GST Verification API: IndiaCos for GST, CIN, DIN, PAN and Trade Mark Lookups at ₹0.40 a Call

Last updated: 3 November 2026

Key takeaways

• One key, one base URL (https://indiacos.com/api/v1), ₹0.40 per successful call. Errors such as 400, 404, 422 and 503 are not billed.
• Every example on this page is a live call made on 3 November 2026: our own company’s GSTIN, a listed company with 101 GSTINs under one PAN, a director with 20 directorships on record and a wilful-defaulter search.
• A GST record shows status and filing dates. It does not prove that your particular invoice was reported or that the tax on it was paid.
• Name matches are leads, not findings. A defaulter-list entry is as published, and a similar name is not the same company.
• Of eight GST and KYB API vendors we checked, only GSTZen publishes prices on its own page. We compare them fairly below, and say when each is the better pick.

What is the IndiaCos API and who builds it?

IndiaCos is one of three public-records APIs from Billion Insights, the Noida company that also builds eCourtsIndia (court data) and IndiaPropertyRegister (land and property records). The company is Billion Insights Ventures Pvt. Ltd., CIN U62090UP2026PTC241369, and it is named as the operator in the IndiaCos terms. The hub post for all three APIs shows how they fit together.

We should be clear about one thing up front. We make IndiaCos, and later in this post we compare it with other vendors. We have kept that comparison to what each vendor publishes on its own page, with the date we read it, and we say where another product is the better fit.

The data comes from public registers. Company and LLP records come from the Ministry of Corporate Affairs, GST records from the GST portal, trade marks from the Trade Marks Journal published by IP India, patents and designs from the Patent Office Journal, copyright from the Register of Copyrights, MSMEs from Udyam, and defaulter entries from the lists that banks, credit bureaus, exchanges and regulators publish. Here is the size of each set, as stated in the IndiaCos llms.txt file on 3 November 2026.

Record set	Count (3 Nov 2026)	Main endpoint
Companies (MCA)	32,70,538	/company/{cin}
LLPs (MCA)	5,82,797	/company/{llpin}
GST registrations	64,91,973	/gst/{gstin}, /pan/{pan}
Trade mark applications	34,76,033	/trademark/search
Patent applications	10,85,225	/patent/search
Registered designs	2,04,080	/design/search
Copyright registrations	2,78,307	/copyright/search
MSMEs (Udyam)	4,64,87,042	/msme/search
Defaulter-list entries	7,02,941	/defaulter/search

Billion Insights Ventures Pvt. Ltd. holds ISO 9001:2015, ISO/IEC 20000-1:2018 and ISO/IEC 27001:2022 certification (9001 certificate, 20000-1 certificate, 27001 certificate).

What does a GST verification API return?

A GST verification API takes a 15-character GSTIN and returns the registration as the GST portal shows it: legal name, PAN, constitution, taxpayer type, status, registration and cancellation dates, address, jurisdiction and recent return filings. IndiaCos adds Aadhaar authentication and e-invoicing flags from the portal, other registrations under the same PAN, and any defaulter-list entries.

The cleanest example is our own GSTIN, because we can say exactly what is true about it. This is the real call and a trimmed copy of the real response from 3 November 2026.

curl -s https://indiacos.com/api/v1/gst/09AAOCB3302M1ZH \
  -H "Authorization: Bearer $INDIACOS_KEY"

{
  "gstin": "09AAOCB3302M1ZH",
  "legal_name": "BILLION INSIGHTS VENTURES PRIVATE LIMITED",
  "pan": "AAOCB3302M",
  "constitution": "Private Limited Company",
  "taxpayer_type": "Regular",
  "status": "Active",
  "registration_date": "2026-08-24",
  "cancellation_date": null,
  "aadhaar_authenticated_on": "2026-09-10",
  "einvoice_enabled": false,
  "return_filings": [
    {"form": "GSTR3B", "financial_year": "2026-2027", "period": "September", "status": "Filed", "filed_on": "2026-10-17"},
    {"form": "GSTR1", "financial_year": "2026-2027", "period": "September", "status": "Filed", "filed_on": "2026-10-11"}
  ],
  "same_pan_registrations": {"count": 1},
  "defaulter_lists": []
}

Read it the way a finance team would. The registration is Active and dates from 24 August 2026. The September GSTR-1 (outward supplies) went in on 11 October 2026 and the September GSTR-3B (summary return with tax payment) on 17 October 2026. Aadhaar authentication was done on 10 September 2026. E-invoicing is not enabled, which is common for a young company. The full record also says the core business is “Service Provider and Others” and that the profile was last read from the portal on 24 October 2026.

That last date matters. If you need today’s position, pass ?refresh=true, which re-reads the portal unless the record was read in the last 30 days. If you send a GSTIN that IndiaCos has never seen, it does not guess. We tried a made-up number and got HTTP 202 with "status": "checking" and "retry_after": 60, and our usage log showed ₹0 billed for it.

Why status alone is not enough

Under section 16(2) of the CGST Act, a buyer can take input tax credit only if, among other conditions, the supplier has furnished the invoice in its statement of outward supplies and the tax charged has actually been paid to the Government. So a supplier’s filing pattern is your risk too. A GSTIN that is Active but has a gap in GSTR-3B filings is a question to ask before you pay, not after.

The scale of the problem is public. On 7 January 2024 the Ministry of Finance said, through a PIB release, that GST formations had detected 29,273 bogus firms involved in suspected input tax credit evasion of ₹44,015 crore since the special drive began in mid-May 2023, with 121 arrests. Our vendor KYB guide turns that into a step-by-step onboarding check.

How do you verify a CIN and read a company record?

Call /company/{cin} with the 21-character CIN (or an LLPIN) and you get the MCA record with a live official status, plus the company’s GSTINs, charges, directors, IP filings and defaulter-list entries in one response. If you only have a name, call /search?q= first and pick the right CIN from the results.

For a large listed company we used Tata Consultancy Services Limited (CIN L22210MH1995PLC084781). The table shows what the record held on 3 November 2026.

Field	What the record showed	Why a checker cares
Official status	Active, checked on the MCA side on 28 Oct 2026	Struck off, under liquidation or dormant changes everything
Listed	true	Listed companies also file with the exchanges
Incorporated	19 Jan 1995, ROC Mumbai I	Very young companies deserve more questions
Paid-up capital	₹3,61,80,87,518 (about ₹361.8 crore)	A sense of scale, not of solvency
Last annual return / financials	2025 / 2025	Three years of non-filing can disqualify directors
Charges	35 on record, 11 shown open	Who has security over the company’s assets
IP on record	575 trade mark applications, 3,446 patent applications, 19 designs, 43 copyrights	Brand and technology ownership
Directors	11 on the company record	Cross-check each DIN separately

Two honest notes. First, the director list inside a company record is a summary. On this record only 3 of the 9 current names shown carried a DIN, so for anything serious call /company/{cin}/directors and read its din_linked_by field, which says whether the DIN came from the record or from a name match. Second, new companies have gaps. Our own company, incorporated on 15 January 2026, showed an Active official status checked on 28 October 2026 but an empty director list and no registered office in the record. When the record is thin, ask the counterparty for its MCA master data rather than assuming the worst.

Court cases have their own endpoint, /company/{cin}/cases, built on eCourtsIndia court records. Our guide to finding all cases against a company explains how to read the petitioner and respondent split, and the eCourts API pillar covers the full court-data API.

How do you list every GSTIN under one PAN?

Call /pan/{pan} and you get every GST registration under that PAN across states, with status and registration date. A company takes a separate GSTIN for each state where it has a place of business, and sometimes more than one in a state.

The PAN in a GSTIN sits in characters 3 to 12, so TCS’s PAN is AAACR4849R. On 3 November 2026 that PAN carried 101 GST registrations across 33 state and UT codes: 87 Active, 7 Not Migrated, 6 Cancelled on application of the taxpayer and 1 Inactive. Our own PAN, AAOCB3302M, carries exactly one.

curl -s https://indiacos.com/api/v1/pan/AAOCB3302M \
  -H "Authorization: Bearer $INDIACOS_KEY"

{"pan": "AAOCB3302M", "total": 1, "count": 1, "limit": 200, "offset": 0, "next": null,
 "results": [{"gstin": "09AAOCB3302M1ZH",
              "legal_name": "BILLION INSIGHTS VENTURES PRIVATE LIMITED",
              "state_code": "09", "status": "Active", "registration_date": "2026-08-24"}]}

Why it matters: the GSTIN on the invoice is the one that counts. A big supplier can be perfectly sound while the particular state registration on your bill is cancelled. Check the exact GSTIN, then use the PAN view to see the wider picture. One small lesson from our own testing: /pan takes no query parameters, and when we added ?limit=3 it returned HTTP 400 unknown_parameter, which was not billed.

How do you check a DIN and spot a disqualified director?

Call /director/{din} with the DIN (up to 8 digits) and you get the MCA DIN status and approval date, any live disqualification with its section and period, the active-non-compliant-company flag and the person’s directorships. It works for any DIN on the MCA register, even one with no directorships.

We used the public DIN of Chandrasekaran Natarajan (00121863), a director of TCS, and keep to what the MCA record shows. The DIN status was Approved, first approved on 27 May 2006, with no disqualification and no active-non-compliant flag, as of 14 October 2026. The record listed 20 directorships, 14 current and 6 ceased, all linked to the DIN by the record rather than by a name match.

curl -s https://indiacos.com/api/v1/director/00121863 \
  -H "X-API-Key: $INDIACOS_KEY"

{"din": "00121863", "din_status": "Approved", "din_approved": "2006-05-27",
 "disqualified": false, "disqualification_section": null,
 "active_noncompliant_company": false, "din_status_as_of": "2026-10-14",
 "directorships": [ ...20 entries, each with cin, company, status, din_linked_by... ]}

The disqualification that trips most small companies is section 164(2) of the Companies Act, 2013. It says a person who is or has been a director of a company that has not filed financial statements or annual returns for any continuous period of three financial years, or has failed to repay deposits or debentures for a year or more, is not eligible to be reappointed there or appointed in another company for five years. The director check guide walks through DIN status, section 164 and defaulter lists in detail, and our post on how Indian law treats company directors explains why directors carry personal exposure.

Can the same key search trade marks, patents, designs and copyright?

Yes. The same key and the same ₹0.40 price cover trade mark search and record reads, patent and design search, and copyright search. The trade mark set is drawn from the Trade Marks Journal from 2014 onwards and can be filtered by Nice class (1 to 45, with 99 for multi-class) and Registry office.

A trade mark record shows the Registry status as read on a date. For example, the Amul Kool Elaichi application (2559157, class 29) showed “Opposed” in the Registry e-register as read on 25 October 2026. A search for our sample brand “Nyaaya Kart” returned no results at all, which is a start, not a clearance. The trade mark search and clearance guide runs a full clearance with variants, classes, oppositions and court cases. One caution for patents: a published application is not a granted patent, and the API says so in each record.

How do defaulter lists work in the API?

/defaulter/search searches published lists by name, list, state, lender, CIN, DIN or the last four characters of a PAN, and returns each entry as published. The lists include wilful and large defaulters as banks report them to credit bureaus, SEBI recovery proceedings, companies fined, suspended or delisted by BSE and NSE, defaulting brokers, GeM and World Bank debarments, ESIC defaulting employers and MCA alert lists from 2014 to 2018.

A search for Kingfisher Airlines on 3 November 2026 returned several entries in different states. The first sat on both the Wilful defaulters (suit filed) and Large defaulters (suit filed) lists, as published through CRIF High Mark and Equifax, naming IDBI Bank, Punjab National Bank, State Bank of India and The Federal Bank, with ₹909.96 crore outstanding on that entry and present in the latest list.

curl -s "https://indiacos.com/api/v1/defaulter/search?q=Kingfisher%20Airlines&limit=1" \
  -H "Authorization: Bearer $INDIACOS_KEY"

{"results": [{"name": "Kingfisher Airlines Ltd.", "pan_masked": "XXXXXX301J",
   "lists": [{"key": "ld_sf", "title": "Large defaulters (suit filed)"},
             {"key": "wd_sf", "title": "Wilful defaulters (suit filed)"}],
   "sources": ["CRIF High Mark", "Equifax"],
   "lenders": ["IDBI Bank Limited", "Punjab National Bank", "State Bank of India", "The Federal Bank Limited"],
   "amount_outstanding_inr": 9099600000, "in_latest_list": true}],
 "has_more": true,
 "note": "As published by the listed authorities; a similar name is not the same person or company."}

Notice the masked PAN and the note. Lists publish PANs masked, so a match on the last four characters narrows a search but does not prove identity. For lending files, the borrower due diligence workflow shows how to combine these entries with court and land records.

What does the plain-English find endpoint do?

/find turns a request such as “pharma manufacturers in Gujarat” into filters (category, business function, place) and returns matching industry codes, companies and GST registrations. It is a starting point for lead lists and market maps, and it tells you how it read your words.

That transparency is the point, so here is an imperfect result. For “pharma manufacturers in Gujarat” on 3 November 2026, the understood block read the category as wholesale with function manufacturer and state Gujarat. The first industry it offered was NIC 46497, wholesale of pharmaceutical and medical goods (8,440 companies), with NIC 21002, manufacture of allopathic pharmaceutical preparations (1,516 companies), second. The companies list came from the wholesale code. The fix is simple: read understood, then call /companies?nic=2008/21002&state=Gujarat with the exact code you want.

How much does the IndiaCos API cost?

₹0.40 per successful call, from a prepaid wallet, with no subscription. Every HTTP 200 is billed, including a search that returns nothing. Errors (400, 404, 422, 503), refused calls and the /account endpoints are free. New accounts get ₹50, about 125 calls.

Usage	Calls	Cost at ₹0.40	How you would pay
Trying it out	125	₹50	Free signup credit
One vendor, six checks (GST, PAN, company, directors, cases, defaulters)	6	₹2.40	Wallet
A month of light onboarding	1,000	₹400	₹500 top-up (1,250 calls) + 18% GST
Mid-size team	12,500	₹5,000	₹5,000 top-up + ₹900 GST
Platform scale	1,25,000	₹50,000	₹50,000 top-up + ₹9,000 GST

How does that compare? Most vendors in this space price through sales. We read each vendor’s own page on 3 November 2026 and recorded only what it publishes.

Vendor	What its page showed (read 3 Nov 2026)	Price published?	Choose it instead when
GSTZen	GST validator API annual packs: ₹3,500 for 5,000 calls, ₹5,000 for 10,000, ₹8,250 for 25,000; taxes extra; prices may change at renewal	Yes	You only need GSTIN validation at steady volume and prefer a fixed annual cost (the 25,000 pack is about ₹0.33 a call)
Surepass	GST verification API returning business name, registration status, state jurisdiction and GSTIN; free trial offered	No	You want GST checks bundled with identity KYC from one vendor
Signzy	GST verification API listed in its API marketplace	No	You run regulated onboarding and want a large KYC catalogue under one contract
Gridlines	GSTIN API page shows a “per verification” unit with no amount	No	You want a verification-only vendor with a sales-led contract
Sandbox	Pricing page offers Enterprise custom pricing and a cost calculator; GST is listed as a product	No	You also need GST and tax workflow APIs beyond lookups
Masters India	GST number verification API and bulk utility; says it is a GST Suvidha Provider appointed by GSTN; ERP integrations	No	You want GSP services such as e-invoicing and return filing from your ERP
Attestr	Home page describes 80+ REST APIs with one key, including business KYC from GST, MCA, Udyam and FSSAI	No	You want KYB monitoring alerts alongside person KYC
Probe42	Pricing page names Probe42 Business, Banking and API products with contact links	No	You want a packaged company report product for credit teams

On price alone, GSTZen’s largest annual pack works out cheaper per GST validation than ₹0.40, and its smaller packs work out dearer (₹0.70 and ₹0.50 a call). IndiaCos is priced for breadth: the same ₹0.40 buys a company record, a director record, a trade mark search or a defaulter search, with no annual commitment and credits that you top up as you go.

How do you call the IndiaCos API from code?

Send Authorization: Bearer YOUR_KEY (or X-API-Key: YOUR_KEY) to https://indiacos.com/api/v1, and handle four responses: 200 (billed), 202 (still reading the portal, retry), 4xx errors (free) and 429 (daily cap). There is no official SDK; curl, Python requests and Node fetch all work, and the docs link an OpenAPI file and a Postman collection.

Without a key the API answers HTTP 401 with {"error":"api_key_required", ...} and a link to sign up. List endpoints return at most 100 records per call, and offset goes up to 10,000. Here is a small, readable Python helper that keeps the key in an environment variable and retries the 202 case.

import os, time, requests

BASE = "https://indiacos.com/api/v1"
HEADERS = {"Authorization": "Bearer " + os.environ["INDIACOS_KEY"]}

def get(path, params=None, tries=3):
    for attempt in range(tries):
        r = requests.get(BASE + path, headers=HEADERS, params=params, timeout=30)
        if r.status_code == 202:            # not on record yet; being read from the portal
            time.sleep(int(r.json().get("retry_after", 60)))
            continue
        if r.status_code == 429:            # daily cap reached; resets at midnight IST
            raise RuntimeError("daily cap reached")
        r.raise_for_status()                # 4xx errors are not billed
        return r.json()
    raise RuntimeError("still checking after retries: " + path)

gst = get("/gst/09AAOCB3302M1ZH")
print(gst["status"], [f["form"] + " " + f["period"] for f in gst["return_filings"][:2]])

Cache what you fetch with its read date, and use /account/usage, which is free, to see each recent call with what it was billed. The vendor risk score tutorial builds a full Python script on top of these calls, with eCourtsIndia court search added.

Can AI agents use IndiaCos through MCP?

Yes. The IndiaCos MCP server lives at https://indiacos.com/mcp (Streamable HTTP) and accepts OAuth 2.1 sign-in or a key, with the same ₹0.40 billing. Its tools mirror the endpoints: search, find, get_company, get_gst, get_pan, get_director, get_cases, the trade mark, patent, design and copyright tools, MSME and defaulter search.

Agents can also sign themselves up by email code through /agent/identity and /agent/identity/claim, and the llms.txt file gives a model the counts, endpoints and terms in one read. Our MCP guide for Claude, ChatGPT and Cursor connects IndiaCos, eCourtsIndia and IndiaPropertyRegister side by side, and the earlier walkthrough on connecting the eCourtsIndia MCP to Claude covers the court server on its own.

What may you do with the data?

Internal business use, including commercial use and showing individual records to your own users, is allowed without a separate licence. Reselling or redistributing the data, building a competing database, bulk scraping, and training, fine-tuning or evaluating AI models need a written licence from support@indiacos.com. That is the usage section of the llms.txt file as read on 3 November 2026; the full terms govern.

What this does not tell you

Sources and method

• Live IndiaCos MCP calls: get_gst 09AAOCB3302M1ZH, get_pan AAOCB3302M and AAACR4849R, get_company L22210MH1995PLC084781 and U62090UP2026PTC241369, get_director 00121863, search_defaulters “Kingfisher Airlines”, find (two requests), search_trademarks “Nyaaya Kart” and get_trademark 2559157, run 3 November 2026.
• Live REST calls with curl against https://indiacos.com/api/v1 (gst, pan, director, defaulter/search, trademark/search, account/usage, and a call without a key), run 3 November 2026. JSON shown is trimmed, not edited.
• IndiaCos llms.txt, API docs and OpenAPI file, read 3 November 2026.
• Statutes via IndiaCode on eCourtsIndia: CGST Act s.16 and Companies Act 2013 s.164, read 3 November 2026.
• PIB, Ministry of Finance, release of 7 January 2024 on bogus GST firms, read 3 November 2026.
• Vendor pages, each read 3 November 2026: GSTZen pricing, Surepass GST verification, Signzy GST verification, Gridlines GSTIN API, Sandbox pricing, Masters India, Attestr, Probe42 pricing.
• How we built our data stack, for readers who want the background: building India’s legal data engine.

Frequently asked questions

Start with a GSTIN you already know, ideally your own. It is the quickest way to see what the record holds before you check anyone else.