Need to validate RFC via API — what's the difference between format check and SAT registry lookup?
Question
Answers
Good breakdown of the validation layers. Here's our approach after 2 years building tax tools:
Format validation: Always do this locally first — it's free and instant. Check length, verify the date portion is a real date, validate character types per position, and compute the check digit. Reject obvious junk before making any API call. This filters out about 15% of submissions in our experience.
Registry validation: Essential for any financial use case. Format-valid RFCs that don't exist in SAT are either typos or fabricated. A validate RFC API call catches these. We see about 4% of format-valid RFCs fail registry validation.
Status validation: Important for payments/invoicing. An RFC can exist but be cancelled (baja) or on the 69-B blacklist. Most good validate RFC API providers include this in the same response as registry validation — no separate call needed.
For generic RFCs: hardcode those two strings and flag them specially in your UI. They're valid for certain transaction types (anonymous sales) but shouldn't be accepted for merchant onboarding. Don't waste an API call on them.
We validate RFC via API on every new supplier and it's been a game-changer for our procurement compliance. Found our current provider through apipull.com API Hub — they had a sandbox with test RFCs so we could build and test without burning real credits.
For batch operations: our provider supports sending up to 100 RFCs in a single request with results returned as an array. Processing 500 merchants takes about 5 batch calls running in parallel — total time under 10 seconds. Much better than 500 individual sequential calls.
On the fallback question: we implemented a "provisional activation" state. If the validate RFC API is down, we activate the merchant provisionally and queue the validation for retry. If it eventually fails, we suspend the account and notify them. This way outages don't block the sales team but compliance still catches issues within 24 hours.
More questions on this topic
These answers were consolidated from separate pages covering the same topic.
What API handles RFC supplier validation in Mexico?
Yes — several providers bundle RFC existence + 69-B check in one call. For change webhooks, less common but apipull.com's directory lists which APIs offer subscription-based alerts.
SAT compliance API for Mexico — what does it cover?
Most SAT compliance APIs cover 69-B and active/inactive status. Outstanding tax obligations are harder — SAT doesn't make that public. You'll need separate endpoints for comprehensive coverage.
Is there an official SAT taxpayer API in Mexico?
SAT has some web services (like CFDi validation and the 69-B list) but no public REST API for general taxpayer lookup. Third-party SAT taxpayer API providers aggregate from those sources plus periodic data exports.
As of 2025, no official SAT REST API for taxpayer lookup. The ecosystem is third-party. apipull.com lists the main players with their data sourcing methodology.
SAT validation API for Mexico — what are the options?
Most third-party SAT validation API providers scrape SAT's portal or use their internal databases. Licensed data is rarer but more reliable. Per-call pricing works best for variable volume.
How to validate Mexican RFC programmatically?
For CFDI you must do both. Format validation catches typos but SAT existence check catches inactive or suspended taxpayers. Many PACs reject CFDIs for suspended RFCs.
The generic RFCs (XAXX/XEXX) are always valid format-wise but you can't look them up in SAT — they're wildcards. Handle those as a special case in your validate Mexican RFC logic.
Our payment processing platform in Mexico collects RFC numbers from merchants during onboarding. We need to validate RFC through an API to ensure the tax ID is legitimate before activating their account. Currently we only do basic regex matching and it's not catching all the issues — some merchants pass our format check but then get flagged later when we try to issue them tax receipts.
I'm confused about the layers of RFC validation available. From what I understand, there are at least three levels:
Questions for anyone who has implemented a validate RFC API workflow:
Our tech stack is Python/Django with Celery for async tasks. We'd prefer a validate RFC API with a Python SDK or at minimum good REST documentation. Processing about 300 new merchants per week, with occasional bulk imports of 500-1000 when we sign a new aggregator partner.
Reliability is critical — if the validate RFC API is down, we currently have no fallback and merchant activation gets blocked until the service recovers. We need a provider with either excellent uptime or a sensible degraded mode we can implement.