Attest 1.2.1

Attest

Validates national identification numbers, tax identification numbers, VAT codes and postal codes for 87 countries.

Attest started as a fork of CountryValidator by Anghel Valentin, which has had no release since 1.1.3. The country coverage comes from that project; 197 defects in it have been fixed since, each against the rule the country actually publishes. See NOTICE for attribution and CHANGELOG.md for the detail.

Install

dotnet add package Attest
dotnet add package Attest.DataAnnotations

Targets netstandard2.0 and net8.0. The newest minor is the supported line — fixes ship forward rather than being backported — and netstandard2.0 stays until keeping it costs something.

A verdict change is never a patch here, so a minor release can change the answer for numbers you have already stored. CHANGELOG.md says which, in both directions, for every release.

Coming from CountryValidator? MIGRATION.md lists every verdict that changes, in both directions. Read the section on numbers that used to be accepted and now are not before you upgrade anything that stores what it validated.

What this checks, and what it does not

Attest checks that a number is well formed: the right shape for that country, carrying the check digits the issuing authority publishes. It runs in-process and makes no network call, so it is the cheap first gate on a form, an import or a batch of rows.

It cannot tell you a number is registered. A VAT number can be perfectly well formed and belong to nobody, or have been deregistered last week. For EU VAT that answer only comes from the European Commission's VIES service, and vies-dotnet-api makes that call. The two compose rather than compete: reject the malformed ones here without a round trip, and ask VIES about the ones that survive.

What is different from upstream

The short version of three repair waves, all of it verified by running the code rather than reading it:

• Hungary accepted none of the 36,363,636 valid tax ids there are. Its checksum summed UTF-16 code units instead of digit values, adding a constant 48 x (1+...+9) = 2160, which is 4 mod 11. The check digit it computed was therefore always the correct one plus 4, mod 11, and so could never equal it. The count is an enumeration of the whole space; the impossibility is arithmetic.
• 22 of 87 validators threw instead of returning a result — on null, on short input, on a letter where a digit belonged. A sweep over every country and every method now proves none does.
• Mexico and South Africa could never validate anything: their date helpers always returned false. Malaysia, Canada and San Marino had inverted guards, so they accepted everything, including the empty string, and rejected the real formats.
• Test data was fiction. Thailand's tax-code tests used a Swedish personnummer; Cyprus's only national-id test was a Czech rodné číslo copied from the Czech file. Both passed for years.
• Every bug report left open upstream is answered. Ten of the twelve open issues report a defect — the other two ask whether the project is maintained and what the four Validate methods mean. The ten are the Netherlands' post-2020 btw-identificatienummer, Belgium's check number below ten (reported twice), Belgian enterprise numbers starting with 1, Finland's 2023 HETU separators, the printed Swiss TVA number, Mexico's unreachable company RFC, Chile, Paraguay and Uruguay, the Indian Aadhaar validator throwing on a letter and the GSTIN that replaced the VAT TIN in 2017, and the French VAT number capped at nine characters. Each is asserted with its reporter's own value in UpstreamReportTests.cs.

The test suite went from 586 cases to 4,212, and every validator now has one. What is still weak is written down rather than hidden: KNOWN-ISSUES.md lists 33 entries by country: 19 still-open gaps, almost all of them check digits no authority publishes, and 14 the repair waves investigated and closed as decided rather than pending.

Use

using Attest;

var validator = new CountryValidator();

ValidationResult result = validator.ValidateIndividualTaxCode("93051822361", Country.BE);
if (!result.IsValid)
{
    Console.WriteLine(result.ErrorMessage);
}

Asking by category

When you do not want to name a method — "is this any business identifier for this country?" — ask by kind:

using Attest;

var validator = new CountryValidator();

IdentifierResult result = validator.Validate(value, Country.BE, IdentifierKind.Business);

if (result.IsValid && !result.IsAmbiguous)
{
    // definitely a company number or a VAT number
}

IdentifierKind is a flags enum: PersonalId, PersonalTaxCode, CompanyNumber, Vat, PostalCode, plus the combinations Person, Business and Any (the default, which covers personal and business identifiers but not postal codes).

Two things the result tells you that a plain boolean cannot:

• IsAmbiguous — a few countries issue one number that serves as both a personal and a business identifier. Armenia (the 8 digit ՀՎՀՀ, whose digits carry no meaning by the State Revenue Committee's own account) and Nigeria issue literally one number for both. In Russia, Peru, Indonesia and Ukraine the overlap is narrower: a sole trader files VAT under their personal number, so that number is a VAT identifier as well as a personal one. There, a value asked about as a business identifier can be valid and indistinguishable at the same time, and the flag says so instead of guessing.
• Supports(country, kind) — whether the country has a rule for that kind at all. A kind with no rule reports every value invalid, which is not a verdict on the value. 25 of the 435 country/kind pairs in this library have no rule.

Matched lists every kind the value is valid as, and Details carries the individual ValidationResult for each kind that was evaluated.

Each country also has its own validator class in Attest.Countries, if you want to skip the dispatch:

using Attest.Countries;

bool valid = new BelgiumValidator().ValidateVAT("BE0428759497").IsValid;

Using Data Annotations

[HttpPost]
public IActionResult ValidateSSN([Required, SSNAttribute(Country.US)] string ssn)
{
    if (!ModelState.IsValid)
    {
        return BadRequest();
    }

    return Ok();
}

Supported countries

<a href="https://buymeacoffee.com/egoushka" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/default-orange.png" alt="Buy Me A Coffee" style="height: 51px !important;width: 217px !important;" ></a>

Contributing

CONTRIBUTING.md has the rules this project runs on — every one of them exists because a validator here was wrong for years without anyone noticing. The short version: cite a published source for any rule you change, compute your own test numbers rather than copying them, and never write a test that asserts behaviour you believe is wrong.

docs/adding-a-country.md walks through adding or fixing a country.

KNOWN-ISSUES.md is the backlog: weaknesses found and deliberately left alone, each with the reason. Most are one validator and its test file, which makes them the natural place to start.

Security reports go through SECURITY.md. Conduct: Contributor Covenant.

Upgrading from CountryValidator: MIGRATION.md.

License

Apache License, Version 2.0 — see LICENSE.

Copyright 2020 Anghel Valentin (original work) Copyright 2026 Yehor Hrabovskyi (changes)

Special thanks

Python Stdnum