Endpoint
| Method | GET |
| URL | https://ibancodecheck.com/api/iban/{iban} |
| Auth | None, no API key required |
| Rate limit | 500 requests / day / IP (see X-RateLimit-Remaining header) |
| CORS | Access-Control-Allow-Origin: * |
| Privacy | IBANs are never stored or logged; responses are no-store |
Example Request
| curl | curl https://ibancodecheck.com/api/iban/DE89370400440532013000 |
| JavaScript | const r = await fetch('https://ibancodecheck.com/api/iban/DE89370400440532013000').then(r => r.json()); |
| PHP | $r = json_decode(file_get_contents('https://ibancodecheck.com/api/iban/DE89370400440532013000'), true); |
| Python | r = requests.get('https://ibancodecheck.com/api/iban/DE89370400440532013000').json() |
Response Fields
| Field | Type | Description |
|---|---|---|
data.valid | boolean | Overall verdict: format, length, and checksum all pass |
data.iban / data.formatted | string | Normalized and print-formatted (groups of 4) versions |
data.country_code / data.country | string | ISO country of the IBAN |
data.sepa | boolean | Whether the country participates in SEPA |
data.length_ok / data.checksum_ok | boolean | Individual check results for precise error messages |
data.check_digits | string | Positions 3 and 4 |
data.bank_code | string | Domestic bank code, where the position is defined for the country |
data.error | string|null | Human-readable reason when invalid |
Errors use standard status codes: 400 for input that is not IBAN-shaped at all, 429 when the daily limit is reached. Structurally wrong IBANs still return 200 with valid: false and the reason, so your form can show a helpful message.
Tip: Validate Client-Side First
The mod-97 algorithm is simple enough to run in the browser (our own checker does exactly that). A common pattern: validate client-side for instant feedback, then re-validate server-side via this API before accepting the form.
Frequently Asked Questions
Is the API really free?
Yes. No key, no registration, up to 500 requests/day per IP, CORS enabled.
Are IBANs stored?
No. Validation is purely algorithmic and IBANs are never written to disk or logged.
Can I test it right now?
Try /api/iban/DE89370400440532013000 in your browser (the published ISO sample for Germany).