Data Validation APIs: What Your Checks Actually Prove

Data Validation APIs: What Your Checks Actually Prove

A data validation API checks whether the data your users typed is any good.

There are two levels to it.

Format validation looks at the shape. Does this email have an @ and a domain. Does this IBAN pass its check digits. Does this card number satisfy Luhn. Pure arithmetic. Instant, free, and you can write most of it yourself.

Existence validation asks a live source. Does that mailbox accept mail. Is that VAT number registered. Is that postcode a real place. This needs a network call and a current database.

Format checking catches the mistake someone made while typing. Existence checking catches the address that was never real.

Most teams do the first one and find out about the second when a campaign bounces.

This guide covers what each kind of check actually proves, where it belongs in your app, and what to do when one fails.

01The Difference, By Field

Not every field can be verified for existence. Some can only be checked for shape, and knowing which is which stops you promising a product manager something impossible.

Two rows are worth reading twice.

Payment cards cannot be verified without charging them. A Luhn check confirms the digits are plausible and identifies the network. That is all. Anyone claiming to verify a card without an authorisation is checking the format. Use card validation to catch a mistyped number in a form, and your payment processor to find out whether it works.

IBANs are only partly verifiable. The check digits confirm the number is internally consistent and the country structure is right. Whether the account exists and is open is not public information in most countries. IBAN validation stops transfers failing on a typo, which is the majority of failures, and cannot tell you the account is active. We went into the mechanics in Validate IBAN API: a developer's guide.

Try it in the playground. Paste a real IBAN into the Validate IBAN API and look at the parsed output before you write anything. Every service page has one, and it takes about a minute.

02The Email Problem

Email validation is the check most teams get wrong, and the one that costs the most when they do.

A regex confirms the string looks like an address. That is all it does. It leaves five questions open:

• Whether the domain has a mail server at all
• Whether that mailbox exists
• Whether it is a disposable address created ninety seconds ago
• Whether it is a role account like info@ that no individual reads
• Whether the domain is a catch-all that accepts everything and delivers nothing

Each one fails differently.

A typo in the domain bounces. A disposable address signs up and never converts. A catch-all domain accepts your mail and quietly drops it, so you never even learn it failed.

Five endpoints, five answers:

• Validate Email DNS checks MX records and deliverability, which is the live question rather than the format one
• Disposable Email Checker flags throwaway domains
• Email MX Lookup confirms the domain runs mail at all
• Validate Academic Email for education discounts and student verification
• Email and IP Risk Analyzer when signup abuse is the concern

Email verification pays for itself faster than any other check on this page.

An unreachable address is a customer you lost silently. They are in your database. They look fine. Nothing you send them arrives.

Test it on your own data. Take five addresses from your database where you already know the answer, including one you are sure is dead. Run them through the Validate Email DNS API playground and see whether it agrees with you. That test tells you more than any accuracy claim.

Try the email validation endpoint | Get a free API key

03Where Validation Belongs

Four moments, and the right check differs at each.

At the form. Format checks only. Keep it instant. Someone waiting on a network call to learn their email has a typo will close the tab.

At submission. Run the real checks here. Does the email accept mail, is the VAT number registered, is the postcode a place. You have the user's attention and a reason to use it.

At import. Bulk validation earns the most. A ten thousand row CRM import will hold hundreds of dead addresses. Catching them now beats catching them at send. Batch VAT validation takes ten numbers per request for this.

On a schedule. Data rots. Companies deregister. People leave. Domains lapse. Anything you will act on in six months deserves a recheck first.

Browse the validation catalog | Start free, no card

04The Business Cases

Where each check actually earns its keep.

Signup and onboarding. Email deliverability first, because everything downstream depends on being able to reach the person. Then whatever your product needs: phone, postcode, address.

B2B and invoicing. VAT validation is a compliance requirement in the EU, not a nice-to-have. VAT Company Lookup goes further and returns the registered company name and address, which lets you confirm the customer is who they claim before you invoice them.

Payments. IBAN and SWIFT/BIC validation before you attempt a transfer. A failed international transfer costs a fee and a support ticket; a check digit costs nothing.

Checkout. Card format validation catches mistyped numbers before the authorisation, which is a better error message than a decline.

Product catalogues. Barcode check digits for EAN, UPC and ISBN, so a mistyped product code does not propagate through your inventory.

File uploads. Validate File Type checks whether a file is actually what its extension claims. A .pdf that is really an executable is a security problem, not a data quality one.

Deduplication. Phonetic matching using Metaphone or Soundex catches "Smith" and "Smyth" as the same person, which exact matching never will.

Pick one and test it now. VAT validation is the fastest to try if you invoice EU businesses. Paste a real VAT number into the playground and it returns the registered company name and address. No signup needed to look at the docs, and no card needed to get a key.

Browse all 45 validation APIs | Get a free API key

05What To Do With a Failure

Running the check is the easy part. Deciding what happens next is where teams get stuck.

Hard fail anything that breaks a transaction. A malformed IBAN. An invalid VAT number on an EU invoice. Cheap to catch, expensive to miss.

Soft flag anything ambiguous. A catch-all domain is not proof of a bad address. A role account like support@ is fine for B2B and useless for a consumer signup. Flag it, let a human look, keep the signup.

Never block on a timeout. If your validation provider goes down, people should still be able to sign up. A vendor outage should not become an outage in your funnel.

Store the answer with a date. In six months you will want to know what the result was and when. A boolean with no timestamp tells you nothing.

Try a validation endpoint | Create a free key

06Validation Inside a Bigger Flow

Validation is rarely the whole job. It is usually a step inside something else, which is where the sequencing matters.

In a CV pipeline, the parser returns the email it found on the page and cannot tell you the inbox exists. Validation is the step after parsing, and we covered the full flow in Resume Parsing API.

In merchant onboarding, validation sits alongside domain checks. A VAT number that validates and a domain registered nine days ago is a combination worth reviewing, and Domain Intelligence APIs covers that side.

Three rules for the chain itself, covered in more depth in API Chaining in 2026:

Run independent checks in parallel. Email and phone validation have nothing to do with each other. Running them in sequence doubles the wait.

Order by cost, cheapest first. A format check that rejects the record makes every subsequent call unnecessary.

Cache the stable answers. A postcode does not stop being a postcode. Re-checking it on every request is spend with no information.

07Validation When an Agent Is Doing It

Agents run into this more than people do, because an agent handles data it did not collect.

An agent processing a batch of leads, filling a CRM, or acting on a form submission has no idea whether an email address is real. It cannot look at it and think that domain seems odd. It can only check.

Every validation endpoint in the catalog is available over MCP, so an agent can find the right check at runtime and call it. No wrapper written in advance, no list of tools handed over up front.

Two things matter more for agents than for your own code.

Clear failures. An agent that gets a bare 400 gives up. One that gets a message naming the field fixes its call and retries. This is the difference between an agent recovering and an agent stopping.

Cheap checks first. An agent working through a list should hit format validation before anything that costs a lookup. Same rule as your own pipeline, and it matters more when the agent is deciding the order itself.

We covered how agents sequence multi-step work in API Chaining in 2026 and how they find endpoints at all in How AI Agents Use APIs.

See the MCP setup | Browse validation endpoints

08Build or Call

Some of this you should absolutely write yourself.

Write it for format checks. Luhn is a dozen lines. IBAN check digits are a published algorithm. Email regex is solved, though the correct one is longer than you think.

Call an API for live lookups. Email deliverability needs DNS and MX queries. VAT validation needs the VIES registry. Postcode validation needs a current postcode database.

Those are not algorithms. They are data that changes underneath you, and maintaining it is nobody's product.

If the answer can be computed, compute it. If it has to be looked up, look it up.

Not sure which yours is? Open any service page in the validation catalog and send a real value through the playground. If the response contains something you could not have worked out yourself, it is a lookup.

09Conclusion

One word, two jobs.

Format checking is instant and free. It catches typing mistakes.

Existence checking costs a network call. It catches the address that was never real.

Most teams do the first and get surprised by the second. The fix is knowing which fields support a live check, running those at the right moment, and deciding what happens when one fails before it does.

Browse the validation catalog | Start free, no card

10FAQ

What is a data validation API?

An API that checks whether a value is correctly formed, and where possible whether it exists. It is also called a verification API, a data quality API, or a data cleansing API. Emails, phone numbers, VAT and IBAN numbers, postcodes and card numbers are the fields most commonly validated.

What is the difference between validation and verification?

Validation usually means checking the format: does this value have the right shape. Verification means checking against a live source: does this thing actually exist. The terms get used interchangeably, which is why it is worth asking which one a given API performs.

How do I check if an email address is real?

Format checks are not enough. Query the domain's MX records to confirm it accepts mail, check it against disposable domain lists, and identify catch-all domains that accept everything without delivering. An email deliverability endpoint does all three in one call.

Can you validate an email without sending one?

Yes, up to a point. DNS and MX checks confirm the domain can receive mail, and disposable domain lists catch throwaway addresses. Confirming a specific mailbox exists is less reliable than it used to be, because many providers deliberately answer ambiguously to prevent address harvesting.

How do I validate a VAT number?

EU VAT numbers are checked against the VIES registry, which returns validity and, for many countries, the registered company name and address. Format checking alone catches typos but not deregistered or invented numbers, and VAT validation is a compliance requirement for EU B2B invoicing rather than an optional check.

Can I validate an IBAN without a bank?

Partly. IBAN check digits confirm the number is internally consistent and matches the country's expected structure, which catches the majority of failed transfers, since most are typos. Whether the account exists and is open is not public information in most countries.

Can you verify a credit card number without charging it?

No. A Luhn check confirms the digits are plausible and identifies the network, and that is the limit of what is possible without an authorisation. Anyone claiming to verify a card without contacting the issuer is checking the format.

Should validation block a signup?

Hard fail on anything that will break a transaction, such as a malformed IBAN or an invalid VAT number on an EU invoice. Soft flag on anything ambiguous, such as a catch-all domain or a role account. Never block on a validation timeout, because a vendor outage should not become an outage in your funnel.

Can I validate data in bulk?

Yes, and imports are where validation earns the most. A ten thousand row CRM import will contain hundreds of unreachable addresses, and catching them at import beats catching them at send. Batch endpoints exist for the fields where volume is common, such as VAT validation at up to ten numbers per request.

Should I build validation myself or use an API?

Compute what can be computed and look up what has to be looked up. Luhn, IBAN check digits and format patterns are algorithms you can implement once. Email deliverability, VAT registry lookups and postcode databases are live data that changes, and maintaining that data is not your product.

Can an AI agent validate data for me?

Yes. Every validation endpoint in the ApyHub catalog is available over MCP, so an agent can search for the right check, read what it needs, and call it without anyone writing a wrapper first. Agents hit this more often than people do, because they work with data they did not collect and cannot eyeball.

What is the best email validation API?

Depends what you need it to prove. Any of them will check the format. The ones worth paying for check MX records, flag disposable domains, and identify catch-all domains that accept everything without delivering. Test on a list of addresses where you already know the answer, including a few you know are dead.

How do I validate a phone number?

Check the format against the country's numbering plan, normalise it to E.164, and where possible identify the line type. A phone validation API does all three and handles the country-by-country rules you would otherwise maintain yourself.

Can I validate an address?

Partly. Address validation parses a free-form line into structured components and matches it against known addresses where coverage exists. Coverage varies a lot by country, so check the countries you actually operate in rather than assuming global support.

How often should I re-validate stored data?

Anything you will act on after a delay is worth rechecking before you act. Companies deregister, employees leave, and domains lapse. Store the validation result with a timestamp so you know how old the answer is.

11Building a Validation API?

The list above is not finished, and it never will be. Validation is one of those categories where the useful checks are endlessly specific: national ID formats, industry registries, licence numbers, sector-specific identifiers that matter enormously to a few thousand developers and nowhere else.

If you run one, the catalog is open. Publishing takes about ten minutes: point at your endpoint, review the generated spec and docs, set your price, publish. Your API becomes callable by everyone already using the catalog, and MCP-discoverable by their agents on day one, with no wrapper for anyone to write.

Regional and niche validators are the most obviously missing pieces. National identity numbers outside the ones already covered, tax identifiers, professional registration numbers, country-specific address and postcode systems.

Publish your API | See what's already in the category

12Further Reading

• Validate IBAN API: a developer's guide - check digits, country formats, and what IBAN validation can and cannot tell you
• Resume Parsing API - why parsed contact details need validating before you store them
• Domain Intelligence APIs - verifying the business behind the data
• API Chaining in 2026 - sequencing validation inside a larger flow
• Browse the validation catalog - 45 services

13About ApyHub

ApyHub is a curated API catalog for developers, teams, and AI agents. The data validation category holds 45 services covering email, phone, VAT, IBAN, SWIFT, postcode, address, card and file type validation, alongside standard data, geolocation, file conversion, AI and OCR and more across 20 categories.

One subscription covers the whole catalog, with headroom pooled across every API rather than locked to individual services. Every service carries machine-readable certification covering data handling, retention, and standards alignment including GDPR, SOC 2, and ISO 27001. Every endpoint is MCP-ready by default, so agents can discover and call them without a hand-written wrapper.

ApyHub is EU-based and runs entirely on EU infrastructure, which keeps data residency simple for teams with GDPR obligations. The catalog holds 450+ services and 1,500+ endpoints, with new APIs and providers onboarded continuously. The free tier requires no credit card, and every service page has a playground for testing before you build.