ForHosting KIT · Validation

Check a SWIFT/BIC code

The SWIFT/BIC Validation API looks at a bank identifier code and confirms it follows the ISO 9362 shape banks actually use: a 4-letter institution code, a 2-letter country, a 2-character location and an optional 3-character branch. It's a small check with an outsized payoff, since a malformed BIC on a wire instruction is one of the most common reasons cross-border payments stall at the sending bank.

● StableFree · in your browser

Run — free How it works & API

Use it from WebAPIEmailApp soonTelegram soon

What a valid SWIFT/BIC actually looks like

A BIC is either 8 or 11 characters, never anything else, and every position carries meaning: the first four letters identify the institution, the next two the ISO country code, the next two a location code within that country, and an optional final three identify a specific branch when present. The swift code validation api parses each segment on its own and confirms the character set and length rules hold, catching the common failure modes — a lowercase code copied from a PDF, a stray space, an 11-character code truncated to 9, or a country segment that doesn't correspond to a real ISO code.

Where a bad BIC causes real friction

International wire desks, payroll systems paying contractors abroad, invoicing platforms collecting bank details from vendors, and treasury software reconciling counterparty records all depend on a correctly shaped BIC before a payment instruction goes anywhere. Because SWIFT payments route through correspondent banks, a malformed code doesn't always fail instantly — sometimes it sits in a queue for review, adding days to a transfer that should have taken hours. Catching the format error at data entry avoids that entire detour.

How the check runs

Send POST /verify/swift with the code and you receive a task_id immediately, since verification happens asynchronously and never blocks your calling process. The response tells you whether the format is valid, the parsed institution and country segments, and whether an optional branch code was present. Any task that fails outright is retried three times before returning a clear error, and you're never billed for a task that ultimately fails.

A format shaped by decades of interbank messaging

The BIC standard traces back to SWIFT's founding in the 1970s as banks needed a compact, unambiguous way to address each other across a shared messaging network, and it was later formalized as ISO 9362. That history is why the structure is so rigid: a fixed-width code was designed to be parsed by machines reliably, long before APIs existed, and that same rigidity is what makes format validation both possible and genuinely useful today.

Wiring it into payment workflows

Because results arrive as structured JSON by webhook, this drops straight into vendor onboarding forms, batch payroll uploads and periodic audits of a stored counterparty table: validate on entry to stop a bad code before it reaches a payment file, or sweep an existing database overnight to flag records worth a second look. Access requires prepaid balance, which keeps the endpoint fast and free of abuse, and each check is a flat published $0.002 with no invented credits to track.

What you can do with it

International wire setup

A treasury team validates a new counterparty's BIC the moment it's entered into the payment system, before it's ever included in a wire instruction.

Contractor payroll abroad

A payroll platform checks the SWIFT code on a foreign contractor's bank profile at onboarding, avoiding a stalled international transfer on the first pay run.

Vendor invoicing platform

An accounts-payable tool validates the BIC field on every new supplier record before it's saved, preventing malformed codes from ever reaching an outgoing payment batch.

Counterparty database audit

A bank operations team runs its stored BIC list through the endpoint periodically to catch codes that were entered incorrectly years ago and never used until now.

FAQ

How do I validate a SWIFT/BIC code with an API?

Send POST /verify/swift with the code. The swift code validation api returns a task_id immediately and delivers the format result to your webhook or a signed link once the check completes.

Does this confirm the bank code is actually assigned to a real bank?

No. It confirms the code follows the correct 8 or 11-character ISO 9362 structure and character set. Confirming a BIC is currently assigned and active requires the SWIFT network's own registry, which this endpoint does not query.

Is SWIFT/BIC validation free?

The tool above runs free in your browser. The API is paid — each call draws from your prepaid ForHosting KIT balance: top up from $10.00 (it never expires), pay each request's published price, and a call with no balance returns HTTP 402. No subscription, no tokens, and a failed task is never charged.

What's the difference between an 8-character and 11-character BIC?

An 8-character code identifies the institution's primary office, while an 11-character code adds a 3-character branch identifier for a specific location. Both are valid; the endpoint accepts and correctly parses either length.

Can I validate SWIFT codes in bulk?

Yes. Submit each code as its own POST and the tasks process in parallel; every request is billed independently and a failed task is retried and never charged.

Why does a code that looks right sometimes fail validation?

Most failures trace back to a lowercase letter, a trailing space copied from a document, or a country segment that isn't a real ISO code — small entry errors the structural check is built to catch.

How are results delivered?

Either a signed webhook posted to your server as soon as the check finishes, which we recommend, or a signed link valid for 24 hours you can retrieve on your own schedule.

Is the submitted code stored afterward?

No. The code and its result are deleted once the retention window closes and are never used for training; delivery links are signed and expire after 24 hours.

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/verify/swift

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/verify/swift \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d &#39;{"items":["valor-1","valor-2"]}'

const res = await fetch("https://api.kit.forhosting.com/verify/swift", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "items": [
      "valor-1",
      "valor-2"
    ]
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/verify/swift",
    headers={"Authorization": f"Bearer {os.environ[&#39;KIT_KEY']}"},
    json={
    "items": [
        "valor-1",
        "valor-2"
    ]
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/verify/swift", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => &#39;{"items":["valor-1","valor-2"]}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"items":["valor-1","valor-2"]}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/verify/swift", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "items": [
    "valor-1",
    "valor-2"
  ]
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "verify.swift",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Read the full KIT documentation →

Run — free