Real-Time GST Verification API for B2B Lenders & Fintechs
Enterprise real-time GST verification API for Indian fintechs and B2B lenders. Instant GSTIN authentication, GSTR-3B active return filing track record, and DPDP compliance.
1. Statutory Framework & Technical Architecture
In Indian business-to-business commerce and digital lending, validating corporate identity requires more than passive document OCR. Under the Central Goods and Services Tax (CGST) Act, 2017, every taxable person crossing prescribed annual aggregate turnover thresholds must obtain a 15-character Goods and Services Tax Identification Number (GSTIN).
For digital lenders, supply chain financiers, and enterprise procurement platforms, GST verification serves three foundational requirements:
- Legal Entity & Trade Authenticity: Validating that the business is actively registered with the Central Board of Indirect Taxes and Customs (CBIC) and state tax authorities, linking the PAN to the exact operational location.
- Operational Cash-Flow Health via GSTR-3B: Verifying that the entity actively reports sales and discharges tax liabilities monthly or quarterly rather than holding a dormant or dummy shell registration.
- Input Tax Credit (ITC) Protection: Confirming that vendor invoices will allow compliant ITC claim under Section 16(2)(aa) of the CGST Act without triggering statutory reversal demands.
2. Specifications: 15-Digit GSTIN Regex & Structural Decomposition
The GSTIN is a structured 15-character alphanumeric code. Every character index encodes vital business metadata according to national tax standards. The formal validation regex enforced at our edge gateway is:
| Digit Position | Component | Technical Specification | Example |
|---|---|---|---|
| 1 – 2 | State Code | 2-digit standard state/UT identifier assigned under the 2011 Indian Census (01–38). | 27 (Maharashtra) |
| 3 – 12 | PAN of Entity | 10-character Permanent Account Number of the business or sole proprietor (5 letters, 4 digits, 1 letter). | AAACB2894G |
| 13 | Entity Number | Alphanumeric registration index within the state under the same PAN (1 through 9, then A through Z). | 1 (1st Registration) |
| 14 | Default Alphabet | Reserved constant character by statute for future indirect tax expansions. | Z |
| 15 | Checksum Digit | Calculated check character computed across first 14 characters using Luhn Mod-36 algorithm. | N |
Taxpayer Types, Filing Cadence & Status Matrix
The API parses and returns critical taxpayer classifications that dictate tax pass-through, invoicing compliance, and underwriting limits:
| Taxpayer Type | Filing Cadence | Input Tax Credit (ITC) Rules | Underwriting Risk Profile |
|---|---|---|---|
| Regular | Monthly / QRMP (GSTR-1 & GSTR-3B) | Full ITC claims allowed on inward supplies. | Standard Enterprise Grade |
| Composition | Quarterly CMP-08, Annual GSTR-4 | Cannot issue tax invoices or pass ITC to buyers. | Micro / Small Trader (< ₹1.5 Cr) |
| SEZ Unit / Developer | Monthly (GSTR-1 & GSTR-3B) | Zero-rated interstate supplies with LUT or IGST refund. | Export-Oriented Enterprise |
| Input Service Dist (ISD) | Monthly (GSTR-6) | Distributes ITC from corporate headquarters to branches. | Multi-State Corporate Entity |
| Operational Status | Technical Cause | Actionable System Outcome | Billing Policy |
|---|---|---|---|
| ACTIVE | Valid taxpayer in good standing with active portal filings. | Proceed with vendor onboarding and credit underwriting. | Standard Charge |
| SUSPENDED | Rule 21A trigger due to continuous non-filing or GSTR-1 vs 3B mismatch. | Halt loan disbursement; flag credit risk; pause vendor payouts. | Standard Charge |
| CANCELLED | Voluntary surrender or Suo Motu cancellation by GST tax officer. | Block transaction; reject invoice; invalidate ITC claims. | Standard Charge |
| GATEWAY_TIMEOUT | Government GSTN node latency exceeds failover timeout SLA. | Retry automatically via secondary GSP route; zero penalty. | ₹0 (Free / No Charge) |
3. Enterprise B2B Features & Fraud Prevention
A. Fake Invoicing & Shell Company Detection
The Directorate General of GST Intelligence (DGGI) routinely uncovers multi-crore circular trading rings involving dummy entities created solely to pass fraudulent Input Tax Credit without supplying physical goods. ASP Associates provides automated structural heuristics to catch these actors early:
- Velocity vs. Registration Age Ratio: Immediate alerts when a recently incorporated entity (< 90 days old) suddenly reports high GSTR-1 outward supplies.
- Suspension & Revocation History: Full historical audit trail exposing whether the registration was previously suspended under Rule 21A for non-compliance.
- Address & Geocoding Verification: Automated decomposition of the Principal Place of Business to cross-reference shared commercial shell addresses.
B. Input Tax Credit (ITC) Eligibility Verification
Under Section 16(2)(aa) of the CGST Act, enterprise buyers cannot claim ITC unless the supplier has furnished invoice details in GSTR-1 and actively discharged liability via GSTR-3B. Receiving an invoice from a non-compliant vendor exposes enterprises to:
- Immediate statutory demand notices for ITC reversal with 18% per annum penal interest.
- Blockage of electronic credit ledgers and working capital disruption.
Our API automatically inspects the supplier's real-time 6-month GSTR-3B filing history to ensure 100% filing compliance before your enterprise ERP approves invoice settlement.
C. Vendor Onboarding & MSME Loan Underwriting in Under 60 Seconds
Traditional corporate onboarding involves manual scrutiny of paper GST certificates, PAN cards, and bank statements, taking 3 to 7 business days. ASP Associates enables true Straight-Through-Processing (STP):
- Step 1 (0–180ms): Query
POST /v1/verify/gstinto authenticate legal entity name, active status, and 6-month 3B filing track record. - Step 2 (180–350ms): Extract embedded PAN from GSTIN digits 3–12 and cross-verify operative tax status via our PAN Verification API.
- Step 3 (350–650ms): Execute NPCI IMPS name-matching with the vendor's bank account using our Penny Drop Bank API.
- Step 4 (650–850ms): Algorithmic underwriting engine checks filing consistency score, approves trade credit limits, and syncs into SAP/Oracle ERP instantly.
Standardized REST Request & Response
Canonical JSON contract returning legal identity, trade name, business constitution, principal address, and 6-month GSTR-3B filing history.
// POST /v1/verify/gstin — Request Payload POST https://api.aspassociates.in/v1/verify/gstin Authorization: Bearer <YOUR_API_KEY> Content-Type: application/json { "gstin": "27AAACB2894G1ZN", "consent": true, "include_filing_history": true, "filing_months": 6 }
// 200 OK — Complete JSON Response (p95 Latency: 174ms) { "outcome": "SUCCESS", "request_id": "req_gst_9d4e21a8", "data": { "gstin": "27AAACB2894G1ZN", "status": "ACTIVE", "legal_name": "BHARAT INDUSTRIAL LOGISTICS PRIVATE LIMITED", "trade_name": "BHARAT LOGIXPRESS", "constitution": "Private Limited Company", "taxpayer_type": "Regular", "registration_date": "2018-04-14", "pan": "AAACB2894G", "einvoice_status": "ENABLED", "filing_frequency": "Monthly", "jurisdiction": { "state": "Maharashtra", "state_code": "27", "center_jurisdiction": "Range-IV, Division-II, Mumbai East", "state_jurisdiction": "Ward-A, Bandra Kurla Complex" }, "principal_address": { "building_name": "Trade Point Tower", "building_number": "Plot C-24, 7th Floor", "street": "G Block, Bandra Kurla Complex", "city": "Mumbai", "district": "Mumbai Suburban", "state": "Maharashtra", "pincode": "400051", "latitude": "19.0657", "longitude": "72.8687" }, "gstr3b_filing_history": [ { "financial_year": "2026-2027", "tax_period": "July 2026", "return_type": "GSTR-3B", "filing_date": "2026-08-19", "status": "FILED", "arn": "AA2707260198421", "mode": "ONLINE" }, { "financial_year": "2026-2027", "tax_period": "June 2026", "return_type": "GSTR-3B", "filing_date": "2026-07-18", "status": "FILED", "arn": "AA2706260187654", "mode": "ONLINE" }, { "financial_year": "2026-2027", "tax_period": "May 2026", "return_type": "GSTR-3B", "filing_date": "2026-06-20", "status": "FILED", "arn": "AA2705260176543", "mode": "ONLINE" }, { "financial_year": "2026-2027", "tax_period": "April 2026", "return_type": "GSTR-3B", "filing_date": "2026-05-19", "status": "FILED", "arn": "AA2704260165432", "mode": "ONLINE" }, { "financial_year": "2025-2026", "tax_period": "March 2026", "return_type": "GSTR-3B", "filing_date": "2026-04-20", "status": "FILED", "arn": "AA2703260154321", "mode": "ONLINE" }, { "financial_year": "2025-2026", "tax_period": "February 2026", "return_type": "GSTR-3B", "filing_date": "2026-03-18", "status": "FILED", "arn": "AA2702260143210", "mode": "ONLINE" } ], "compliance_rating": { "six_month_filing_ratio": 1.0, "delayed_filings_count": 0, "risk_level": "LOW" } }, "consent_verified": true, "tat_ms": 174 }
# Live GSTIN Verification with GSTR-3B Filing History curl -X POST https://api.aspassociates.in/v1/verify/gstin \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "gstin": "27AAACB2894G1ZN", "consent": true, "include_filing_history": true, "filing_months": 6 }'
# Python 3.9+ GSTIN Verification Client import requests api_key = "YOUR_API_KEY" endpoint = "https://api.aspassociates.in/v1/verify/gstin" payload = { "gstin": "27AAACB2894G1ZN", "consent": True, "include_filing_history": True, "filing_months": 6 } headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json" } response = requests.post(endpoint, json=payload, headers=headers, timeout=5) data = response.json() # Evaluate business status & GSTR-3B regularity if data.get("outcome") == "SUCCESS": biz = data["data"] print(f"Entity: {biz['legal_name']} ({biz['status']})") print(f"Type: {biz['taxpayer_type']} | Constitution: {biz['constitution']}") print(f"Recent 3B Filings Verified: {len(biz['gstr3b_filing_history'])}")
// Node.js ES Module / TypeScript Implementation const apiKey = process.env.ASP_API_KEY; const response = await fetch('https://api.aspassociates.in/v1/verify/gstin', { method: 'POST', headers: { 'Authorization': `Bearer ${apiKey}`, 'Content-Type': 'application/json' }, body: JSON.stringify({ gstin: '27AAACB2894G1ZN', consent: true, include_filing_history: true, filing_months: 6 }) }); const result = await response.json(); console.log('Taxpayer Legal Name:', result.data.legal_name); console.log('GSTR-3B Filings Count:', result.data.gstr3b_filing_history.length);
Test GST Verification In Our Live Playground
Simulate live GSTIN responses, test active, suspended, and composition scenarios, examine GSTR-3B filing arrays, and export cURL, Python, and Node.js code snippets in real-time.
GST Verification Questions
Why is the active GSTR-3B filing track record critical for B2B credit underwriting and vendor qualification?
GSTR-3B is the monthly or quarterly summary return where a business declares its taxable turnover, pays actual tax liability, and avails Input Tax Credit (ITC). Under Section 16(2)(aa) of the CGST Act, buyers cannot claim ITC unless the supplier files their return. An active 6-month GSTR-3B track record proves real operational solvency, active cash flow, and tax compliance, protecting lenders and enterprise buyers from non-performing vendors.
How does OTP-less GSTIN verification work, and is taxpayer authorization required?
ASP Associates leverages direct GSTN/CBIC public authentication gateways and GSP pipelines. Basic entity authentication—such as registered legal name, trade name, active status, jurisdiction, and return filing history—is publicly verifiable on GST portals and requires zero OTP interruption. This allows seamless, zero-friction merchant and borrower onboarding while remaining fully compliant with DPDP Act 2023 consent mandates.
How does the API detect and handle Cancelled or Suspended GSTINs?
The API performs live status lookups directly against central GST records. When a GSTIN is suspended (often under Rule 21A due to continuous non-filing or significant GSTR-1 vs GSTR-3B discrepancies) or cancelled, the response flags the status immediately along with the effective cancellation date and last filed tax period, preventing credit disbursement or vendor payment release.
How does ASP Associates ensure compliance with the Digital Personal Data Protection (DPDP) Act 2023?
All GST verification requests are processed ephemerally in memory using TLS 1.3 encryption. Payload data is queried directly from authorized gateways and routed back without storing proprietary business intelligence, promoter PANs, or filing logs at rest. All infrastructure is hosted exclusively in Indian Tier-4 datacenters, adhering strictly to Section 6 and Section 8 of the DPDP Act 2023.
How does the API facilitate Input Tax Credit (ITC) eligibility verification and prevent fake invoicing?
The API validates the supplier's active tax compliance profile and historical GSTR-3B filing cadence. By flagging businesses with sudden turnover surges, recent registrations claiming massive ITC, or non-filing suppliers, enterprise finance teams can prevent fraudulent ITC pass-through and mitigate the risk of statutory notices or GST reversals from tax authorities.