The VIES API: REST vs SOAP, the error codes and the limits

The VIES API is free and needs no key: POST countryCode and vatNumber as JSON to https://ec.europa.eu/taxation_customs/vies/rest-api/check-vat-number and read valid, plus the trader’s name and address where the member state publishes them; add your own VAT number as the requester to receive a consultation number. The older SOAP service (checkVatService) answers the same question (European Commission, VIES technical information). What VIES does not give you is a cache for the hours a member state is down, a retry policy, or the same answer shape for every country: that is the part you build, or delegate.

·

What does a REST call look like?

One POST with a JSON body. The answer is JSON; a failure is either an HTTP error or a userError field other than VALID / INVALID.

curl — the Commission’s VIES REST API
curl -X POST "https://ec.europa.eu/taxation_customs/vies/rest-api/check-vat-number" \
  -H "Content-Type: application/json" \
  -d '{"countryCode":"DE","vatNumber":"136695976"}'
curl — with your own VAT number, for a consultation number
curl -X POST "https://ec.europa.eu/taxation_customs/vies/rest-api/check-vat-number" \
  -H "Content-Type: application/json" \
  -d '{"countryCode":"DE","vatNumber":"136695976",
       "requesterMemberStateCode":"FR","requesterNumber":"40303265045"}'

Which fields come back?

  • valid — true when the number is registered for intra-EU transactions in that member state on the request date.
  • requestDate — the date of the check, the one to store with the answer.
  • name, address — the registered trader, or --- where the member state does not publish them.
  • requestIdentifier — the consultation number, only when a requester was given.
  • userError — VALID, INVALID, or the reason the check could not be made (next section).

What do the VIES error codes mean?

CodeMeaningWhat to do
MS_UNAVAILABLEThe member state’s register did not answerServe your last dated answer or retry later; never read it as "invalid"
SERVICE_UNAVAILABLE, TIMEOUTThe Commission’s relay failed or was too slowRetry with backoff, bounded
MS_MAX_CONCURRENT_REQ, GLOBAL_MAX_CONCURRENT_REQToo many requests in flight, for one state or overallSlow down; pace your batch
INVALID_INPUTThe country code or the number is malformedFix the input; check the structure before calling
INVALID_REQUESTER_INFOThe requester VAT number is malformedCheck your own number and its prefix
IP_BLOCKED, VAT_BLOCKEDThe caller or the number is blocked by the serviceStop and investigate the request pattern

REST or SOAP: which one should you call?

Both are the same service in front of the same 27 registers and answer the same question; they differ in transport, in how the consultation number is asked for, and in what fails first. The REST API (JSON, published in 2021) is the one to build on; the SOAP service (the original checkVatService, WSDL at https://ec.europa.eu/taxation_customs/vies/checkVatService.wsdl) is the fallback worth keeping, because the two front ends do not always fail together.

REST APISOAP service
EndpointPOST …/vies/rest-api/check-vat-number, JSON in and outPOST …/vies/services/checkVatService, SOAP 1.1 envelope, SOAPAction empty
Simple checkcountryCode + vatNumberoperation checkVat
Consultation numberrequesterMemberStateCode + requesterNumber in the same body; requestIdentifier in the answeroperation checkVatApprox with requesterCountryCode + requesterVatNumber; requestIdentifier in the answer
ErrorsuserError field (MS_UNAVAILABLE, TIMEOUT…) in a 200, or an HTTP 4xx/5xxa SOAP fault whose faultstring is the same code
Status of the member statesGET …/rest-api/check-status (relay and each national component)none
Typical failure modeHTTP 5xx or a gateway timeout under loadthe same codes as faults; occasionally answers when REST does not
Toolingany HTTP clientany HTTP client with a hand-written envelope, or a SOAP library

Veriport calls REST first and retries once over SOAP when REST fails for a reason that is not the number’s; input and requester errors are final on the first transport.

What are the limits of the VIES API?

The Commission publishes no numeric quota. What it does publish and enforce: a cap on concurrent requests per member state (MS_MAX_CONCURRENT_REQ) and overall (GLOBAL_MAX_CONCURRENT_REQ), blocking of an address or a number whose request pattern looks abusive (IP_BLOCKED, VAT_BLOCKED), and the scheduled unavailability windows of each national component (the help page lists them; the self-monitoring page shows the live state). In practice: send one request at a time per member state from one address, wait for the answer before the next, retry the concurrency codes after a pause rather than immediately, and never validate the same number in a loop. A batch of 10,000 numbers takes hours this way; that is the service’s design, not a defect.

  • No key, no quota, no SLA: VIES is a public utility, not an API product; a 99.9 % expectation is the wrong one.
  • Timeouts are yours to set: Veriport waits 8 seconds per transport; the Commission’s help page mentions no figure.
  • Name and address are published by some member states only; Germany answers ---; that is not a limit you can work around through VIES.
  • The UK (GB) left VIES on 1 January 2021; only XI numbers remain. Switzerland and Norway were never in it.

What do you still have to build around it?

Four things, in the order an outage makes you need them: a structural check (prefix, length, check digit) so impossible numbers never reach VIES; a cache of the last answer per number, dated and marked as cached when you serve it during an outage; a bounded retry with backoff that honours the concurrency codes; and storage of the evidence (date, result, consultation number). The guide "VIES is down: validate anyway" walks through each. Veriport is that layer as one REST call, with the same answer shape for the 27 member states and Northern Ireland, 100 calls a month free.

Questions

Is the VIES API free?
Yes. The European Commission provides VIES at no charge and without registration, through a REST API and a SOAP service.
Does VIES return the company name?
Only where the member state publishes it. Several do not: Germany, for example, returns "---" for the name and the address, and confirms them only through its own qualified confirmation service.
Can I check UK VAT numbers on VIES?
Not since 2021, except Northern Ireland numbers with the XI prefix, for trade in goods. Great Britain numbers are checked with HMRC’s own API.

100 calls a month, the cache and the retries included.

Get a free key

Sources