ForHosting KIT · Validation

Validate an IBAN

The IBAN Validation API takes any International Bank Account Number and tells you, structurally, whether it could ever be real: correct country prefix, correct length for that country, and a checksum that actually clears. It exists because a bank transfer built on a typo doesn't bounce politely — it either lands in the wrong account or sits stuck for days, and this endpoint catches the typo before either happens.

● StableFree · in your browser

Run — free How it works & API

Use it from WebAPIEmailApp soonTelegram soon

What an IBAN checksum actually proves

Every IBAN carries two check digits right after the country code, and those digits are the output of a mod-97 calculation over the rest of the number. That means an IBAN with a single transposed digit, a dropped character or a swapped letter will almost always fail the checksum, even though it might still look plausible to a human eye. The iban validation api recomputes that checksum server-side and compares it against the BBAN length and structure each country registers with SWIFT, so a pass means the number is internally consistent, not that the account exists or is open.

Who needs this before money moves

Payroll systems onboarding a new hire's bank details, marketplaces paying out sellers across borders, treasury teams reconciling supplier records, and any checkout flow collecting IBANs from customers all share the same risk: a malformed IBAN either gets rejected by the bank days later or, worse, gets misrouted. Validating at the point of entry turns a support ticket and a delayed payment into an inline error the user fixes in seconds.

The request and what comes back

Call POST /verify/iban with the IBAN string and you get a task_id immediately; the check itself runs asynchronously so your form submission never blocks. The result reports whether the format is valid, the detected country, the expected length for that country, and whether the checksum passed. If a task fails outright it retries three times before returning a clear error, and a failed task is never billed — you only pay for checks that complete.

Coverage across more than 80 countries

IBAN started as a European standard in the late 1990s and has since been adopted well beyond the EU, with each participating country registering its own fixed length and BBAN layout in the IBAN registry. Some countries embed a bank code, others a branch code, others neither, and the lengths range from 15 to 34 characters. This endpoint keeps that per-country structure current so the same call works whether the IBAN comes from Germany, Brazil, Saudi Arabia or Ukraine, without you maintaining a lookup table yourself.

Dropping it into a payment pipeline

Because the response is structured JSON delivered by webhook, teams wire this directly into onboarding forms, batch payroll imports and vendor-record cleanups: validate on entry to block a payment before it's scheduled, or run a nightly batch across an existing customer table to flag records worth a second look. Access requires prepaid balance, which is what keeps the endpoint fast and free of scraping abuse, and each check is a flat, published $0.002 with no bundled credits to track.

What you can do with it

Payroll onboarding

An HR platform validates a new employee's IBAN the moment it's typed into the bank-details form, catching a mistyped digit before the first payroll run tries to use it.

Marketplace payouts

A multi-country marketplace checks every seller's IBAN before scheduling a payout batch, so a single bad account number doesn't stall the entire run.

Vendor master-data cleanup

A finance team runs its existing supplier database through the endpoint overnight to flag IBANs that fail checksum, ahead of a migration to a new payment system.

Checkout-time validation

A subscription billing page validates the customer's IBAN inline during SEPA direct-debit signup, replacing a silent bank rejection days later with an immediate, fixable error.

FAQ

How do I validate an IBAN with an API?

Send POST /verify/iban with the IBAN string. The iban validation api returns a task_id right away and delivers the checksum and format result to your webhook or a signed link once the check completes.

Does this confirm the bank account actually exists?

No. It confirms the IBAN is structurally valid — correct country format, correct length and a passing mod-97 checksum. Confirming that an account is open and active requires the bank's own verification rails, which this endpoint does not perform.

Is there a free tier for IBAN validation?

The tool above runs free in your browser. The API is paid — each call draws from your prepaid ForHosting KIT balance: top up from $10.00 (it never expires), pay each request's published price, and a call with no balance returns HTTP 402. No subscription, no tokens, and a failed task is never charged.

How many countries does the IBAN validation API cover?

More than 80 countries that participate in the IBAN standard, each checked against its own registered length and BBAN structure rather than one generic rule.

Can I validate IBANs in bulk?

Yes. Submit each IBAN as its own POST and the tasks run in parallel; every request is billed independently and a failed task is retried and never charged.

What does a failed checksum usually mean?

Most often a single transposed or mistyped digit, a missing character, or an IBAN copied from the wrong field. It rarely means the underlying bank account is invalid, only that the number as entered is not.

How do results get delivered?

Either a signed webhook posted to your server the moment the check finishes, which we recommend, or a signed link valid for 24 hours you can fetch on your own schedule.

Is my IBAN data kept after the check?

No. The submitted IBAN and its result are deleted once the retention window closes and are never used for training; delivery links are signed and expire.

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/verify/iban

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/verify/iban \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d &#39;{"items":["valor-1","valor-2"]}'

const res = await fetch("https://api.kit.forhosting.com/verify/iban", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "items": [
      "valor-1",
      "valor-2"
    ]
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/verify/iban",
    headers={"Authorization": f"Bearer {os.environ[&#39;KIT_KEY']}"},
    json={
    "items": [
        "valor-1",
        "valor-2"
    ]
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/verify/iban", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => &#39;{"items":["valor-1","valor-2"]}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"items":["valor-1","valor-2"]}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/verify/iban", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "items": [
    "valor-1",
    "valor-2"
  ]
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "verify.iban",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Read the full KIT documentation →

Run — free