What the verification API checks
The Payonclick verification API checks a document or account against its source record and returns what it found. Every service takes the same request format: post the fields the service lists, plus your own client_reference. You get back a clear verified answer and the record behind it.
| Service | Endpoint | You send | You get back |
|---|---|---|---|
| Bank account (penny drop) | /verify/bank-account |
Account number, IFSC | Account status, name at bank, bank, branch, city, UTR |
| GSTIN | /verify/gstin |
15-character GSTIN, optional business name | Legal and trade name, GST status, taxpayer type, constitution, registration date, principal place of business |
| PAN to GSTIN | /verify/pan-to-gstin |
Business PAN | GSTINs registered against that PAN |
| Vehicle RC | /verify/vehicle-rc |
Registration number | Owner, registration date, RC status and expiry, make and model, fuel type, insurance, PUCC and tax validity, financer, blacklist status |
| Driving licence | /verify/driving-licence |
DL number, date of birth | Licence details, validity, badge details |
| Voter ID (EPIC) | /verify/voter-id |
EPIC number, optional name | Name, age, gender, relative's name, address, state, assembly and parliamentary constituency, polling station |
Not every field is present for every record. The fields that come back depend on what the source holds for that document.
Where businesses use it
Payouts to new accounts
Confirm the account is active and see the name registered at the bank before the first payout, so money does not go to a mistyped account.
B2B onboarding
Check that a supplier's or buyer's GSTIN is active and matches their legal name before you invoice them or extend credit.
Fleet and logistics
Check vehicle RC, insurance, PUCC and road tax validity when you onboard transporters and drivers.
Driver and field staff checks
Match a driving licence to the holder's date of birth before a driver starts work.
Lending
Cross-check a borrower's documents and repayment bank account during loan onboarding.
Marketplaces
Verify a seller's GST registration and list every GSTIN linked to the seller's PAN.
How a verification call works
Read the catalogue
GET /verify/services lists the services enabled for your account, the fields each needs and the charge in force.
Send the fields
POST to the service with its fields and a unique client_reference.
Read the answer
The response carries verified, a status such as VALID, and the record found.
Re-read any time
GET /verify/result/{client_reference} returns a stored result without running the lookup again.
A bank account request looks like this:
{
"client_reference": "VENDOR-2026-000481",
"account_number": "50100123456789",
"ifsc": "HDFC0001234"
}
The response follows the same envelope as every other Payonclick API: success, then a data object with client_reference, service, verified, status, the charge applied, a result object holding the fields listed above, and duplicate.
Input is checked before you are billed
Format mistakes are caught before any lookup is sent, so you do not pay for them:
- IFSC must be 11 characters, for example
HDFC0001234 - GSTIN must be 15 characters and PAN 10 characters, for example
ABCDE1234F - A bank account number must be 6 to 20 digits
- A vehicle number must be 6 to 15 letters and digits with no spaces
- An EPIC number must be 7 to 20 characters and a DL number 8 to 20
- A date of birth must be
YYYY-MM-DD
Such a request is rejected with a clear error that names the field. Errors from the underlying lookup are mapped to the documented codes, INVALID_PARAM or VERIFICATION_FAILED, so your code only has to handle codes listed in the reference.
Billing: what counts as a lookup
You are billed per completed lookup, from your prepaid MAIN wallet:
- Charged: a lookup that reached the record source, including one that comes back
verified: false. An invalid Voter ID is still a completed check. - Not charged: a request rejected before dispatch (bad format, missing field), or a lookup the source could not complete because of an error or timeout.
- Not charged again: resending the same
client_referencereturns the original result withduplicate: true.
The charge for each service is shown by GET /verify/services, and each result states the charge applied.
Keep one client_reference per business action, such as VENDOR-<id>. If your call times out, retry with the same reference. You get the result without a second charge.
Security and data handling
The verification API uses the same security model as our BBPS bill payment API:
- API key as a Bearer token, plus a timestamp accepted within five minutes of server time
- HMAC-SHA256 signature on every POST, computed over the method, full path, timestamp and exact body
- The
verifypermission on the key, an IP whitelist, and a per-key rate limit of 60 requests a minute by default
Results are stored against your client_reference, so they can be read again later for audit.
Verify a person's documents only with their consent and for a clear purpose. India's Digital Personal Data Protection Act, 2023 applies to the personal data these checks return. See our privacy policy for how Payonclick handles data.
Getting access
Register and complete KYC
Create a Payonclick account, finish business KYC and ask our team to enable the verification services you need.
Create an API key
Under Developer, API Keys, grant the verify permission and whitelist your server IP.
Check the catalogue
Call GET /verify/services to see the services and charges enabled for you. This read costs nothing.
Fund and go live
Add balance to your MAIN wallet and start verifying.
There is no sandbox host; keys are issued live. The public API reference has a page for every service, with request samples that compute the signature for you.