CIN TO PAN

Endpoint Overview

POST /api/v1/corporate/cin-to-pan

Description

The CIN to PAN Conversion API enables instant retrieval of a company's Permanent Account Number (PAN) using its Corporate Identification Number (CIN). This endpoint streamlines corporate verification processes by providing a direct mapping between these two critical business identifiers issued by Indian regulatory authorities.

CIN (Corporate Identification Number) is a unique 21-character alphanumeric identifier assigned by the Ministry of Corporate Affairs (MCA) to all companies registered in India. PAN (Permanent Account Number) is a 10-character alphanumeric identifier issued by the Income Tax Department for tax purposes. This API bridges these identifiers, enabling seamless corporate identity verification and due diligence workflows.

The API delivers real-time results with high accuracy, eliminating manual lookup processes and reducing verification time from hours to seconds. It serves as a foundational component for KYC compliance, vendor onboarding, credit assessment, and corporate background verification systems.

Key Benefits

Instant Verification: Retrieve PAN details in real-time using only the CIN number, eliminating manual searches across multiple databases

Regulatory Compliance: Ensure accurate corporate identity verification for KYC, AML, and due diligence requirements mandated by regulatory authorities

Workflow Automation: Integrate seamlessly into onboarding, procurement, and risk assessment workflows to accelerate business processes

Data Accuracy: Access verified, government-backed corporate identifiers to minimize errors in vendor management and financial operations

Use Cases

Financial Services

B2B Platforms

Professional Services

Corporate KYC: Banks and NBFCs can instantly verify company identities during account opening, loan applications, or credit facility assessments by validating CIN to PAN mappings

Risk Assessment: Credit rating agencies and financial institutions use this API to cross-verify corporate identities before conducting detailed credit analysis

Fraud Prevention: Detect identity mismatches or discrepancies between declared CIN and actual PAN to identify potentially fraudulent applications

Regulatory Reporting: Ensure accurate corporate identifier reporting to regulatory bodies like RBI, SEBI, and tax authorities

Technical Implementation

Authentication

All API requests require authentication using a JWT Bearer token. Authentication follows these steps:

Obtain API Credentials: Register with Surepass to receive your API key.

Generate JWT Token: Use your API key to generate a JWT token through Surepass's authentication service.

Include in Requests: Add the token to the Authorization header as Bearer {TOKEN}.

Different authentication tokens are used for sandbox and production environments:

Sandbox Environment: https://sandbox.surepass.app - Use for testing and development

Production Environment: https://kyc-api.surepass.app - Use for live transactions

Important: Never expose your JWT tokens in client-side code or public repositories. Always store tokens securely in environment variables or secure credential management systems.

Request Parameters

Request Headers

Header	Required	Description
Authorization	Yes	JWT Bearer token for authentication. Format: `Bearer {your_jwt_token}`
Content-Type	Yes	Must be set to `application/json`

Request Body

Parameter	Type	Required	Description
cin_number	string	Yes	21-character Corporate Identification Number (CIN) issued by the Ministry of Corporate Affairs. Format: 1 character (listing status) + 5 digits (industrial classification) + 2 characters (state code) + 4 digits (year of incorporation) + 3 characters (company type) + 6 digits (registration number). Example: U74999MH2017PTC000000

Request Body Validation Rules

The cin_number must be exactly 21 characters long

All characters must be alphanumeric (A-Z, 0-9)

The CIN should follow the MCA-prescribed format

Leading or trailing whitespaces will cause validation errors

Example Request

{
    "cin_number": "U74999MH2017PTC000000"
}

Process Response

Response Parameters

Parameter	Type	Description
data	object	Container object holding the response data
data.client_id	string	Unique identifier for this API request, useful for tracking and support purposes
data.cin_number	string	The CIN number that was queried (echoed back for confirmation)
data.pan_number	string	The retrieved PAN number associated with the provided CIN. Format: 10 alphanumeric characters (5 letters + 4 digits + 1 letter)
status_code	integer	HTTP status code indicating the result of the request (200 for success)
success	boolean	Indicates whether the API call was successful (true) or failed (false)
message	string	Human-readable message describing the result
message_code	string	Machine-readable code for programmatic handling of responses

Example Successful Response

{
    "data": {
        "client_id": "cin_to_pan_hwqkpTKvzrbbTLEsamyy",
        "cin_number": "U74999MH2017PTC000000",
        "pan_number": "ABDCI1234F"
    },
    "status_code": 200,
    "success": true,
    "message": "Success",
    "message_code": "success"
}

Possible Error Responses

Invalid CIN Format

Authentication Failed

Server Error

{
    "success": false,
    "status_code": 400,
    "message": "Invalid CIN format. Please provide a valid 21-character CIN number.",
    "message_code": "invalid_cin_format"
}

Cause: The provided CIN number doesn't meet format requirements (incorrect length, invalid characters, or malformed structure).

Resolution: Verify the CIN number is exactly 21 alphanumeric characters and follows the MCA format.

Integration Best Practices

Security Recommendations

Token Management: Never hardcode JWT tokens in your application code. Use environment variables or secure credential vaults (like AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault)

HTTPS Only: Always use HTTPS endpoints to ensure data encryption in transit. Never make API calls over unsecured HTTP connections

Token Rotation: Implement regular token rotation policies and refresh tokens before expiration to maintain uninterrupted service

Input Validation: Always validate and sanitize the CIN number on the client side before sending to the API to prevent injection attacks

Error Handling: Implement comprehensive error handling and avoid exposing sensitive error details to end users

Rate Limiting: Implement client-side rate limiting and request queuing to avoid hitting API quotas unexpectedly

Logging: Log all API requests with sanitized data (never log tokens or sensitive information) for audit trails and debugging

IP Whitelisting: Where possible, configure IP whitelisting on your Surepass account to restrict API access to known servers

User Experience Guidelines

Real-time Validation: Validate CIN format on the front-end before API submission to provide immediate feedback and reduce unnecessary API calls

Loading States: Display clear loading indicators during API calls since verification can take 1-3 seconds depending on network conditions

Clear Error Messages: Convert technical error codes into user-friendly messages that guide users on how to resolve issues

Retry Mechanism: For temporary failures (network issues, rate limits), implement automatic retry with exponential backoff to improve success rates

Caching Strategy: Cache successful CIN to PAN mappings with appropriate TTL (Time To Live) to reduce redundant API calls and improve response times

Fallback Options: Provide alternative verification methods if the CIN to PAN lookup fails (manual PAN entry with separate validation)

Progress Indicators: For bulk verification operations, show progress indicators and allow users to track the status of multiple lookups

Accessibility: Ensure form fields have proper labels, ARIA attributes, and keyboard navigation support for users with disabilities

Code Samples

cURL

Python

Node.js

Java

PHP

Compliance and Legal Considerations

Data Privacy: This API processes corporate identity data governed by India's Information Technology Act, 2000 and applicable data protection regulations. Ensure you have proper legal basis and consent mechanisms before processing company information.

KYC/AML Compliance: Financial institutions must use this API in accordance with RBI's Master Direction on Know Your Customer (KYC) and Prevention of Money Laundering Act (PMLA) requirements. Maintain proper audit trails and documentation.

Purpose Limitation: Use retrieved PAN information only for the stated business purpose (verification, onboarding, due diligence). Do not repurpose or share this data without proper authorization.

Data Retention: Follow industry-specific data retention guidelines. Financial services typically require 5-10 years of record retention, while other sectors may have different requirements.

Consent Management: Under the Digital Personal Data Protection Act (DPDPA), ensure you have obtained appropriate consent from the corporate entity before retrieving and processing their PAN information.

Audit Requirements: Maintain comprehensive logs of all API requests including timestamp, requesting user, purpose, and results for regulatory audits and compliance reporting.

MCA Data Usage: Data retrieved from this API originates from the Ministry of Corporate Affairs (MCA) database. Comply with MCA's terms of service regarding the use and redistribution of corporate data.

Tax Compliance: PAN information is tax-sensitive. Ensure your usage complies with Income Tax Department regulations regarding PAN data handling and storage.

Security Standards: Implement industry-standard security controls (ISO 27001, SOC 2) to protect stored corporate identity data from unauthorized access or breaches.

Cross-Border Data Transfer: If transferring retrieved data across international borders, ensure compliance with cross-border data transfer regulations and obtain necessary approvals.

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

curl --location --request POST 'https://kyc-api.surepass.app/api/v1/corporate/cin-to-pan' \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data-raw '{ "cin_number": "U74999MH2017PTC000000" }'

{ "data": { "client_id": "cin_to_pan_hwqkpTKvzrbbTLEsamyy", "cin_number": "U74999MH2017PTC000000", "pan_number": "ABDCI1234F" }, "status_code": 200, "success": true, "message": "Success", "message_code": "success" }

Description#

Use Cases#

Technical Implementation#

Request Headers#

Request Body#

Request Body Validation Rules#

Example Request#

Response Parameters#

Example Successful Response#

Possible Error Responses#

Integration Best Practices#

Code Samples#

Request

Responses