For developers
VIES, without the VIES headaches
One JSON API for EU VAT and EORI numbers, IBANs, sanctions screening and more, with clear errors when a registry is down, caching, webhooks, bulk jobs and a PDF proof for every check.
Sound familiar?
- VIES’s SOAP and REST interfaces, with errors returned inside HTTP 200 responses.
- MS_UNAVAILABLE, MS_MAX_CONCURRENT_REQ and timeouts that are easy to misread as "invalid".
- Country databases that go down at night, and customers who can’t sign up meanwhile.
- Building your own cache, retries, sanctions screening and audit trail on top.
What you get
Honest answers
Valid, invalid, or a 503 saying the registry couldn’t answer: never a false "invalid". Scale can fall back to the last good result during an outage, marked as stale.
More than VAT
EORI (EU and GB), IBAN, sanctions (EU, UN, UK, OFAC), email-domain fraud signals, Peppol, LEI, VAT rates and the reverse charge, all with the same key.
Bulk jobs and webhooks
Submit thousands of numbers as a job; get a signed webhook when it completes, or when a watched VAT number changes status.
Proof built in
Every successful check has a certificateId: download it as a PDF for your customer’s file or your audit trail.
OpenAPI spec
Import it into Postman, Insomnia or your code generator, or hand it to an AI assistant.
Shared with your team
Invite teammates to the same account: one plan, shared keys and a shared check history.
How it works
- Step 1
Get a key
Sign up (Google, GitHub or Microsoft works) and create an API key: 50 requests a month are free, no card.
- Step 2
Call the API
POST JSON with your key in the x-api-key header; quotas come back in X-RateLimit headers.
- Step 3
Handle the answer
Treat 503 as "try later", keep the certificateId, and subscribe to webhooks for changes.
Quick start
curl
curl -X POST https://validitool.com/api/v1/validate \
-H "x-api-key: $VALIDITOOL_API_KEY" \
-H "Content-Type: application/json" \
-d '{"vatNumber":"IE6388047V","companyName":"Google Ireland Limited"}'JavaScript / TypeScript
const res = await fetch('https://validitool.com/api/v1/validate', {
method: 'POST',
headers: { 'x-api-key': process.env.VALIDITOOL_API_KEY, 'Content-Type': 'application/json' },
body: JSON.stringify({ vatNumber: 'IE6388047V' }),
});
if (res.status === 503) { /* registry down for that country: retry later, not "invalid" */ }
const { valid, name, address, certificateId } = await res.json();Python
import os, requests
res = requests.post(
"https://validitool.com/api/v1/validate",
headers={"x-api-key": os.environ["VALIDITOOL_API_KEY"]},
json={"vatNumber": "IE6388047V"},
timeout=30,
)
if res.status_code == 503:
... # registry down for that country: retry later, not "invalid"
data = res.json() # valid, name, address, certificateId, ...Response
{
"source": "live_vies",
"valid": true,
"countryCode": "IE",
"vatNumber": "6388047V",
"name": "GOOGLE IRELAND LIMITED",
"address": "3RD FLOOR, GORDON HOUSE, BARROW STREET, DUBLIN 4",
"consultationNumber": null,
"validatedAt": "2026-10-06T09:00:00.000Z",
"stale": false,
"nameCheck": {
"result": "match",
"givenName": "Google Ireland Limited",
"registeredName": "GOOGLE IRELAND LIMITED",
"source": "VAT register"
},
"certificateId": "8b1d4f2e-6c3a-4e9b-9f7d-2a5c8e1b3d6f"
}Machine-readable spec: validitool.com/openapi.json (OpenAPI 3.1). Full reference: API docs.
Which plan fits
Free: 50 requests a month. Starter from $9/month for 2,000; higher plans add bulk jobs, more monitoring and the outage fallback. Every check, a bulk item or a compliance check, counts as one request.
Questions
- Is it just a wrapper around VIES?
- The VAT answer comes from VIES, live or from a 24-hour cache. Around it: proper error handling, sanctions screening, name matching, certificates, monitoring, webhooks and bulk jobs.
- What are the rate limits?
- A monthly quota per plan; the remaining quota is in the X-RateLimit-Remaining header of every response.
- Where is the data processed?
- Validitool runs on Cloudflare and Supabase; see the Privacy Policy for details.