What does the PAN Verification API do?
The PAN Verification API lets you verify the validity and details of a Permanent Account Number (PAN) in real time against the Income Tax Department (ITD) database. It confirms whether the PAN exists and is active, and returns details such as the holder's name, date of birth, and Aadhaar seeding status.
This service is provided by Protean eGov Technologies Ltd on the ULI Platform.
Who can use this API?
Lenders onboarded to the ULI Platform who have subscribed to the PAN Verification service on the Dev Portal. Separate subscriptions are required for Sandbox and Production environments.
What are the prerequisites before I can use this API?
Complete all common platform prerequisites (IP whitelisting, URL whitelisting, credentials, service subscription, and JWT token generation) as described in Getting Started with ULI Platform APIs.
In addition, this API requires:
PFX Certificate (required before Production)
You must procure a Class 3 PFX certificate from a CA (e.g., eMudhra) and complete the following steps:
- Share the certificate serial number and a screenshot with Protean for mapping.
- Protean will share a User ID after mapping is complete.
- Share the User ID, PFX certificate, and PFX password with RBIH for upload to Production.
SSL Certificate (required for API v1.4)
- Provide a separate SSL certificate for UAT and Production in
.cerformat, along with your Client ID, to the support team. - From v1.4 onwards, API responses are encrypted using your public key derived from this certificate.
- You must use your SSL private key to decrypt the response. A Java decryption utility will be shared by the support team.
- Production certificate is configured only after successful UAT sign-off.
What are the API endpoints?
| Environment | URL |
|---|---|
| Sandbox | https://extgw.nonprod.rbihub.io/panverification/1.4/en |
| Production | https://extgw.api.rbihub.io/panverification/1.4/en |
Method: POST
Use version 1.3 in the URL for unencrypted responses, or 1.4 for encrypted responses.
What headers do I need to send?
| Header | Description |
|---|---|
Authorization | JWT token from the authentication server |
client-id | Your Client ID (Base64 encoded), provided during registration |
provider | Set to 106 for Protean |
x-sp-userid | Your Protean User ID |
x-sp-record-count | Number of PAN records in the request (typically 1) |
x-sp-version | Set to 4 |
x-env-route | Set to /sb for Sandbox only; omit for Production |
What information do I send in the request body?
The request payload must be AES-256 encrypted (AES/GCM/NoPadding algorithm). The decrypted payload contains:
| Field | Required | Format |
|---|---|---|
pan | Yes | 10-character alphanumeric |
name | Yes | 1–85 characters |
fathername | No | 0–75 characters |
dob | Yes | DD/MM/YYYY |
What does the response contain?
In v1.3, the response data is returned in plain JSON. In v1.4, the data field is encrypted — decrypt it using your SSL private key before reading.
Key response fields:
| Field | What it means |
|---|---|
status | success or fail |
errcode | E000 = success; any other code = error |
pan_status | PAN status from the ITD database (see table below) |
name | Y = name matched; N = not matched |
dob | Y = date of birth matched; N = not matched |
seeding_status | Y = Aadhaar linked (operative); R = inoperative; NA = non-individual PAN |
fathername | For DCT users: Y/N; blank for non-DCT users |
What do the PAN status codes mean?
| Code | Meaning |
|---|---|
E | Existing and Valid |
F | Marked as Fake |
X | Deactivated |
D | Deleted |
N | Not found / Invalid PAN |
EA | Valid — event: Amalgamation |
EC | Valid — event: Acquisition |
ED | Valid — event: Death |
EI | Valid — event: Dissolution |
EL | Valid — event: Liquidated |
EM | Valid — event: Merger |
EP | Valid — event: Partition |
ES | Valid — event: Split |
EU | Valid — event: Under Liquidation |
What do the error codes mean?
Platform error codes:
| Error Code | Meaning |
|---|---|
| E351 | PAN is invalid |
| E352 | PAN marked as fake |
| E353 | PAN marked as deactivated |
| E354 | PAN marked as deleted |
| E355 | PAN not found in ITD database |
| E356–E364 | PAN valid but with an event (Amalgamation, Acquisition, Death, Dissolution, Liquidated, Merger, Partition, Split, Under Liquidation) |
| E365 | PAN is inoperative |
| E366 | Invalid provider User ID |
| E367 | Invalid record count in header |
| E368 | Invalid provider version |
| E043 | Provider-side error — see the info field in the response for the provider error message |
Common provider errors (returned under E043):
| Code | Message |
|---|---|
| 2 | System Error |
| 3 | Authentication Failure |
| 4 | User not authorized |
| 6 | User validity expired |
| 17 | User ID deactivated |
| 22 | PAN number invalid or null |
| 24 | Duplicate Transaction ID |
| 29 | Date of birth format incorrect — must be DD/MM/YYYY |
Who do I contact if the API fails?
Write to support@rbihub.in with the following details:
- Service name:
PAN Verification (Protean / OPV) - Environment: Sandbox or Production
- Provider code:
106 - Full request payload (headers + body)
- Error code and message received
- Screenshot or log of the error
- Status of prerequisites: IP whitelisting, URL whitelisting, service subscription, token generation
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article