PAN-Udyam Check Initialize

Endpoint Overview

POST /api/v1/pan-udyam-check/initialize

Description

The PAN-Udyam Check Initialize API enables businesses to verify the linkage between a PAN (Permanent Account Number) and Udyam Registration details in an asynchronous manner. This endpoint initiates the verification process by accepting PAN details along with the business name and date of incorporation, returning a unique client ID for tracking the verification status.

This API is essential for businesses that need to validate the authenticity of MSMEs (Micro, Small, and Medium Enterprises) registered under the Udyam Registration system. The asynchronous nature of this endpoint makes it ideal for high-volume verification scenarios where immediate responses aren't critical, allowing your system to continue processing while the verification completes in the background.

Key Benefits

Asynchronous Processing: Initiate verification requests without blocking your application workflow

MSME Validation: Verify legitimate Udyam-registered businesses to reduce fraud risk

Compliance Support: Meet regulatory requirements for vendor onboarding and supplier verification

Scalable Architecture: Handle multiple concurrent verification requests efficiently

Use Cases

Financial Services

E-commerce & Marketplaces

Government & Public Sector

MSME Loan Disbursement: Verify Udyam registration before approving loans under government schemes

Vendor Onboarding: Validate supplier credentials for supply chain financing programs

Credit Assessment: Cross-verify business authenticity as part of creditworthiness evaluation

Technical Implementation

Authentication

All API requests require authentication using a JWT Bearer token. Authentication follows these steps:

Obtain API Credentials: Register with Surepass to receive your API key.

Generate JWT Token: Use your API key to generate a JWT token.

Include in Requests: Add the token to the Authorization header as Bearer TOKEN.

Different authentication tokens are used for sandbox and production environments:

Sandbox: https://sandbox.surepass.app

Production: https://kyc-api.surepass.app

Request Parameters

Request Headers

Header	Required	Description
Authorization	Yes	Bearer token for API authentication. Format: `Bearer <JWT_TOKEN>`
Content-Type	Yes	Must be set to `application/json`

Request Body

Parameter	Type	Required	Description
pan_number	String	Yes	Valid 10-character PAN number of the business entity. Format: 5 letters, 4 digits, 1 letter (e.g., ABBCS1234D)
full_name	String	Yes	Complete registered business name as per official records. Must match the name associated with the PAN
dob	String	Yes	Date of incorporation or registration of the business. Format: YYYY-MM-DD (e.g., 2000-08-23)

Example Request

{
    "pan_number": "ABBCS1234D",
    "full_name": "Smart Analytics Services Pvt Ltd",
    "dob": "2000-08-23"
}

Process Response

Response Parameters

Parameter	Type	Description
data	Object	Container object holding the verification response data
data.client_id	String	Unique identifier for tracking this verification request. Use this ID to poll for results
data.status	String	Current status of the verification process. Initial value is typically "pending"
status_code	Integer	HTTP status code indicating the result of the API call
success	Boolean	Indicates whether the API request was successful (true) or failed (false)
message	String	Human-readable message describing the result of the operation
message_code	String	Machine-readable code for programmatic handling of responses

Example Successful Response

{
    "data": {
        "client_id": "pan_udyam_check_async_WsHoFrce",
        "status": "pending"
    },
    "status_code": 200,
    "success": true,
    "message": "Success",
    "message_code": "success"
}

Possible Error Responses

Authentication Failed

Missing Required Fields

{
    "data": null,
    "status_code": 401,
    "success": false,
    "message": "Unauthorized access",
    "message_code": "unauthorized"
}

The JWT Bearer token is either missing, expired, or invalid. Generate a new token and retry the request.

Integration Best Practices

Security Recommendations

Secure Token Storage: Never hardcode JWT tokens in your source code. Use environment variables or secure credential management systems

HTTPS Only: Always use HTTPS endpoints to prevent man-in-the-middle attacks and ensure data transmission security

Token Rotation: Implement regular token refresh mechanisms to minimize security risks from compromised credentials

Input Validation: Sanitize and validate all input parameters on the client side before sending requests

Rate Limiting: Implement client-side rate limiting to avoid overwhelming the API and triggering security blocks

User Experience Guidelines

Async Status Updates: Since this is an initialization endpoint, implement polling or webhook mechanisms to retrieve verification results and update users proactively

Clear Error Messages: Translate technical error codes into user-friendly messages that guide users on how to resolve issues

Loading Indicators: Show appropriate loading states when initiating verification to set proper user expectations

Retry Logic: Implement exponential backoff retry logic for transient failures to improve success rates

Progress Tracking: Use the returned client_id to provide users with a way to track their verification request status

Code Samples

cURL

Python

Node.js

Related APIs

PAN Verification API: Validate PAN authenticity independently before initiating Udyam checks

Udyam Registration Verification: Directly verify Udyam registration details using the Udyam Registration Number

Business PAN Verification: Advanced PAN validation with additional business entity details

Compliance and Legal Considerations

This API accesses official government databases and must be used in compliance with applicable data protection regulations including the Information Technology Act, 2000 and associated rules. Ensure you have proper consent from the business entity before initiating verification. The data retrieved should be used solely for legitimate business purposes such as KYC, vendor onboarding, or compliance requirements. Maintain audit trails of all verification requests for regulatory compliance. Do not store sensitive PAN data longer than necessary and implement appropriate data retention policies. Users are responsible for ensuring their use case aligns with the permissible purposes under applicable laws and regulations.

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

curl --location --request POST 'https://kyc-api.surepass.app/api/v1/pan-udyam-check/initialize' \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data-raw '{ "pan_number": "ABBCS1234D", "full_name": "Smart Analytics Services Pvt Ltd", "dob": "2000-08-23" }'

{ "data": { "client_id": "pan_udyam_check_async_WsHoFrce", "status": "pending" }, "status_code": 200, "success": true, "message": "Success", "message_code": "success" }

Initialize

PAN-Udyam Check Initialize#

Description#

Use Cases#

Technical Implementation#

Request Headers#

Request Body#

Example Request#

Response Parameters#

Example Successful Response#

Possible Error Responses#

Integration Best Practices#

Code Samples#

Request

Responses