Tax ID Validator API

About the Tax ID Validator API

A tax ID validation API for US SSNs, EINs and ITINs, for checking numbers at signup, payroll and vendor onboarding. Tax ID Validator checks each number against the SSA and IRS numbering rules (SSN area, group and serial numbers, assigned EIN prefixes, ITIN middle-digit ranges) and returns formatted and masked versions, the digits alone and the last four digits, ready to store or display safely.

It catches typos and impossible numbers before they reach a payroll run, a 1099 filing or a KYC review, and the masked output lets support screens show a number without exposing it. It validates format only: it is not EIN or SSN verification against IRS or SSA records, so a well-formed number that was never issued still passes.

The Free plan returns the valid flag, normalized, digits-only, masked and last-four forms, and the EIN prefix or ITIN range check. Paid plans add the detected ID type, the SSN component checks, placeholder detection for filler like 123-45-6789, and a risk score with a low, medium or high band.

How it works

Tax ID Validator removes spaces and hyphens from taxid and requires exactly nine digits; anything else returns valid: false, type Unknown, a format error and a fixed risk_score of 50. The type is then inferred from shape alone. A number starting with 9 is treated as an ITIN. A number written with a hyphen after the second digit (XX-XXXXXXX) is treated as an EIN. Every other nine-digit number is treated as an SSN. Because the leading 9 check runs first, an EIN with a 9x prefix is classified and validated as an ITIN, so send hyphen-formatted EINs and read type before trusting the result.

SSN rules reject area 000, 666 and 900 to 999, group 00 and serial 0000, stopping at the first failure, which is reported in error and the matching validation_details flag. EINs must start with one of the two-digit prefixes the IRS has assigned; unassigned prefixes such as 07, 08, 09, 17 or 89 fail prefix_valid. ITINs must have middle digits in 50 to 65, 70 to 88, 90 to 92 or 94 to 99, checked by itin_range_valid.

normalized is the hyphenated standard form, digits_only the bare digits, last4 the final four, and masked hides all but those four (***-**-6789, or **-****6789 for an EIN). taxid echoes the input as sent. is_placeholder is true for all-identical digits or a strict ascending or descending run such as 123456789. risk_score adds 40 for a failed rule and 35 for a placeholder, so a valid placeholder scores 35; risk_level is high at 60 or above, medium at 25 or above, otherwise low. On the Free plan type, type_full, format, is_placeholder, the risk fields and the SSN component flags are null.

What people use it for

Form Validation

Validate Tax IDs in online forms and applications to ensure correct format before submission

Compliance

Verify Tax ID format compliance for tax reporting, payroll processing, and financial services

Data Quality

Validate Tax IDs in databases during data cleaning and migration to identify invalid entries

Identity Verification

Check Tax ID format as part of identity verification processes while maintaining privacy with masking

Ways to call it

One endpoint, many ways in — REST with JSON, XML, YAML and CSV, plus GraphQL and an MCP interface for AI agents.

JSON

Default REST response

XML

Markup format

YAML

Human-readable

CSV

Tabular export

Beta

GraphQL

Query language

New

MCP

For AI agents

How it compares

Side by side with the tools people weigh Tax ID Validator against — what each one is better at, in plain terms.

Request parameters — GET /v1/taxidvalidator

Sent in the query string. Premium parameters are accepted on every plan but only take effect on plans that include them. Anything not listed here is dropped rather than passed through.

Required

1
2

curl "https://api.apiverve.com/v1/taxidvalidator?taxid=123-45-6789" \
  -H "x-api-key: YOUR_API_KEY"

Authentication

Send your key in the x-api-key header. That is the only auth step — no token exchange, and no per-endpoint scope to configure.

Response — GET /v1/taxidvalidator

Every APIVerve endpoint returns the same three top-level keys, so one response handler covers your whole integration: status, error and data. Only data changes shape.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

{
  "status": "ok",
  "error": null,
  "data": {
    "valid": true,
    "taxid": "123-45-6789",
    "type": "SSN",
    "type_full": "Social Security Number",
    "format": "XXX-XX-XXXX",
    "normalized": "123-45-6789",
    "digits_only": "123456789",
    "masked": "***-**-6789",
    "last4": "6789",
    "is_placeholder": true,
    "validation_details": {
      "format_valid": true,
      "area_number_valid": true,
      "group_number_valid": true,
      "serial_number_valid": true
    },
    "risk_score": 35,
    "risk_level": "medium",
    "error": null
  }
}

Response fields

Paths are relative to data. Premium fields are absent rather than zeroed on plans that do not include them, so check for presence instead of comparing to 0.

Response headers

Every response carries your balance, so your own code always knows where it stands without polling anything. All four are exposed to browsers through CORS.

Errors

Read the HTTP status first, then error for the specific reason. The body names the parameter that has to change.

What a call costs — 10 credits per call

Credits are shared across every APIVerve API — one balance, one key, one bill. Failed requests never count against it, so a rejected input costs nothing.

Calls are what the credits buy at this API's rate — spend them here, on any of the other APIs, or across both. Nothing is reserved per endpoint.

Zero-code embed — one snippet, no backend

Drop an interactive Tax ID Validator form onto any page. The widget calls the API for you, so no key ever appears in your markup and there is nothing to deploy.

Changelog — Tax ID Validator API

Every change to this endpoint, newest first. Breaking changes ship as a new version and the previous one keeps serving — response fields are added, never removed or retyped in place, so an integration written against v1 keeps working.

Currently v1