PAN Verification API Integration - Complete Developer Guide

April 04, 2026

PAN (Permanent Account Number) verification is a critical component of KYC processes in India. Whether you are building a lending platform, fintech app, or any financial service, verifying PAN details ensures compliance and reduces fraud.

What is PAN Verification API?
Types of PAN Verification
Use Cases
API Integration Guide
Response Format
Compliance Requirements
Best Practices

What is PAN Verification API?

PAN Verification API allows businesses to instantly verify PAN card details against the Income Tax Department database. The API returns information such as:

PAN holder full name
PAN status (Active/Inactive/Fake)
PAN category (Individual/Company/Firm/Trust)
Name match percentage
Aadhaar-PAN linking status

Types of PAN Verification

Basic PAN Verification

Verify PAN format and check if it exists in ITD database. Returns name and status.

PAN with Name Match

Verify PAN and match provided name with ITD records. Returns match percentage.

PAN Comprehensive

Full verification including Aadhaar linking status, category, and detailed info.

Use Cases

Loan Applications: Verify borrower identity before processing
Account Opening: KYC compliance for banks and NBFCs
Vendor Onboarding: Verify business PAN for B2B transactions
Employee Verification: Background checks during hiring
Insurance: Policy issuance and claim processing
GST Registration: Validate PAN before GST filing

API Integration Guide

Authentication

The API uses HMAC-SHA256 signature authentication:

Headers Required:
X-API-Key: your_api_key
X-Timestamp: unix_timestamp
X-Signature: hmac_sha256_signature

PHP Example

<?php
$api_key = "your_api_key";
$api_secret = "your_secret";
$timestamp = time();
$endpoint = "/api/v1/pan/verify";

$body = json_encode([
    "pan" => "ABCDE1234F",
    "name" => "Rahul Kumar",
    "consent" => true
]);

// Generate signature
$signature_string = $timestamp . "POST" . $endpoint . $body;
$signature = hash_hmac("sha256", $signature_string, $api_secret);

$ch = curl_init("https://api.vistarkriya.com" . $endpoint);
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => $body,
    CURLOPT_HTTPHEADER => [
        "Content-Type: application/json",
        "X-API-Key: " . $api_key,
        "X-Timestamp: " . $timestamp,
        "X-Signature: " . $signature
    ]
]);

$response = curl_exec($ch);
$result = json_decode($response, true);
?>

Python Example

import time, hmac, hashlib, json, requests

api_key = "your_api_key"
api_secret = "your_secret"
timestamp = str(int(time.time()))
endpoint = "/api/v1/pan/verify"

body = json.dumps({
    "pan": "ABCDE1234F",
    "name": "Rahul Kumar",
    "consent": True
})

signature_string = timestamp + "POST" + endpoint + body
signature = hmac.new(
    api_secret.encode(),
    signature_string.encode(),
    hashlib.sha256
).hexdigest()

response = requests.post(
    f"https://api.vistarkriya.com{endpoint}",
    headers={
        "Content-Type": "application/json",
        "X-API-Key": api_key,
        "X-Timestamp": timestamp,
        "X-Signature": signature
    },
    data=body
)

API Response Format

Success Response

{
  "success": true,
  "data": {
    "pan": "ABCDE1234F",
    "name": "RAHUL KUMAR",
    "status": "VALID",
    "category": "INDIVIDUAL",
    "name_match": 98,
    "aadhaar_linked": true,
    "last_updated": "2024-01-15"
  }
}

PAN Status Values

Status	Meaning	Action
VALID	PAN exists and is active	Proceed with KYC
INVALID	PAN does not exist	Reject application
INACTIVE	PAN deactivated by ITD	Request updated PAN
FAKE	Fraudulent PAN detected	Flag and report

Compliance Requirements

Important Compliance Points

Consent: Obtain explicit consent before verifying PAN
Data Storage: Do not store PAN details longer than necessary
Audit Trail: Maintain logs of all PAN verifications
Encryption: Encrypt PAN data in transit and at rest
Access Control: Limit PAN access to authorized personnel only

Best Practices

Validate Format First: Check PAN format (AAAAA9999A) before API call
Cache Results: Cache verification results for 24 hours to reduce costs
Handle Errors: Implement proper error handling for API failures
Name Matching: Use fuzzy matching for name verification (threshold 80%+)
Batch Processing: Use bulk API for verifying multiple PANs

PAN Format Validation

Before calling the API, validate PAN format using regex:

// PHP
$pattern = "/^[A-Z]{5}[0-9]{4}[A-Z]{1}$/";
if (preg_match($pattern, $pan)) {
    // Valid format, proceed with API
}

# Python
import re
pattern = r"^[A-Z]{5}[0-9]{4}[A-Z]{1}$"
if re.match(pattern, pan):
    # Valid format, proceed with API

Start Verifying PAN Today

Get API access with sandbox environment for testing.

Get API Access

FAQs

Q: How accurate is PAN verification?

A: The API fetches data directly from ITD database, ensuring 100% accuracy.

Q: What is the response time?

A: Average response time is under 2 seconds.

Q: Can I verify company PAN?

A: Yes, the API supports Individual, Company, Firm, Trust, and other PAN types.

For integration support, contact hello@vistarkriya.com.

Complete Your KYC Stack

Bank Account Verification API

Verify bank accounts instantly

Credit Bureau API

CIBIL, Experian, CRIF, Equifax

DSA

Start DSA Business

Use these APIs in your business

Originally published at: PAN Verification API Integration - Complete Developer Guide

Search This Blog

Vistarkriya