Validating UPI IDs Using a Secure API

Overview

In digital payment systems, validating a UPI (Unified Payments Interface) ID before initiating a transaction is essential to ensure accuracy and reduce failures. This article explains how to integrate a UPI ID validation API using C# (ASP.NET) and JavaScript without disclosing sensitive implementation details. We'll use a dummy endpoint for demonstration.

Why Validate UPI IDs?

• Avoid transaction failures due to incorrect UPI IDs
• Improve user experience by providing real-time feedback
• Ensure the UPI ID belongs to the correct customer

Technologies Used

• C# (ASP.NET WebForms/Backend)
• JavaScript (AJAX for frontend calls)
• JSON for data communication
• Dummy API endpoint (replace with actual provider)

Example API Request

POST https://dummyapi.example.com/v1/payments/validate/vpa
Content-Type: application/json
{
    "vpa": "user123@dummyupi"
}

Successful Response

{
  "vpa": "user123@dummyupi",
  "customer_name": "John Doe",
  "success": true
}

Invalid UPI Response

{
  "error": {
    "code": "BAD_REQUEST_ERROR",
    "description": "Invalid VPA. Please enter a valid Virtual Payment Address",
    "source": "customer",
    "step": "payment_initiation",
    "reason": "invalid_vpa"
  }
}

Backend Implementation (C#)

Here’s a simplified C# function to validate a UPI ID via HTTP POST.

public static string ValidateUPIID(string upi)
{
    string responseJson = "";
    try
    {
        var requestObj = new { vpa = upi };
        string requestJson = new JavaScriptSerializer().Serialize(requestObj);

        HttpWebRequest request = (HttpWebRequest)WebRequest.Create("https://dummyapi.example.com/v1/payments/validate/vpa");
        request.Method = "POST";
        request.ContentType = "application/json";

        byte[] data = Encoding.UTF8.GetBytes(requestJson);
        using (var stream = request.GetRequestStream())
        {
            stream.Write(data, 0, data.Length);
        }

        using (HttpWebResponse response = (HttpWebResponse)request.GetResponse())
        using (StreamReader reader = new StreamReader(response.GetResponseStream()))
        {
            responseJson = reader.ReadToEnd();
        }

        if (responseJson.Contains("success"))
        {
            var jsonObj = new JavaScriptSerializer().Deserialize<UPIResponse>(responseJson);
            return jsonObj.success ? $"success - {jsonObj.customer_name}" : "failed - ";
        }
        else if (responseJson.Contains("error"))
        {
            var errorObj = new JavaScriptSerializer().Deserialize<UPIErrorResponse>(responseJson);
            string errDesc = !string.IsNullOrEmpty(errorObj.error.description) ? errorObj.error.description : "Invalid VPA";
            string errReason = !string.IsNullOrEmpty(errorObj.error.reason) ? errorObj.error.reason : "invalid_vpa";
            return $"reason - {errDesc} - {errReason}";
        }

        return "failed - unknown error";
    }
    catch (Exception ex)
    {
        return "error - " + ex.Message;
    }
}

public class UPIResponse
{
    public string vpa { get; set; }
    public string customer_name { get; set; }
    public bool success { get; set; }
}
public class UPIErrorResponse
{
    public UPIError error { get; set; }
}
public class UPIError
{
    public string code { get; set; }
    public string description { get; set; }
    public string source { get; set; }
    public string step { get; set; }
    public string reason { get; set; }
}

JavaScript Frontend (AJAX Call)

<div class="bid-content-common bid-content-3">
    <label class="upiid-lble">UPI ID</label>
    <input id="txtupiid" runat="server" type="text" placeholder="Enter the UPI ID"
           onchange="UPIIDtxtboxchanges()" onblur="handleBlur()" />
    <span id="upidtxt"></span>
    <input id="upidvalidation" type="hidden" />
    <button id="applybtn">Apply</button>
</div>

<script>
    function UPIIDtxtboxchanges() {
        var applybtn = document.getElementById("applybtn");
        var upitxt = document.getElementById("upidvalidation");
        var txtbutton = document.getElementById("txtupiid");
        var verifytxt = document.getElementById("upidtxt");

        upitxt.value = 'Verify';
        upitxt.style.backgroundColor = "#F0F0F0";
        upitxt.style.border = "2px solid #979F6E";
        upitxt.style.color = "black";
        verifytxt.innerText = "";
        applybtn.style.pointerEvents = "auto";
    }

    function handleBlur() {
        // Assuming upivalidationmethod takes a callback function
        upivalidationmethod(function (isValid) {
            if (isValid) {
                return true;
            } else {
                return false;
            }
        });
    }

    function upivalidationmethod(callback) {
        var upiId = document.getElementById("upiInput").value;

        $.ajax({
            type: "POST",
            url: "/your-page.aspx/ValidateUPI",
            contentType: "application/json; charset=utf-8",
            data: JSON.stringify({ upi: upiId }),
            success: function (res) {
                var status = res.d.split('-');
                if (status[0] === "success") {
                    $("#message").text("Valid UPI: " + status[1]).css("color", "green");
                    callback(true);
                } else {
                    $("#message").text("Invalid UPI").css("color", "red");
                    callback(false);
                }
            },
            error: function () {
                $("#message").text("Error validating UPI").css("color", "red");
                callback(false);
            }
        });
    }
</script>

Best Practices

• Always encrypt sensitive credentials used in API headers.
• Validate and sanitize inputs to avoid injection or malformed requests.
• Log and monitor UPI validation failures for system analysis.

Conclusion

Integrating a UPI ID validation step into your application ensures smoother payments, fewer failed transactions, and a better user experience. Using an API for this process helps streamline validation with real-time customer name checks and error handling. Replace the dummy API URL and credentials with your actual provider’s details securely in production.