Get the bank of a card

GEThttps://api.veriko.mx/v1/public/bin-lookup/{bin}

Audience: public

Resolves the issuing bank of a payment card from its BIN (Bank Identification Number).

Accepts 6 to 16 digits, although only the leading 6-8 are used. The BIN returned in the response is the prefix that matched in the lookup, along with the banking institution's information.

The returned banxico_code is the 5-digit code that identifies each banking institution participating in SPEI.

Parameters
Parameter	In	Type	Required	Description
`bin`*	path	`string`	required	BIN or card number (6 to 16 digits). Only the leading 6-8 are used. e.g. `45320151`

Request

cURLPythonJavaScriptPHP

curl -X GET 'https://api.veriko.mx/v1/public/bin-lookup/{bin}'

import requests

bin = "424242"
response = requests.get(f"https://api.veriko.mx/v1/public/bin-lookup/{bin}")
print(response.json())

const bin = "424242";

fetch(`https://api.veriko.mx/v1/public/bin-lookup/${bin}`)
  .then(response => response.json())
  .then(data => console.log(data));

<?php

$bin = "424242";
$ch = curl_init("https://api.veriko.mx/v1/public/bin-lookup/$bin");

curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

echo $response;

**Response 200**`BinLookupResponse` — BIN information: issuing bank and metadata.
Field	Type	Description
`data`	`object`	Main response payload. Shape varies by endpoint (object, array, or JSON:API envelope with `type`, `id`, `attributes`).
`type`*	`string`	API resource type (`bin_lookup` by default). e.g. `bin_lookup`
`id`*	`string`	The 6-8 digit BIN that matched in the lookup. e.g. `45320151`
`attributes`*	`object`	Attributes of the BIN and the associated bank.
`bin`*	`string`	The 6-8 digit BIN that matched in the lookup (same value as `id`). e.g. `45320151`
`bank_name`*	`string`	Official name of the banking institution. e.g. `BBVA MEXICO`
`banxico_code`*	`string \| null`nullable	5-digit code of the banking institution in the SPEI system, or `null` when the bank is not a SPEI participant (e.g. Amex). e.g. `40012`
`card_brand`	`string \| null`nullable	Card network (VISA, MASTERCARD, …), or `null` if unknown. e.g. `VISA`
`card_type`	`string \| null`nullable	Card type (CREDIT, DEBIT, PREPAID, …), or `null` if unknown. e.g. `CREDIT`
`card_level`	`string \| null`nullable	Card level (GOLD, PLATINUM, …), or `null` if unknown. e.g. `GOLD`
`country_iso`*	`string`	Issuing country code (in ISO-3166 alpha-2). e.g. `MX`
`meta`	`object`	Response metadata including API version, route prefix, unique request identifier, and the server timestamp in UTC.
`version`	`string`	API version that processed the request. e.g. `1.47.0`
`api_version`	`string`	API route prefix version (e.g. `v1`). e.g. `v1`
`request_id`	`string`	Unique request identifier (hex). e.g. `a1b2c3d4e5f6`
`datetime`	`object`	Companion descriptor present in every response's meta block (and in outgoing webhook payloads). Lets clients assert the timezone contract without re-reading the spec. e.g. `{"timezone":"UTC","format":"ISO 8601"}`
`timezone`*	`string`	Always `UTC` — the canonical timezone for every datetime field in the body. e.g. `UTC`
`format`*	`string`	Always `ISO 8601` — explicit `Z` suffix on every datetime. e.g. `ISO 8601`
`links`	`object`	Pagination or related links, present only when the endpoint returns a paginated collection.

**Response status codes**`GET /v1/public/bin-lookup/{bin}`
Status	Class	Description	Body
200	`2xx`	BIN information: issuing bank and metadata.	`BinLookupResponse`
404	`4xx`	The resource does not exist or is not visible to the client	`Error`
422	`4xx`	Request validation failed.	`ErrorResponse`
429	`4xx`	Rate limit exceeded	`ErrorResponse`

**Errors from `GET /v1/public/bin-lookup/{bin}`**
Status	Code	Example
422	`validation_error`	The fecha field is required. Envelope source.pointer `/data/attributes/fecha` meta.request_id `e6f7a8b9c0d1`
429	`rate_limit_exceeded`	Rate limit exceeded. Try again in 45 seconds. Envelope meta.request_id `f7a8b9c0d1e2` Response headers `Retry-After`: integer — Seconds to wait before retrying. Matches the endpoint's rate-limit window (typically 60s for list endpoints, 1-5s for in-flight idempotent operations). `X-RateLimit-Limit`: integer — Configured request cap for this bucket (emitted only on 429). `X-RateLimit-Remaining`: integer — Requests remaining in the current window — always 0 at the moment of the 429 (emitted only on 429). `X-RateLimit-Reset`: integer — Absolute Unix epoch (seconds) when the window resets. Emitted only on 429, alongside Retry-After. Per-endpoint overrides exist (e.g. `rate_limited_login`).