A copy of every IBAN.com API with fixed answers, for development and automated tests. It needs no subscription, uses no queries and contacts no bank or registry. Requests and responses have the same format as production: same parameters, same JSON and XML, same HTTP status codes and error codes. Point your integration at sandbox.iban.com instead of api.iban.com (or api.bav.com for VAT) and use a test key.

The answers to the test values below were recorded from the live APIs, and the sandbox gives no other answers: send a test value exactly as listed (same characters, case and parameters) and you get production’s answer; send anything else and the request is refused with a sandbox-only error code, SANDBOX_NOT_SUPPORTED_IBAN, SANDBOX_NOT_SUPPORTED_ACCOUNT and so on, in the API’s own error format. These codes never come from production. Missing parameters, a wrong format and the test keys behave as in production.

Endpoints

Test keys

Use testkey as the API key (for BAV in the x-api-key header). The other keys return the account error your code has to handle, in each API’s own format and HTTP status:

Two APIs have no numeric codes: the IBAN Calculation API answers {"error":"<message>"} with the message only, and the EISCD download answers with the message as plain text (there, nomorecredits gives No downloads available and ipnotallowed gives IP Address not allowed, sandbox conventions).

Missing parameters and an unknown format behave as in production: see each API’s documentation.

IBAN Validation API

Parameters as in the IBAN Validation API documentation: api_key, format, iban, and optionally sci, sci_tips and translit.

Test values: every IBAN on the Test IBAN numbers page (a valid IBAN and up to five broken variants for each of the 89 IBAN countries, plus the examples with spaces and in lower case) and the documentation examples, 538 in all. Send them exactly as listed. Each returns the full live answer with bank data, SEPA reachability and every validation code, also with sci, sci_tips and translit.

Any other input is refused with SANDBOX_NOT_SUPPORTED_IBAN in errors (HTTP 200, bank_data, sepa_data and validations empty, as for an account error).

curl "https://sandbox.iban.com/clients/api/v4/iban/?api_key=testkey&format=json&iban=GB33BUKB20201555555555"

IBAN Calculation API

Parameters as in the IBAN Calculation API documentation. Test values: the documented example for each country plus a few error cases, 66 in all. Send exactly the fields and values listed, no more and no others.

Any other input is refused with {"error":"SANDBOX_NOT_SUPPORTED_INPUT"} (HTTP 200; in XML <error>SANDBOX_NOT_SUPPORTED_INPUT</error>).

curl "https://sandbox.iban.com/clients/api/calc-api.php?api_key=testkey&format=json&country=GB&bankcode=090127&account=93496333"

BIC Validation API

Parameters as in the BIC Validation API documentation. Test BICs, to be sent exactly as listed:

Any other input is refused with SANDBOX_NOT_SUPPORTED_BIC (HTTP 400, in the format of an account error).

Bank search test values, to be sent exactly as listed:

Any other input is refused with SANDBOX_NOT_SUPPORTED_SEARCH (HTTP 400, in the format of an account error).

BAV (VoP) API

Request as in the BAV API documentation: JSON body with IBAN and name, the key in the x-api-key header. The answer depends on the IBAN, sent exactly as listed, and the name:

curl "https://sandbox.iban.com/clients/api/verify/v3/" -H "x-api-key: testkey" -H "Content-Type: application/json" -d '{"IBAN":"FR7630006000011234567890189","name":"John Doe"}'

Any other IBAN (also a test IBAN with spaces or in lower case) is refused with {"error":"SANDBOX_NOT_SUPPORTED_IBAN"} (HTTP 400). The test keys return IP_NOT_ALLOWED, USER_NOT_ALLOWED, SUBSCRIPTION_EXPIRED and NO_CREDITS_AVAILABLE (HTTP 401), any other key INVALID_API_KEY; the key is checked before the body. The request-format errors (MISSING_API_KEY, UNSUPPORTED_FORMAT, INVALID_JSON, MISSING_INPUT_IBAN, MISSING_INPUT_NAME, METHOD_NOT_ALLOWED) behave as in production.

SortWare API

Parameters as in the SortWare API documentation. As in production, a missing sortcode or account (for a lookup, search) gives HTTP 200 with an empty body. Test sort code and account pairs, to be sent exactly as listed (the rows with separators or extra digits show how production reports such input):