VAT Validation API

Part of the VAT Suite service. One request checks a VAT number: first its form (country prefix, length, structure and check digits), then its registration with the national VAT registry of the country, and returns whether the number is currently registered together with the registered name and address. All EU member states, Northern Ireland, the United Kingdom and Norway.

Endpoint

• HTTPS only. POST bodies are application/x-www-form-urlencoded; GET takes the same parameters in the query string. Both methods return the same response. JSON request bodies are not read (result code 306).
• Responses are JSON, Content-Type: application/json, with non-ASCII characters escaped; the 429 and 500 cases below are the exceptions (HTML and empty bodies). There is no format parameter; one sent is ignored.
• The HTTP status tells the kind of outcome: 200 the number is well-formed and the registry answered (the outcome is in active); 422 the number failed a format check, with the same body structure and result code 601–604; 400 a parameter is missing (306, 307); 403 an account problem (301–305); 429 when the rate limit is exceeded; 503 when the national registry does not answer.
• Response times depend on the registry: most answers take 0.1–0.5 s, but some registries are slow (longest recorded per country: DK 15.2 s, CZ 9.4 s, LV 8.7 s, FR 5.0 s, BE 4.0 s, IT 3.0 s, NL 1.6 s, DE 1.4 s). Allow at least 30 s before timing out.

Your first request

1. Copy your key from API Access.
2. Run, with the key in place of YOUR_API_KEY:

curl "https://api.bav.com/validate/" -d api_key=YOUR_API_KEY -d vat=FR64443061841

The full response to this request is in the Response section; the same request in six more languages is under Example request.

Keeping the key safe

• Use POST in production. With GET the key is part of the URL and ends up in proxy, load-balancer and web-server access logs; with POST it travels in the request body.
• Call the API from your server. A key embedded in browser JavaScript or a mobile app can be read from the source or the network traffic.
• Restrict the key to the IP addresses of your servers under Settings; requests from anywhere else are refused.
• Keep the key out of source control; load it from an environment variable or a configuration file. A key cannot be regenerated from the client area: if it is exposed, contact support to have it replaced.

Request parameters

Two parameters; anything else is ignored.

Example request

Every example checks the same number, FR64443061841 (Google France); its response is shown in the next section. Replace YOUR_API_KEY with the key from API Access. Each sample sets a 30-second timeout, because a slow registry can take more than ten seconds to answer.

curl "https://api.bav.com/validate/" --max-time 30 \
  -d api_key=YOUR_API_KEY \
  -d vat=FR64443061841

<?php
$ch = curl_init('https://api.bav.com/validate/');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT        => 30,
    CURLOPT_POSTFIELDS     => http_build_query([
        'api_key' => 'YOUR_API_KEY',
        'vat'     => 'FR64443061841',
    ]),
]);
$result = json_decode(curl_exec($ch), true);   // the whole response as an array
curl_close($ch);

echo json_encode($result, JSON_PRETTY_PRINT), PHP_EOL;

import json
import requests

r = requests.post('https://api.bav.com/validate/', data={
    'api_key': 'YOUR_API_KEY',
    'vat': 'FR64443061841',
}, timeout=30)
result = r.json()   # the whole response as a dict
print(json.dumps(result, indent=3))

const body = new URLSearchParams({
  api_key: 'YOUR_API_KEY',
  vat: 'FR64443061841',
});

fetch('https://api.bav.com/validate/', { method: 'POST', body, signal: AbortSignal.timeout(30000) })
  .then(res => res.json())
  .then(result => console.log(JSON.stringify(result, null, 3)));   // result: the whole response as an object

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.time.Duration;

public class VatApi {
    public static void main(String[] args) throws Exception {
        String body = "api_key=YOUR_API_KEY&vat=FR64443061841";
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.bav.com/validate/"))
            .timeout(Duration.ofSeconds(30))
            .header("Content-Type", "application/x-www-form-urlencoded")
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());   // the whole JSON response; parse it with Jackson or Gson
    }
}

using System;
using System.Collections.Generic;
using System.Net.Http;
using System.Text.Json;
using System.Text.Json.Nodes;

var client = new HttpClient { Timeout = TimeSpan.FromSeconds(30) };
var form = new FormUrlEncodedContent(new Dictionary<string, string>
{
    ["api_key"] = "YOUR_API_KEY",
    ["vat"]     = "FR64443061841",
});
var response = await client.PostAsync("https://api.bav.com/validate/", form);
var result = JsonNode.Parse(await response.Content.ReadAsStringAsync());   // the whole response
Console.WriteLine(result?.ToJsonString(new JsonSerializerOptions { WriteIndented = true }));

package main

import (
	"encoding/json"
	"fmt"
	"net/http"
	"net/url"
	"time"
)

func main() {
	form := url.Values{
		"api_key": {"YOUR_API_KEY"},
		"vat":     {"FR64443061841"},
	}
	client := &http.Client{Timeout: 30 * time.Second}
	resp, err := client.PostForm("https://api.bav.com/validate/", form)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	var result map[string]any // the whole response
	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
		panic(err)
	}
	out, _ := json.MarshalIndent(result, "", "   ")
	fmt.Println(string(out))
}

Response

Five members in this order: query, valid, active, registration_data and error. The API sends the body indented with four spaces and with non-ASCII characters as \uXXXX escapes; the examples on this page are re-indented and decoded. The response to the example request:

{
   "query": {
      "vat": "FR64443061841",
      "status": "completed",
      "request_time": "2026-10-09 07:46:39"
   },
   "valid": true,
   "active": true,
   "registration_data": {
      "name": "EURL GOOGLE FRANCE",
      "address": "8 RUE DE LONDRES",
      "city": "PARIS",
      "zip": "75009",
      "country_iso": "FR",
      "country_name": "France"
   },
   "error": {}
}

registration_data

Cleaned input

BE 0567.647.463 sent as the vat parameter: the number is checked and echoed as BE0567647463. BE0567-647-463 gives the same response; fr 64 443 061 841 is echoed as FR64443061841:

{
   "query": {
      "vat": "BE0567647463",
      "status": "completed",
      "request_time": "2026-10-09 07:46:40"
   },
   "valid": true,
   "active": true,
   "registration_data": {
      "name": "BVBA Waowdeals.be",
      "address": "Uitbreidingstraat 84",
      "city": "Antwerpen",
      "zip": "2600",
      "country_iso": "BE",
      "country_name": "Belgium"
   },
   "error": {}
}

Well-formed but not registered

A number that passes the format and check-digit tests but is not a current VAT registration: HTTP 200, valid true, active false, registration_data empty. A company number that is not a VAT number (an Italian codice fiscale, for instance) is answered the same way:

{
   "query": {
      "vat": "GB999999973",
      "status": "completed",
      "request_time": "2026-10-09 07:59:38"
   },
   "valid": true,
   "active": false,
   "registration_data": {},
   "error": {}
}

Greece

Sent with the EL prefix; the name comes back in Greek letters (escaped as \uXXXX in the raw JSON) and country_iso is GR:

{
   "query": {
      "vat": "EL094014201",
      "status": "completed",
      "request_time": "2026-10-09 07:47:12"
   },
   "valid": true,
   "active": true,
   "registration_data": {
      "name": "ΤΡΑΠΕΖΑ ΕΘΝΙΚΗ ΤΗΣ ΕΛΛΑΔΟΣ ΑΝΩΝΥΜΗ ΕΤΑΙΡΕΙΑ",
      "address": "eolou 86",
      "city": "athina",
      "zip": "10559",
      "country_iso": "GR",
      "country_name": "Greece"
   },
   "error": {}
}

Northern Ireland

A UK number sent with the XI prefix. The registry delivers the whole address in one field, here zip, and country_iso is GB:

{
   "query": {
      "vat": "XI220430231",
      "status": "completed",
      "request_time": "2026-10-09 07:47:15"
   },
   "valid": true,
   "active": true,
   "registration_data": {
      "name": "TESCO PLC",
      "address": "",
      "city": "",
      "zip": "CIRRUS A SHIRE PARK KESTREL WAY WELWYN GARDEN CITY   AL7 1GA",
      "country_iso": "GB",
      "country_name": "United Kingdom"
   },
   "error": {}
}

Format failure

HTTP 422 with the full structure; here a wrong check digit (604). Note that error.code is a number and the message is in text:

{
   "query": {
      "vat": "FR64443061842",
      "status": "completed",
      "request_time": "2026-10-09 07:46:32"
   },
   "valid": false,
   "active": false,
   "registration_data": {},
   "error": {
      "code": 604,
      "text": "Invalid VAT format, length, structure or check digit."
   }
}

Greece sent as GR, result code 602:

{
   "query": {
      "vat": "GR094014201",
      "status": "completed",
      "request_time": "2026-10-09 07:47:13"
   },
   "valid": false,
   "active": false,
   "registration_data": {},
   "error": {
      "code": 602,
      "text": "Country code not supported."
   }
}

Request and account errors

HTTP 400 and 403 responses carry only error, with code as a string and the message in message. A missing vat parameter:

{
   "error": {
      "code": "307",
      "message": "Bad Request: Missing 'vat' parameter value"
   }
}

A wrong key (HTTP 403):

{
   "error": {
      "code": "301",
      "message": "API Key is invalid"
   }
}

Result codes

The code is in error.code. 6xx codes describe the number and come with HTTP 422, where the code is a number and the text is in error.text. 3xx codes describe the request or the account and come with HTTP 400 or 403, where the code is a string and the text is in error.message. Read the code with a parser that accepts both types.

Number

Request and account

No lookup is performed and no query is used. 301, 306 and 307 were recorded; 302 to 305 follow the same path with their own message.

Other responses

Handling errors

What each outcome means for your code. The format checks are deterministic; the registration status is not, so do not cache active for long — a registration can be cancelled at any time, and tax authorities expect a check at the time of each supply.

Reading the result

• Decide on active. valid true only says the number is well-formed; a number that is not registered can be well-formed too (HTTP 200, active false).
• Decide on the body, not on the HTTP status alone: 200 and 422 both carry the full structure, and a 422 is a final answer about the number, not a request error.
• Keep the evidence. For a reverse-charge supply store the number as checked (query.vat), request_time, active and the registered name and address with the transaction.
• Compare the registered name with your customer’s name yourself; the API does not. Expect legal forms and spelling to differ from the trading name (EURL GOOGLE FRANCE, Telefonica sa).
• Registration data is passed through as the registry delivers it: upper case in some countries, mixed case in others; the whole address in one field in Romania and Northern Ireland; a Greek name in Greek letters.
• Send the prefix with the number: EL for Greece, XI for Northern Ireland, GB for the rest of the United Kingdom. Spaces, full stops, hyphens and lower case are fine; any other character gives 601.
• Each check uses one query whether the number is registered or not, including a number refused with 601–604, so check the prefix and the length on your side before sending.

Supported countries

The 27 EU member states, Northern Ireland, the United Kingdom and Norway. 29 of the 30 prefixes were looked up successfully during recording (marked); the format column is the one published by the national registries. A prefix outside this list is refused with result code 602 (recorded for AU, US and XX); Switzerland is the exception, see below.

Switzerland is not available: the prefix is recognised, but a Swiss number in any spelling (CHE-116.281.710, with or without MWST, CH116281710) is refused with 604.

Checking your balance

The services endpoint returns every service on your account with its remaining queries and expiry date, the same information as My Services. Poll it from your monitoring to catch a low balance before the API starts answering 303. It takes your api_key and a format (json or xml) and does not use a query.

The response, shortened to the entry of this service (the endpoint lists every service on your account, one object each):

{
   "services": [
      {
         "service_name": "VAT Suite (2,000)",
         "credits": 1968,
         "expiry_date": "2027-10-09",
         "service_expired": 0
      }
   ],
   "errors": []
}

<?xml version="1.0"?>
<result>
   <services>
      <service>
         <service_name>VAT Suite (2,000)</service_name>
         <credits>1968</credits>
         <expiry_date>2027-10-09</expiry_date>
         <service_expired>0</service_expired>
      </service>
   </services>
   <errors/>
</result>

The HTTP status is 200 in every case. With a wrong key, services is empty and errors carries code 301 ({"services":[],"errors":[{"code":"301","message":"API Key is invalid"}]}); without format the body is empty.

Rate limits and queries

• The shared API accepts up to 20 requests per second. Beyond that, requests are rejected with HTTP 429 Too Many Requests and a small HTML body; a rejected request never reaches the API and is not charged. Acceptance resumes as soon as your rate drops below the limit, so wait a moment and resend; keep the sending rate at or below 20 per second with a queue or a token bucket. If several processes send requests, apply the limit to their total.
• Each processed check uses one query from your VAT Suite balance, whatever the outcome (HTTP 200 or 422). Requests refused with 400, 403, 429 or 500 use none; neither does a registry that does not answer (503). Your balance and expiry date are shown under My Services and by the services endpoint.
• Need more throughput? A dedicated API server is available for your account with no per-second limit, on its own hostname. Contact support with your expected volume.

Glossary