Free Validation API Endpoint

Call the free validation API endpoint

curl -X POST https://aisenseapi.com/services/v1/validate/iban \
  -H "Content-Type: application/json" \
  -d '{"data": "NO9386011117947"}'

{ "type": "iban", "valid": true, "normalized": "NO9386011117947",
  "country": "NO", "structure_ok": true, "length_ok": true, "checksum_ok": true }

Two details carry the whole design. The path carries the type. The body carries one field named data. Nothing else is required, and there is no header beyond the content type.

Spacing and punctuation in the input do not matter. Send a card number with spaces or a kontonummer with dots, and the service strips them before it counts.

The five supported types

Each type runs its own arithmetic. Pick the one that matches the value you hold.

Any other value in the path is a mistake rather than a guess, and the service says so plainly.

Response fields

Every reply names the type it ran and carries a boolean valid. The remaining fields depend on the type, and they exist so you can see which stage failed.

What a check digit proves

A check digit is arithmetic baked into the number itself. IBAN uses mod-97. Norwegian organisasjonsnummer and kontonummer use MOD11 with fixed weights. Payment cards use Luhn. In every case one digit is derived from all the others.

So a passing result means the digits agree among themselves. The value survived a retype, a phone call, or a scan without a single character drifting. Transposed digits are the classic failure these schemes were built to catch, and they catch nearly all of them.

It does not mean the account exists. The card may be cancelled, the company may be dissolved, the phone may never ring. The free validation API endpoint never leaves our server to look anything up, so read a true as permission to continue rather than as proof of anything real.

That distinction matters most at signup. Reject a mistyped organisasjonsnummer immediately, then confirm the live company against a register later, when a slower call is affordable.

How failures look

Change the last digit of that IBAN and the answer keeps the same shape. A bad value is a result, not an error.

# IBAN with the final digit changed
{"type":"iban","valid":false,"normalized":"NO9386011117948","country":"NO",
 "structure_ok":true,"length_ok":true,"checksum_ok":false}

# Card that fails Luhn
{"type":"card","valid":false,"length":16,"format_ok":true,"luhn_ok":false}

Notice which flag flipped. Structure and length still passed on the IBAN, so the caller knows the value was mistyped rather than malformed.

Only a broken request raises a real error. An unknown type or an empty body returns HTTP 400 with a short message.

POST /validate/vatnr  {"data": "123"}
{"error":"Unknown validation type. Known types: iban, card, orgnr, kontonummer, phone"}

POST /validate/iban   {}
{"error":"No data to validate."}

Where to run the check

Run it as close to the input as you can. A web form can call the service when a field loses focus and mark the field before the user reaches the submit button. An importer can call it once per row and write the failing rows to a separate file for a person to read.

An agent should call it after pulling a number out of a document and before handing that number to anything that moves money. The reply is small, so the round trip costs almost nothing next to the mistake it prevents.

One request handles one value. There is no batch mode, so a large import means a loop, and the daily budget is the ceiling on that loop. Repeating a call is safe, because the check is pure arithmetic and holds no state between requests.

Common uses

Privacy and limits

The service-wide limit is 5000 requests per IP per 24 hours. Calls to the free validation API endpoint draw on the same budget as every other service on the base URL https://aisenseapi.com/services/v1.

Related endpoints

Syntax checking pairs well with the rest of the collection. The email validation API endpoint handles addresses, where an MX lookup adds a second layer that check digits cannot. The ping API endpoint is the quickest way to confirm your client reaches us at all. For a place to park a batch of results between steps, reach for the storage API endpoint. The full catalogue lives on the free public REST APIs hub.