castomAPI
Get your key
POST /v1/verify/iban free No key needed Verify

Validate IBAN format, calculate MOD-97 check digits

Validate IBAN format, calculate MOD-97 check digits, identify country, SEPA participation, bank metadata, and SWIFT/BIC code

POST

Request

  • x-api-key: <your-api-key>
  • Content-Type: application/json

Response

{
  "status": "success",
  "isValid": true,
  "validationResult": {
    "isFormatValid": true,
    "isLengthValid": true,
    "isChecksumValid": true,
    "reason": "MOD-97 remainder is 1"
  },
  "ibanDetails": {
    "rawInput": "PL61 1090 1014 0000 0712 1981 2874",
    "normalized": "PL61109010140000071219812874",
    "formattedPrint": "PL61 1090 1014 0000 0712 1981 2874",
    "countryCode": "PL",
    "countryName": "Poland",
    "checkDigits": "61",
    "bban": "109010140000071219812874",
    "isSEPA": true
  },
  "bankDetails": {
    "bankCode": "10901014",
    "bankName": "Santander Bank Polska",
    "swiftBic": "WBKPPLPP",
    "isRecognized": true
  },
  "tokensDeducted": 1
}
The response below is a mock built from the endpoint's own schema — no request leaves this page. Edit the body, press Send, read the shape you will get back. Run it for real in the dashboard →

What it does

Send an IBAN in any spacing; the endpoint normalises it, checks the length for the country, verifies the MOD-97 check digits, tells you whether the country is in SEPA, and — where the national bank code is recognised — names the bank and its BIC. A malformed IBAN answers a 400 and costs nothing; a well-formed one that fails the checksum answers 200 with isValid false, because that is an answer.

When to use it

Before saving a bank account on a customer, a supplier or a payout form; before issuing a refund; in a KYC flow beside VAT and phone verification.

Request

Body

FieldTypeRequiredDescription
ibanstringyesThe IBAN string to validate (spaces allowed)

Example request

{
  "iban": "PL61 1090 1014 0000 0712 1981 2874"
}

Response

FieldTypeDescription
bankDetailsobject
  ↳ bankCodestring
  ↳ bankNamestring
  ↳ isRecognizedboolean
  ↳ swiftBicstring
ibanDetailsobject
  ↳ bbanstring
  ↳ checkDigitsstring
  ↳ countryCodestring
  ↳ countryNamestring
  ↳ formattedPrintstring
  ↳ isSEPAboolean
  ↳ normalizedstring
  ↳ rawInputstring
isValidboolean
statusstring
tokensDeductedinteger
validationResultobject
  ↳ isChecksumValidboolean
  ↳ isFormatValidboolean
  ↳ isLengthValidboolean
  ↳ reasonstring

Example response

{
  "status": "success",
  "isValid": true,
  "validationResult": {
    "isFormatValid": true,
    "isLengthValid": true,
    "isChecksumValid": true,
    "reason": "MOD-97 remainder is 1"
  },
  "ibanDetails": {
    "rawInput": "PL61 1090 1014 0000 0712 1981 2874",
    "normalized": "PL61109010140000071219812874",
    "formattedPrint": "PL61 1090 1014 0000 0712 1981 2874",
    "countryCode": "PL",
    "countryName": "Poland",
    "checkDigits": "61",
    "bban": "109010140000071219812874",
    "isSEPA": true
  },
  "bankDetails": {
    "bankCode": "10901014",
    "bankName": "Santander Bank Polska",
    "swiftBic": "WBKPPLPP",
    "isRecognized": true
  },
  "tokensDeducted": 1
}

Errors

Every error answers with the same envelope: an HTTP status, a machine code and a sentence.

400The body or a parameter failed validation. The details array names the field.
401No key, a revoked key or a wrong header. Send x-api-key.
402The wallet cannot cover this call. Top up or wait for the monthly grant.
404The resource does not exist, or it is not yours. Both answer identically and cost nothing.
429Over the per-minute quota of your tier. Back off and retry.
5xxUpstream refused or timed out. The call is not billed.

Code

curl -X POST 'https://app.castomapi.com/v1/verify/iban' \
  -H 'x-api-key: <your-api-key>' \
  -H 'Content-Type: application/json' \
  -d '{"iban": "PL61 1090 1014 0000 0712 1981 2874"}'
const res = await fetch('https://app.castomapi.com/v1/verify/iban', {
  method: 'POST',
  headers: { 'x-api-key': '<your-api-key>', 'Content-Type': 'application/json' },
  body: JSON.stringify({"iban": "PL61 1090 1014 0000 0712 1981 2874"})
});
const data = await res.json();
console.log(data);
import { request } from 'node:https';

// Node 18+ has fetch built in
const res = await fetch('https://app.castomapi.com/v1/verify/iban', {
  method: 'POST',
  headers: { 'x-api-key': '<your-api-key>', 'Content-Type': 'application/json' },
  body: JSON.stringify({"iban": "PL61 1090 1014 0000 0712 1981 2874"})
});
const data = await res.json();
console.log(data);
import requests

res = requests.post(
    'https://app.castomapi.com/v1/verify/iban',
    headers={'x-api-key': '<your-api-key>'},
    json={"iban": "PL61 1090 1014 0000 0712 1981 2874"},
    timeout=30,
)
print(res.json())
<?php
$ch = curl_init('https://app.castomapi.com/v1/verify/iban');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['x-api-key: <your-api-key>', 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode(['iban' => 'PL61 1090 1014 0000 0712 1981 2874']),
]);
$data = json_decode(curl_exec($ch), true);
print_r($data);

Cost and limits

This operation needs no API key and costs nothing: called without a key it answers 200 and deducts zero tokens, up to 10 requests a minute per IP address.

Rate limits per minute

No key10
Free60
Pro300
Enterprise1200

Docs → Pricing

Questions

What does Validate IBAN format, calculate MOD-97 check digits cost?

This operation needs no API key and costs nothing: called without a key it answers 200 and deducts zero tokens, up to 10 requests a minute per IP address.

How do I authenticate?

Send your key in the x-api-key header. One key covers every metered endpoint; there is nothing to enable per endpoint.

Can I send an Authorization: Bearer token instead?

Not for a metered endpoint — those take the x-api-key header and nothing else. Bearer tokens belong to the account side: the dashboard and account APIs accept a JWT session, and castomapi-auth issues those through a standard OAuth2 handshake, with authorization code, client credentials and refresh grants. The auth service page covers it.

What are the limits?

10 requests a minute per IP with no key at all, 60 a minute on the free tier, 300 on Pro, 1200 on Enterprise. Above the no-key tier the quota is per account, across every endpoint.

OpenAPI: https://app.castomapi.com/docs/json