10 weighted mod-11 digit (X allowed) and the ISBN-13 / EAN-13 alternating 1–3 check digit. When an ISBN-10 is valid it returns the ISBN-13 form (978 + body + new check). ISBN-13 values starting with 978 convert back to ISBN-10; 979 prefixes have no ISBN-10 equivalent and isbn10 stays null. Hyphens and spaces are stripped. A valid checksum is not proof the title exists in a national bibliography.

{
  "isbn": "978-0-306-40615-7"
}

Press Run to try free — no key needed.

Validates an ISIN (ISO 6166): country code, national identifier and the letter-aware check digit.

Portfolio imports and corporate-action files fail on a single mistyped ISIN. The check digit is a Luhn variant that first expands letters to two digits (A=10…Z=35), so a swapped letter is caught, not just a swapped digit. XS (international), EU and other reserved prefixes are accepted as country codes even though they are not ISO 3166 territories. A valid ISIN is self-consistent. It is not proof the security exists, is listed, or is the one you meant.

{
  "isin": "US0378331005"
}

Press Run to try free — no key needed.

Looks up a Legal Entity Identifier in the GLEIF register: legal name, registration status, country, and BIC.

Checksum-valid is not the same as currently registered — a LAPSED or MERGED LEI still passes ISO 7064. This endpoint checks the digits locally first (a typo never becomes an upstream call) then GET the GLEIF lei-records API. Results are cached for 24 hours. GLEIF allows 60 requests per minute; above that, or on timeout/5xx, we return `unknown` rather than invent a registration. HTTP 404 means the service answered and the LEI is not in the index (`invalid`). This is not a replacement for GLEIF’s own API for bulk. `status` is registration.status (ISSUED/LAPSED/MERGED/…), not entity.status (ACTIVE).

{
  "lei": "5493001KJTIIGC8Y1R00"
}

Press Run to try free — no key needed.

Validates a 20-character Legal Entity Identifier (ISO 17442) with the ISO 7064 mod-97 check digits.

KYC and MiFID reporting reject an LEI that fails the check digits before anyone looks the entity up. The algorithm is the same family as IBAN (ISO 7064 mod 97-10) over all 20 characters; the remainder must be 1. The first 4 characters are the issuing LOU prefix, the next 14 the entity, the last 2 the check digits. This does not call GLEIF. A checksum-valid LEI can be lapsed, merged, or never issued. Use GLEIF's free API if you need "this legal entity is currently registered".

{
  "lei": "5493001KJTIIGC8Y1R12"
}

Press Run to try free — no key needed.

Validates and normalises a phone number to E.164, classifies the line type, and resolves the province for Turkish landlines.

For signup and checkout flows that need to store one canonical form and reject typos early. Turkish numbers are handled in depth: landline area codes resolve to a province, mobile and special ranges (toll-free 0800, fixed-rate 0850, premium 0900) are classified, and every accepted input comes back in both E.164 and national notation. One thing this endpoint deliberately does not claim: the current mobile operator. Turkey has had number portability since 2008, so a 0532 number may well be on another network today. Competing APIs report the prefix owner as "the operator" and customers pick SMS routes on that basis. We return it as `originallyAllocatedTo` with the caveat attached, because a confident wrong answer costs more than an honest gap.

{
  "phone": "0532 123 45 67"
}

Press Run to try free — no key needed.

Validates a tax identifier for 25+ countries: checksum where the algorithm is public, format-only where it is not. Country is required.

Onboarding forms collect a tax number from whatever country the customer is in and then store garbage because they only checked the length. This applies the published checksum (SIREN/SIRET Luhn, ABN mod-89, CPF/CNPJ, NIP, BSN 11-proef, NIF/NIE, OIB, IČO, AFM, TCKN/VKN, …) and refuses to guess the country: the same 9 digits are a well-formed identifier in more than one place. Where the checksum is not published (US EIN, UK UTR, DE Steuernummer, IN PAN) the answer is format + `checksum: not-verified`, not a fake pass. This does not ask any tax authority whether the number is issued.

{
  "tin": "73282932000074",
  "country": "FR"
}

Press Run to try free — no key needed.

Validates a 5-digit Turkish postal code and resolves the province from the first two digits (plate map).

PTT postal codes are five digits; the leading pair matches the province plate code for the 81 provinces. This endpoint checks the shape, maps 01–81 to the province name, and returns null with confidence none when the prefix is outside that range — it does not invent a district. District-level resolution needs the full PTT directory and is out of scope here.

{
  "postalCode": "34710"
}

Press Run to try free — no key needed.

Validates Turkish national ID, tax number, IBAN, licence plate, IMEI, barcodes, KEP, MERSİS, postal code and ISBN from one endpoint, with type auto-detection.

Goes past a yes/no: resolves the bank behind an IBAN, the province behind a licence plate and the GS1 country prefix behind a barcode. Pure local computation — no upstream service is called, so latency is microseconds and the answer never changes for the same input.

{
  "value": "TR33 0006 1005 1978 6457 8413 26"
}

Press Run to try free — no key needed.

Validates UUID structure and reports version (1–5, 7) and RFC 4122 variant bits. Deterministic.

Accepts dashed or 32-hex compact form. Reports the version nibble, variant (NCS / RFC 4122 / Microsoft / future), and whether the layout matches a known UUID version used in practice (v1–v5 and Unix-epoch v7). A valid structure is not proof the UUID was issued by a particular system.

{
  "uuid": "550e8400-e29b-41d4-a716-446655440000"
}

Press Run to try free — no key needed.

Validates a 17-character VIN: forbidden letters, ISO 3779 check digit, WMI region/manufacturer, model year and plant.

Typos in a VIN are usually a forbidden letter (I, O, Q — they look like 1 and 0) or a shifted character. This rejects those, splits WMI/VDS/VIS, and names the manufacturer when the WMI is in a conservative built-in table. The 9th-character check digit is computed and compared, but a mismatch does not fail the VIN: it is mandatory under FMVSS 115 in North America and routinely ignored in Europe. `checkDigitMatch` tells you; `valid` stays true if the 17-character form is legal. This does not decode the full vehicle (engine, body, options) and does not prove the VIN was issued.

{
  "vin": "1M8GDM9AXKP042788"
}

Press Run to try free — no key needed.