ForHosting KIT · Validation

Check an EU VAT number

The VAT Validation API takes an EU VAT number and checks that it is well-formed: a recognised EU country prefix followed by a character pattern consistent with a VAT number.

● StablePer request + per item$0.002

Run — $0.002 How it works & API

Use it from WebAPIEmailTelegramApp soon

Run it online

Run this on our servers with your account. Free tools run in your browser; this one bills your KIT balance per the price above.

It matters for one specific reason — charging or exempting VAT on a B2B invoice on the strength of a mistyped or fabricated number is a compliance problem, and this catches the malformed ones before the invoice goes out. It validates the shape of the number; it does not confirm the business behind it is registered — that live confirmation is a separate step against the EU's official VIES lookup.

Why a format check catches real errors

A VAT number can be mistyped, missing a digit, given the wrong country prefix, or simply invented — and every one of those is a malformed string that a structural check catches instantly, before it ever reaches your tax logic. The vat number validation api validates that the number carries a recognised EU country prefix and a character pattern consistent with that scheme, and returns a clear valid-or-invalid answer along with the country code it parsed from the prefix. It is the cheap first gate: a number that fails here is definitely wrong, and one that passes is well-formed and worth checking further.

What a format check can and can't tell you

A passing format check means the number is shaped like a real VAT number — right prefix, plausible length and characters. What it does not tell you is whether that number is actually registered to a live business: a perfectly well-formed number can belong to no one, because the business deregistered or because it was fabricated specifically to pass a shape check. Confirming a live registration is done against VIES, the European Commission's official system that queries each member state's own tax database — a separate step this endpoint deliberately does not perform, which is exactly what keeps it fast and cheap enough to run on every submission.

Who this protects

Any business selling B2B across EU borders needs a valid VAT number from the buyer to apply the reverse-charge mechanism and zero-rate the invoice; get that wrong and the seller can end up liable for VAT it never collected. Catching a malformed number at the point of entry stops the cheapest class of error before it propagates: accounting platforms validate the format before an invoice is generated, marketplaces gate business-buyer registration on a passing format check, and finance teams screen stored numbers for obvious corruption — and each of those flags which numbers still warrant a live VIES confirmation.

How the request behaves

Send POST /verify/vat with the VAT number and you get a task_id back immediately. The check reports whether the number is well-formed and the country code it parsed, delivered by webhook or a signed link valid for 24 hours, so your integration never stalls waiting on it. A task that fails after three retries returns a clear error and is never billed, and the result is structured JSON ready to drop straight into invoicing or onboarding logic.

Where it sits in an invoicing pipeline

Because results are structured JSON, this drops cleanly into invoice-generation logic: validate the buyer's VAT number format before deciding whether to apply the reverse charge, and route the well-formed ones on to a VIES confirmation; block registration on a B2B storefront until a number is at least correctly shaped; or run a scheduled sweep across stored customer VAT numbers to catch corrupted or malformed entries. Access needs prepaid balance, which keeps the service fast and free of abuse, and each check is a flat published $0.002 with no invented credits.

What you can do with it

Cross-border invoice validation

An accounting platform validates a customer's VAT number format before issuing a B2B invoice, rejecting mistyped or malformed numbers up front and flagging the well-formed ones for a live VIES check.

B2B marketplace onboarding

A wholesale marketplace requires a passing format check before approving a new business buyer account, filtering out malformed or fabricated registration numbers automatically.

Periodic customer re-verification

A finance team screens its stored VAT numbers each quarter for corrupted or malformed entries before the next invoice relies on them.

Checkout-time input validation

An e-commerce checkout validates a business customer's VAT number format in real time to catch a typo before the order total is calculated.

FAQ

How do I validate an EU VAT number format with an API?

Send POST /verify/vat with the number. The vat number validation api returns a task_id immediately and delivers the format result and parsed country code to your webhook or a signed link once the check completes.

Does this confirm the business is registered?

No. This validates the format only — the country prefix and the character pattern. Confirming that a number is registered to a live business is a separate step against VIES, the European Commission's official VAT lookup, which this endpoint does not query.

Is VAT format validation free?

There's no free tier — free tiers get abused and slow everyone down. Access runs on a prepaid ForHosting KIT balance: top up from $10.00 (it never expires) and each request is charged at its published price, so a call with no balance returns HTTP 402. No subscription, no tokens, no invented credits, and a failed task is never charged.

Which countries does this cover?

All EU member state VAT number formats, identified by the two-letter country prefix. A number from a non-EU country, including a UK VAT number, is outside this scheme and returns as not applicable.

Can I validate many VAT numbers in bulk?

Yes. Submit each number as its own POST and the tasks run in parallel; every request is billed independently and a failed task is retried and never charged.

Why would a well-formed number still be wrong?

Because a format check only proves the number is shaped correctly, not that it is registered. A well-formed number can belong to no one, which is exactly why a passing format check should be followed by a VIES confirmation for any number you rely on.

How are results delivered?

Either a signed webhook posted to your server the moment the check finishes, which we recommend, or a signed link valid for 24 hours you can fetch on your own schedule.

Is the VAT number kept after the check?

No. The submitted number and its result are deleted once the retention window closes and are never used for training; delivery links are signed and expire.

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/verify/vat

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/verify/vat \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"vat":"ESB12345678"}'

const res = await fetch("https://api.kit.forhosting.com/verify/vat", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "vat": "ESB12345678"
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/verify/vat",
    headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
    json={
    "vat": "ESB12345678"
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/verify/vat", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => '{"vat":"ESB12345678"}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"vat":"ESB12345678"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/verify/vat", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "vat": "ESB12345678"
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "verify.vat",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Read the full KIT documentation →