Is There an API to Validate GSTIN in Bulk? How Businesses Check Thousands of GST Numbers

Why Checking GST Numbers One at a Time Stops Working

Most teams start by pasting a GSTIN into a lookup page. That works for one supplier. It becomes slow when a marketplace onboards hundreds of sellers, a distributor cleans thousands of vendor records, or a lender checks business registrations during onboarding. In each case, someone needs to confirm that the GSTIN exists, check its status and compare the registered name with the business record.

The GST Portal’s tool supports individual lookups. An API lets teams make the same type of check within an onboarding or finance workflow and keep a dated result. A wrong or cancelled GSTIN can cause invoice and return mismatches and complicate an input tax credit review. GSTIN verification is a useful control, but an active GSTIN alone does not establish eligibility for input tax credit.

What the GSTIN Verification API Checks and Returns

Cashfree’s GSTIN verification API reference documents a POST request containing the GSTIN. You may also send business_name. The request uses a client ID and secret from the merchant dashboard; the documentation provides a sandbox for testing. Compare the returned name with the name in your own vendor record instead of assuming the API has made a matching decision for you.

Store the request time yourself. If the GSTIN is invalid or the service cannot complete a check, keep that outcome separate from an inactive registration. The public reference shows the success response fields; your implementation should inspect the actual status code and response body rather than assuming every unsuccessful lookup has the same shape.

Also read: What is a GSTIN? Format, meaning and how to check one

How to Validate Thousands of GSTINs

The publicly documented endpoint takes one GSTIN per request. To process a list, build a small queue around it:

1. Clean the source file. Remove blank rows and duplicates, normalise casing and reject entries that are not 15 characters. The first two characters are the GST state code. A correct-looking format does not prove a registration exists.
2. Run a controlled batch. Start with a modest number of workers and agree on throughput with Cashfree for your account. Do not assume that parallel requests are unlimited.
3. Classify each outcome. Keep active, inactive, invalid, name mismatch and temporary API failure as separate states. A failed request should be retried or reviewed, not silently marked as an invalid GSTIN.
4. Retry temporary failures. Use a bounded retry with backoff for rate limiting or temporary server errors. Do not repeat permanently invalid requests indefinitely.
5. Store and review the results. Save the GSTIN, returned details, reference ID, status, and time checked beside your original vendor ID. Send uncertain name matches or inactive statuses for review.
6. Export for finance. Cashfree’s GSTIN Verification report lists checks already performed. Finance teams can generate it in CSV or XLS, select a date range and choose the columns. This is a results report, not a way to upload an unchecked spreadsheet.

Here is a minimal Python example using the documented sandbox endpoint. Set the credentials as environment variables and replace the sample list with your own input process:

import os
import time
from concurrent.futures import ThreadPoolExecutor
import requests
URL = "https://sandbox.cashfree.com/verification/gstin"
HEADERS = {
    "x-client-id": os.environ["CASHFREE_CLIENT_ID"],
    "x-client-secret": os.environ["CASHFREE_CLIENT_SECRET"],
    "Content-Type": "application/json",
}
gstin_list = ["29AAICP2912R1ZR"]  # Replace with your source list.
def verify_one(gstin):
    for attempt in range(3):
        try:
            response = requests.post(
                URL, headers=HEADERS, json={"GSTIN": gstin}, timeout=15
            )
        except requests.RequestException as exc:
            if attempt == 2:
                return {"gstin": gstin, "error": str(exc)}
            time.sleep(2 ** attempt)
            continue
        if response.status_code == 429 or response.status_code >= 500:
            if attempt < 2:
                time.sleep(2 ** attempt)
                continue
        try:
            body = response.json()
        except ValueError:
            body = {"message": response.text[:200]}
        return {"gstin": gstin, "http_status": response.status_code, "body": body}
with ThreadPoolExecutor(max_workers=3) as pool:
    results = list(pool.map(verify_one, gstin_list))

This example returns results to your application; it does not write a finance report or make an automatic onboarding decision. Use the Secure ID Dev Studio to explore the verification flow, and check current authentication and error-handling requirements before deploying production code. Cashfree describes responses as typically under two seconds, but end-to-end time for a large file depends on your account’s allowed throughput, retries and your own processing.

What Do You Need to Get Started?

• Access to Cashfree’s Verification Suite and your client ID and secret.
• A sandbox run with the test GSTINs specified in the API documentation, followed by a small production run.
• A policy for storing results, reviewing mismatched names and rechecking records when needed.
• Confirmation of your account’s throughput, pricing and any IP allowlisting or additional authentication requirements.

For occasional checks, Cashfree’s GST verification product page describes a dashboard lookup. Its page also mentions bulk verification; ask Cashfree for the endpoint and terms if you need a dedicated bulk API. The publicly linked API reference above documents the one-GSTIN request.

What If You Have a PAN Instead of a GSTIN?

A business may have GSTINs associated with its PAN in more than one state. GST Search by PAN returns associated GSTINs, status and state. The separate PAN to GSTIN API lets a developer perform that lookup in a workflow. You can then check each GSTIN using the verification endpoint. This is a different step from validating a GSTIN you already have.

Also read: How to search GSTINs using a PAN

Where Does GSTIN Validation Fit in a Business Workflow?

Not every workflow follows the same order. For example, a finance team may verify customer GSTINs for invoicing without ever paying those customers. Define when to check and who resolves a mismatch for each use case.

Conclusion

Checking a single GSTIN is quick. Checking thousands needs a repeatable process: clean the input, make controlled API requests, keep uncertain outcomes separate and give finance a dated record it can review. Start with the documented single-GSTIN endpoint and confirm whether a dedicated bulk option fits your volume.

Frequently Asked Questions

Is there an API to validate GSTINs in bulk?

Yes. You can process a list through Cashfree’s publicly documented GSTIN verification endpoint by sending one GSTIN per request with controlled concurrency. Cashfree’s product page also mentions a dedicated bulk API, but its public endpoint and request format should be confirmed with Cashfree before you describe it as available in your integration.

Can I upload a spreadsheet of GSTINs in the dashboard?

The documented GSTIN Verification report is for downloading results of checks already made. It does not establish a spreadsheet-upload feature for GSTINs. Check with Cashfree if you need a no-code bulk-upload workflow.

What details does the GSTIN verification API return?

For a valid lookup, the documented response includes the registration status, legal and trade names, taxpayer type, constitution of business, registration date, last update date, address, activities and jurisdictions. Your system should also record when it made the check.

Does a valid GSTIN mean the business is active?

Not necessarily. Check gst_in_status separately from valid, and compare the registered name with the business details you collected.

Can I find all GSTINs linked to a PAN?

Cashfree’s PAN to GSTIN lookup returns a list of associated GSTINs with their status and state. You can run a separate verification for any registration you need to assess further.

How many GSTINs can I check, and what will it cost?

The public endpoint reference does not specify a batch size or a numeric throughput limit. Confirm the available bulk option, allowed request rate and per-verification pricing for your account before estimating the cost or completion time of a large run.