Mobile to PAN v2 API

Endpoint Overview

POST /api/v1/pan/mobile-to-pan-v2

Description

The Mobile to PAN Lookup API v2 enables instant retrieval of Permanent Account Number (PAN) details associated with a registered mobile number. This endpoint provides a streamlined method for businesses to verify customer identity by linking mobile numbers to official PAN records maintained by Indian tax authorities.

This API is designed for organizations that need to:

Validate customer identity during onboarding processes

Prefill KYC forms with accurate PAN information

Reduce manual data entry errors

Enhance fraud prevention measures

Comply with regulatory requirements for identity verification

The v2 iteration offers improved response times, enhanced data accuracy, and better error handling compared to previous versions.

Key Benefits

Instant Verification: Retrieve PAN details in real-time, reducing customer onboarding time from hours to seconds

Enhanced Accuracy: Access official PAN records directly, eliminating manual entry errors and reducing form abandonment rates

Regulatory Compliance: Meet KYC and AML requirements with verified identity data from authoritative sources

Seamless Integration: Simple REST API design with straightforward request/response structure for quick implementation

Use Cases

Financial Services

E-Commerce & Marketplaces

Insurance & Healthcare

Digital Account Opening: Instantly verify customer PAN details during online banking or investment account creation

Loan Applications: Streamline loan processing by automatically fetching applicant PAN information

Credit Card Issuance: Validate PAN details for credit card applications and risk assessment

Investment Onboarding: Speed up mutual fund, demat, and trading account setup with automated PAN lookup

Technical Implementation

Authentication

All API requests require authentication using a JWT Bearer token. Authentication follows these steps:

Obtain API Credentials: Register with Surepass to receive your API key.

Generate JWT Token: Use your API key to generate a JWT token for the specific environment.

Include in Requests: Add the token to the Authorization header as Bearer YOUR_JWT_TOKEN.

Different authentication tokens are used for sandbox and production environments:

Sandbox: https://sandbox.surepass.app

Production: https://kyc-api.surepass.app

Important: Keep your JWT tokens secure and never expose them in client-side code or public repositories.

Request Parameters

Request Headers

Header	Required	Description
Authorization	Yes	Bearer token for authentication. Format: `Bearer YOUR_JWT_TOKEN`
Content-Type	Yes	Must be set to `application/json`

Request Body

Parameter	Type	Required	Description
mobile_number	string	Yes	10-digit Indian mobile number without country code or special characters. Must be a valid active mobile number registered with telecom providers.

Example Request

{
    "mobile_number": "9876543210"
}

Request Validation Rules:

Mobile number must be exactly 10 digits

Should not include country code (+91), spaces, or special characters

Must be a valid Indian mobile number format

Process Response

Response Parameters

Parameter	Type	Description
success	boolean	Indicates whether the API request was successful (true/false)
status_code	integer	HTTP status code of the response (200 for success)
message	string	Human-readable message describing the response status
message_code	string	Machine-readable code for programmatic handling ("success" for successful requests)
data	object	Container object holding the response payload
data.client_id	string	Unique identifier for tracking this specific API request
data.mobile_number	string	The mobile number that was queried
data.pan_number	string	PAN number associated with the mobile number (format: 5 letters + 4 digits + 1 letter)
data.status	string	Status of the verification process ("success" indicates PAN was found)

Example Successful Response

{
    "data": {
        "client_id": "mobile_to_pan_v2_rKObqxLbiOtBjoFobkfY",
        "mobile_number": "9876543210",
        "pan_number": "ABCPD1234E",
        "status": "success"
    },
    "status_code": 200,
    "success": true,
    "message": "Success",
    "message_code": "success"
}

Possible Error Responses

Invalid Mobile Number

Unauthorized Access

PAN Not Found

Rate Limit Exceeded

{
    "success": false,
    "status_code": 400,
    "message": "Invalid mobile number format",
    "message_code": "invalid_input",
    "data": null
}

Cause: Mobile number doesn't meet validation criteria (not 10 digits, contains special characters, etc.)

Resolution: Verify the mobile number format and ensure it's a valid 10-digit Indian mobile number.

Integration Best Practices

Security Recommendations

Token Management: Store JWT tokens securely using environment variables or secure credential management systems. Never hardcode tokens in source code.

HTTPS Only: Always use HTTPS endpoints to encrypt data in transit and prevent man-in-the-middle attacks.

Input Validation: Sanitize and validate mobile numbers on the client side before sending API requests to prevent injection attacks.

Error Handling: Implement comprehensive error handling to avoid exposing sensitive information in error messages to end users.

Access Control: Restrict API access to authorized services only using IP whitelisting or network-level security controls.

Audit Logging: Maintain detailed logs of all API calls including timestamps, request parameters, and response codes for security audits and compliance.

User Experience Guidelines

Progressive Disclosure: Show loading indicators while the API request is in progress to keep users informed.

Auto-fill Forms: Use the retrieved PAN number to automatically populate KYC forms, reducing user effort and errors.

Error Messaging: Display user-friendly error messages when PAN is not found, guiding users on next steps.

Validation Feedback: Provide immediate feedback on mobile number format validation before API submission.

Retry Mechanism: Implement graceful retry logic for transient failures without requiring user intervention.

Privacy Notice: Inform users that their mobile number will be used for PAN verification in accordance with privacy regulations.

Code Samples

cURL

Python

Node.js

Java

PHP

Related APIs

PAN Verification API: Validate PAN number authenticity and retrieve detailed cardholder information including name, date of birth, and registration status

PAN to Mobile API: Reverse lookup to find mobile numbers associated with a given PAN number for verification purposes

Compliance and Legal Considerations

Data Privacy: This API processes personal information including mobile numbers and PAN details. Ensure compliance with the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023. Obtain explicit user consent before collecting and processing their data.

Purpose Limitation: Use retrieved PAN information solely for the stated purpose (KYC, identity verification, regulatory compliance). Do not repurpose data for unauthorized uses such as marketing without separate consent.

Data Retention: Implement appropriate data retention policies aligned with regulatory requirements. Delete or anonymize PAN data when no longer needed for the original purpose.

Authorized Use Only: Access to PAN databases is regulated by the Income Tax Department of India. Ensure your organization has proper authorization and legitimate business needs for accessing this information.

Security Standards: Implement industry-standard security measures including encryption at rest and in transit, access controls, and regular security audits to protect sensitive PAN information.

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

curl --location --request POST 'https://kyc-api.surepass.app/api/v1/pan/mobile-to-pan-v2' \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data-raw '{ "mobile_number": "9876543210" }'

{ "data": { "client_id": "mobile_to_pan_v2_rKObqxLbiOtBjoFobkfY", "mobile_number": "9876543210", "pan_number": "ABCPD1234E", "status": "success" }, "status_code": 200, "success": true, "message": "Success", "message_code": "success" }

Mobile To PAN V2

Mobile to PAN v2 API#

Description#

Use Cases#

Technical Implementation#

Request Headers#

Request Body#

Example Request#

Response Parameters#

Example Successful Response#

Possible Error Responses#

Integration Best Practices#

Code Samples#

Request

Responses