PAN Advanced

Endpoint Overview

POST /api/v1/ocr/pan-advanced

Description

This endpoint performs advanced Optical Character Recognition (OCR) on a PAN card image or PDF, extracting structured identity fields with per-field confidence scores. Submit a PAN card file and receive machine-readable data including the PAN number, full name, father's name, and date of birth — each annotated with a confidence score indicating extraction accuracy.

The API supports both image and PDF inputs, making it flexible for workflows where scanned documents, mobile captures, or digitally generated PAN PDFs need to be processed. The extracted data is returned synchronously in a structured JSON response, ready for downstream verification, KYC enrichment, or form pre-fill workflows.

Key Benefits

Extracts all key PAN card fields (PAN number, full name, father's name, date of birth) in a single API call with no manual parsing required

Per-field confidence scores allow your application to flag low-confidence extractions for human review rather than blindly trusting OCR output

Supports both image files and PDFs via the use_pdf flag, accommodating a wide range of document input formats

Enables automated form pre-fill and KYC onboarding flows by eliminating manual data entry from PAN card documents

Use Cases

Banking & NBFC

Insurance

Fintech & Payments

Automate PAN data extraction during digital account opening to pre-fill KYC forms without requiring manual entry from applicants

Validate PAN card details extracted via OCR against the PAN Verification API to confirm document authenticity during loan applications

Process bulk PAN card uploads during periodic KYC refresh exercises without manual data entry

Accelerate credit underwriting by instantly extracting and structuring PAN data from uploaded documents in the loan origination system

Technical Implementation

Authentication

All API requests require authentication using a JWT Bearer token. Authentication follows these steps:

Obtain API Credentials: Register with Surepass to receive your API key.

Generate JWT Token: Use your API key to generate a JWT token.

Include in Requests: Add the token to the Authorization header as Bearer TOKEN.

Different authentication tokens are used for sandbox and production environments:

Sandbox: https://sandbox.surepass.app

Production: https://kyc-api.surepass.app

Request Parameters

Request Headers

Header	Required	Description
`Authorization`	Yes	JWT Bearer token. Format: `Bearer <YOUR_JWT_TOKEN>`. Use the sandbox token for sandbox and the production token for production.
`Content-Type`	Yes	Must be set to `multipart/form-data`. This is required because the request includes a file upload alongside form fields.

Request Body

This endpoint accepts a multipart/form-data request body containing both a file upload and an optional form field.

Parameter	Type	Required	Description
`file`	file	Yes	The PAN card document to be processed. Supported formats include common image types and PDF (when `use_pdf` is `true`).
`use_pdf`	Boolean	Optional	Set to `"true"` to indicate that the uploaded file is a PDF document. If omitted or set to `"false"`, the file is treated as an image.

Example Request

Process Response

Response Parameters

Parameter	Type	Description
`data`	object	Contains the OCR result payload for this request.
`data.client_id`	string	A server-generated unique session identifier for this OCR request. Can be used for support queries or audit logging.
`data.ocr_fields`	array	List of extracted OCR result objects. Each element represents one detected PAN card in the submitted document.
`data.ocr_fields[].document_type`	string	The type of document detected. Returns `"pan"` for PAN cards.
`data.ocr_fields[].pan_number`	object	Extracted PAN number field.
`data.ocr_fields[].pan_number.value`	string	The extracted PAN number string (e.g., `"AAACK1234W"`).
`data.ocr_fields[].pan_number.confidence`	number	Confidence score for the PAN number extraction, between 0 and 1. Higher values indicate greater certainty.
`data.ocr_fields[].full_name`	object	Extracted full name of the PAN card holder.
`data.ocr_fields[].full_name.value`	string	The extracted full name as it appears on the PAN card.
`data.ocr_fields[].full_name.confidence`	number	Confidence score for the full name extraction, between 0 and 1.
`data.ocr_fields[].father_name`	object	Extracted father's name of the PAN card holder.
`data.ocr_fields[].father_name.value`	string	The extracted father's name as it appears on the PAN card.
`data.ocr_fields[].father_name.confidence`	number	Confidence score for the father's name extraction, between 0 and 1.
`data.ocr_fields[].dob`	object	Extracted date of birth of the PAN card holder.
`data.ocr_fields[].dob.value`	string	The extracted date of birth in `YYYY-MM-DD` format.
`data.ocr_fields[].dob.confidence`	number	Confidence score for the date of birth extraction, between 0 and 1.
`data.ocr_fields[].dob.yob`	boolean	Indicates whether only the year of birth (rather than the full date) is printed on the PAN card. `false` means the full date of birth was available and extracted.
`status_code`	integer	HTTP-equivalent numeric status code. `200` indicates successful OCR processing.
`success`	boolean	Top-level flag indicating whether the request was processed successfully. `true` on success.
`message`	string	Human-readable status message. Returns `"Success"` on successful processing.
`message_code`	string	Machine-readable message identifier for programmatic response handling. Returns `"success"` on success.

Example Successful Response

{
  "data": {
    "client_id": "ocr_pan_advanced_rbuveglhYUiyyMyuzLTR",
    "ocr_fields": [
      {
        "document_type": "pan",
        "pan_number": {
          "value": "AAAPK1234W",
          "confidence": 0.99
        },
        "full_name": {
          "value": "Akku Yadav",
          "confidence": 0.98
        },
        "father_name": {
          "value": "NEERAJ",
          "confidence": 0.98
        },
        "dob": {
          "value": "1998-01-10",
          "confidence": 0.99,
          "yob": false
        }
      }
    ]
  },
  "status_code": 200,
  "success": true,
  "message": "Success",
  "message_code": "success"
}

Possible Error Responses

401 Unauthorized

400 Bad Request

422 Unprocessable Entity

429 Rate Limited

500 Server Error

{
  "data": null,
  "status_code": 401,
  "success": false,
  "message": "Unauthorized",
  "message_code": "unauthorized"
}

Returned when the Authorization header is missing, malformed, or the JWT token is expired or invalid. Verify that a valid Bearer token for the correct environment (sandbox or production) is included in the request.

Integration Best Practices

Security Recommendations

Never hardcode JWT tokens in client-side code or version control — use environment variables or a secrets manager

Transmit PAN card files exclusively over HTTPS; never send sensitive identity documents over unencrypted HTTP

Avoid storing raw PAN card images on your servers longer than necessary — process, extract, and discard in accordance with your data retention policy

Keep sandbox and production JWT tokens strictly separate — never use a production token in development or testing environments

Restrict API key access using IP allowlisting or access controls where supported to limit exposure in case of token compromise

User Experience Guidelines

Use per-field confidence scores to decide whether to auto-populate form fields or flag them for manual review — a threshold of 0.90 or above is a reasonable starting point for auto-fill

Check dob.yob before displaying or validating the date of birth: if true, only the year is available and downstream date-of-birth validation logic should be adjusted accordingly

Provide clear in-app guidance on acceptable document quality (good lighting, flat surface, no glare, minimum resolution) to reduce submission of unprocessable images

Show a meaningful error message when OCR fails due to document quality, and give the user a clear path to re-upload rather than a generic failure screen

Validate file type and size on the client side before upload to catch unsupported formats early and reduce unnecessary API calls

Code Samples

cURL

Python

Node.js

Related APIs

PAN Verification API: Cross-verify the PAN number extracted by this OCR endpoint against the Income Tax Department database to confirm authenticity and check for name match

Aadhaar OCR API: Extract structured data from Aadhaar cards using the same OCR pipeline — commonly combined with PAN OCR for two-document KYC workflows

Face Match API: Compare the photo extracted from a PAN card image against a live selfie or portrait for identity verification and anti-spoofing checks

Voter ID OCR API: Extract identity fields from Voter ID cards — useful as an alternative or supplementary document when PAN is not available

Driving Licence OCR API: Extract identity and license details from driving licence documents, often used alongside PAN OCR in fintech onboarding flows

Compliance and Legal Considerations

PAN card data is classified as sensitive personal information under the Digital Personal Data Protection Act, 2023 (DPDPA). Collection, processing, and storage of PAN data requires explicit, informed consent from the individual.

Under the Income Tax Act, 1961, PAN numbers must only be used for lawful financial and tax-related purposes. Misuse of PAN data for unauthorized purposes is a criminal offence.

Implement a clear data retention and deletion policy for PAN card images and extracted data. Do not retain documents beyond the period necessary for the stated processing purpose.

If using extracted PAN data for downstream verification or decisioning, ensure your organization's privacy policy discloses this use and that users have consented to it.

Surepass acts as a data processor. Your organization remains the data controller and bears responsibility for ensuring all processing of PAN card data is lawful, purposeful, and compliant with applicable regulations.

For regulated industries (banking, insurance, lending), ensure PAN OCR workflows meet the KYC norms prescribed by your respective regulator (RBI, IRDAI, SEBI, etc.).

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

{ "data": { "client_id": "ocr_pan_advanced_rbuveglhYUiyyMyuzLTR", "ocr_fields": [ { "document_type": "pan", "pan_number": { "value": "AAAPK1234W", "confidence": 0.99 }, "full_name": { "value": "Akku Yadav", "confidence": 0.98 }, "father_name": { "value": "NEERAJ", "confidence": 0.98 }, "dob": { "value": "1998-01-10", "confidence": 0.99, "yob": false } } ] }, "status_code": 200, "success": true, "message": "Success", "message_code": "success" }

Description#

Use Cases#

Technical Implementation#

Request Headers#

Request Body#

Example Request#

Response Parameters#

Example Successful Response#

Possible Error Responses#

Integration Best Practices#

Code Samples#

Request

Responses