PAN Verify

Endpoint Overview

POST /api/v1/pan/pan-verify

Description

The PAN Card Verification API enables real-time validation of Permanent Account Number (PAN) cards issued by the Income Tax Department of India. This endpoint verifies the authenticity of PAN details by validating the PAN number against the official government database and cross-checking it with the cardholder's full name and date of birth.

This API provides instant verification results, helping businesses ensure compliance with KYC (Know Your Customer) regulations while preventing fraud and identity theft. The verification process is seamless, secure, and returns comprehensive data about the PAN cardholder, making it an essential tool for financial services, fintech platforms, and any organization requiring PAN validation.

Key Benefits

Instant Verification: Real-time validation against government databases with immediate results

Regulatory Compliance: Ensures adherence to KYC/AML requirements mandated by regulatory authorities

Fraud Prevention: Validates PAN authenticity and matches cardholder details to prevent identity fraud

Seamless Integration: Simple REST API with clear request/response structure for easy implementation

Use Cases

Financial Services

Fintech & Digital Payments

E-commerce & Marketplaces

Account Opening: Verify customer PAN details during new bank account or demat account opening processes

Loan Processing: Validate borrower identity and PAN authenticity during loan application workflows

Investment Platforms: Ensure compliance for mutual fund investments and trading account setups

Credit Card Issuance: Verify applicant PAN details as part of credit assessment procedures

Technical Implementation

Authentication

All API requests require authentication using a JWT Bearer token. Authentication follows these steps:

Obtain API Credentials: Register with Surepass to receive your API key.

Generate JWT Token: Use your API key to generate a JWT token.

Include in Requests: Add the token to the Authorization header as Bearer {TOKEN}.

Different authentication tokens are used for sandbox and production environments:

Sandbox: https://sandbox.surepass.app

Production: https://kyc-api.surepass.app

Request Parameters

Request Headers

Header	Required	Description
Authorization	Yes	JWT Bearer token for authentication. Format: `Bearer {TOKEN}`
Content-Type	Yes	Must be set to `application/json`

Request Body

Parameter	Type	Required	Description
id_number	string	Yes	Valid PAN card number in the format: 5 letters, 4 digits, 1 letter (e.g., ABCPD1234E)
full_name	string	Yes	Full name of the PAN cardholder as registered with the Income Tax Department
dob	string	Yes	Date of birth of the PAN cardholder in YYYY-MM-DD format (e.g., 2000-01-01)

Example Request

{
    "id_number": "ABCPD1234E",
    "full_name": "Munna Tripathi",
    "dob": "2000-01-01"
}

Process Response

Response Parameters

Parameter	Type	Description
data	object	Contains verified PAN details and verification results
data.client_id	string	Unique identifier for this verification request generated by Surepass
data.pan_number	string	Verified PAN card number returned from the government database
data.full_name	string	Full name of the PAN cardholder as per official records
data.dob	string	Date of birth of the PAN cardholder in YYYY-MM-DD format
status_code	integer	HTTP status code indicating the result of the API call
success	boolean	Indicates whether the verification was successful (true/false)
message	string	Additional message providing context about the response (null if successful)
message_code	string	Code representing the status of the verification (e.g., "success")

Example Successful Response

{
    "data": {
        "client_id": "pan_uczgEGvviRwwpxxzfGDp",
        "pan_number": "ABCPD1234F",
        "full_name": "Munna Tripathi",
        "dob": "2000-01-01"
    },
    "status_code": 200,
    "success": true,
    "message": null,
    "message_code": "success"
}

Possible Error Responses

Invalid PAN Format

Authentication Failed

{
    "data": null,
    "status_code": 400,
    "success": false,
    "message": "Invalid PAN format provided",
    "message_code": "invalid_format"
}

This error occurs when the PAN number doesn't match the required format (5 letters + 4 digits + 1 letter).

Integration Best Practices

Security Recommendations

Secure Token Storage: Never expose JWT tokens in client-side code or public repositories; store them securely in environment variables or secure vaults

HTTPS Only: Always use HTTPS endpoints to encrypt data in transit and prevent man-in-the-middle attacks

Token Rotation: Implement regular token refresh mechanisms and rotate tokens before expiration

Input Validation: Validate and sanitize all input parameters on the client side before making API calls

Error Handling: Avoid exposing sensitive error details to end users; log errors securely for debugging purposes

Data Encryption: Encrypt sensitive PAN data at rest in your database using industry-standard encryption algorithms

User Experience Guidelines

Clear Instructions: Provide clear guidance on PAN format requirements (ABCDE1234F) to reduce user input errors

Real-time Validation: Implement client-side format validation before API submission to improve response time

Loading States: Display appropriate loading indicators during verification to manage user expectations

Error Messaging: Translate API error codes into user-friendly messages that guide users on corrective actions

Privacy Assurance: Inform users about data usage and compliance with privacy regulations to build trust

Retry Mechanism: For transient failures, implement automatic retry logic with exponential backoff to improve success rates

Code Samples

cURL

Python

Node.js

Compliance and Legal Considerations

This API processes PAN card information which is governed by the Income Tax Act, 1961, and regulations set by the Income Tax Department of India. Organizations using this API must:

Comply with KYC regulations as mandated by RBI, SEBI, or other relevant regulatory authorities

Ensure consent is obtained from individuals before verifying their PAN details

Implement appropriate data protection measures as per the Information Technology Act, 2000, and applicable data privacy regulations

Use verified PAN data only for legitimate business purposes and as permitted under law

Maintain audit trails of all verification requests for regulatory compliance and dispute resolution

Not store or share PAN information in violation of data protection and privacy laws

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

curl --location --request POST 'https://kyc-api.surepass.app/api/v1/pan/pan-verify' \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data-raw '{ "id_number": "ABCPD1234E", "full_name": "Munna Tripathi", "dob": "2000-01-01" }'

{ "data": { "client_id": "pan_uczgEGvviRwwpxxzfGDp", "pan_number": "ABCPD1234F", "full_name": "Munna Tripathi", "dob": "2000-01-01" }, "status_code": 200, "success": true, "message": null, "message_code": "success" }

Description#

Use Cases#

Technical Implementation#

Request Headers#

Request Body#

Example Request#

Response Parameters#

Example Successful Response#

Possible Error Responses#

Integration Best Practices#

Code Samples#

Request

Responses