Guide 10 min read

Bulk GSTIN Verification Speed and Throughput

How fast bulk GSTIN verification really runs — concurrency, rate limits, batching and the arithmetic for clearing a 50,000-row vendor master.

Written and reviewed by the GSTIN API team Last reviewed

"Which bulk GSTIN verification tool processes the most records per minute?" is the wrong question, and the vendors who answer it with a single number are answering a question about their marketing rather than your batch. Throughput is not a property of a provider. It is concurrency divided by per-call latency, bounded by a rate limit and by how heavily loaded the government systems are at the moment you run.

The good news is that this makes throughput something you control. This page gives you the arithmetic, the design that sustains a rate rather than spiking and collapsing, and a worked example for a 50,000-row vendor master.

The throughput arithmetic, in one line

Verifications per minute = (concurrent in-flight requests ÷ average seconds per request) × 60, capped by the provider's rate limit.

ConcurrencyAt 300ms/callAt 600ms/callAt 1.2s/call
5 workers1,000/min500/min250/min
10 workers2,000/min1,000/min500/min
20 workers4,000/min2,000/min1,000/min
50 workers10,000/min5,000/min2,500/min
Sustained throughput at different concurrency levels and latencies, before rate limiting.

The table is arithmetic, not a promise — the right-hand columns are the realistic ones, and every row is subject to the rate limit on your account. Its purpose is to show you which lever moves the number. Halving latency and doubling concurrency have identical effects, and you control the second one directly.

What sets the ceiling — and it is not the provider

Four constraints bind, roughly in this order:

  • The provider rate limit. A hard ceiling. Exceeding it returns 429 Too Many Requests, and retrying into a 429 wastes capacity you are still being measured against. Handle it properly — see rate limits, retries and webhooks.
  • Upstream government load. Shared by every provider. On a filing deadline day, the per-call latency term in the equation above simply gets bigger for everyone.
  • Your own infrastructure. Connection pool size, DNS resolution, database writes per result, and the worker count you actually have running. Batches often stall on the database write, not the API call.
  • Error handling cost. Every retry is a call that produced no new record. A batch with a 15% retry rate is doing 15% more work for the same output.

The cheapest speed-up: verify fewer rows

Every call you do not make is infinitely fast and free. Real vendor masters are full of rows that do not need a call at all, and filtering them is worth more than any tuning.

  1. Deduplicate on GSTIN. A supplier appearing on 40 invoice lines is one verification. Deduplicate before the queue, not after.
  2. Reject invalid formats locally. The 15-character structure and mod-36 checksum are checkable in your own code in microseconds. Typos, truncated values and PAN numbers pasted into the wrong column all fall out here — see GSTIN format explained.
  3. Skip anything already fresh. If you store verified_at, a row verified yesterday does not need re-verifying today unless it is at a decision point.
  4. Tier by risk. Re-verify high-spend and recently flagged counterparties often, and the long tail quarterly. One cadence for everybody is what makes a batch large in the first place.

In practice these four steps routinely take a nominal 50,000-row file down to a much smaller number of real calls — which shortens the run and cuts the bill in the same motion.

A worker design that sustains its rate

The pattern that survives contact with a real 50,000-row file:

  • One queued job per GSTIN, not one job for the file. A crash loses one record, not the run, and progress is inspectable at any moment.
  • Rate limiting on the worker side, sized just under the provider limit, so you never rely on 429s as your flow control.
  • Idempotent writes keyed on the GSTIN, so a retried job overwrites rather than duplicates.
  • Exponential backoff with jitter on 429, 502, 504 and network errors — jitter matters, or every retry in the batch fires at the same instant.
  • A dead-letter bucket for records that exhausted retries, reviewed at the end instead of blocking the run.
  • A progress counter and an ETA, because a two-hour run with no visible progress will be cancelled and restarted by someone, which doubles the cost.

The full implementation, including CSV ingestion and reporting, is in the bulk GSTIN verification guide and bulk verification from a CSV upload.

Worked example: a 50,000-row vendor master

A procurement team with 50,000 rows in an export. What actually happens:

StepEffectRows remaining
Raw export—50,000
Deduplicate on GSTINRepeated suppliers collapse to one row each~32,000
Local format and checksum filterTypos and blanks removed at zero cost~30,000
Skip rows verified inside the freshness windowOnly on subsequent runs, not the first~30,000
API calls at ~1,000/min sustained10 workers at roughly 600ms per call≈30 minutes wall clock
Cost at ₹0.4030,000 verifications₹12,000
A first full-master run, step by step. Reduction figures are illustrative of typical real files.

The second run of the same master is dramatically cheaper and faster, because most rows are inside the freshness window and only new or stale ones need a call. That is the shape a daily monitoring job takes — described in automated daily vendor GSTIN monitoring.

Measuring throughput honestly

Three rules keep a throughput number meaningful:

  • Measure sustained, not peak. The first thirty seconds of a run always look excellent, because no retries have accumulated yet and no connection pool is saturated. Report completed verifications divided by total wall-clock time for the whole run.
  • Count retries as work. A run that completed 30,000 records using 36,000 calls did 36,000 calls' worth of work and was billed accordingly. Report both numbers.
  • Report completeness alongside speed. A batch that finished quickly because 8% of responses came back with null filing history did not finish; it produced 8% of records you will have to do again.

Track those three across two runs on different dates and you will have a far better answer to "how many records per minute" than any vendor can give you — because it will be an answer about your data, your infrastructure and your rate limit.

Frequently asked questions

Throughput is concurrency divided by per-call latency, not a fixed vendor number. At 600ms per call, 10 concurrent workers sustain roughly 1,000 verifications per minute and 20 workers roughly 2,000 — provided the provider rate limit and the upstream government systems allow that rate. Any vendor quoting records-per-minute without stating the concurrency it assumes is quoting a marketing number.
After deduplication and local format filtering, typically a few tens of thousands of real calls. At a sustained 1,000 per minute that is roughly half an hour to an hour of wall-clock time. The dominant variables are how many duplicates you removed first and whether you scheduled the run away from GST filing deadlines.
No. Past the provider rate limit, extra concurrency converts into 429 responses and retries, which lowers effective throughput while raising load on everyone. The correct approach is to raise concurrency gradually until your error rate starts climbing, then settle just below that point.
A queue, always. An in-request loop ties up a web worker for the duration, cannot survive a deploy or a crash, and gives you no way to resume from where it stopped. A queued job per GSTIN, with worker-side rate limiting, is resumable, observable and safe to scale.
Away from GST return filing deadlines — the 11th, 13th and 20th of the month in the usual monthly cycle — when the underlying government systems carry their heaviest load and latency rises for every downstream API at once. An overnight run on a quiet date routinely finishes faster than a daytime run on a deadline date with identical code.
At GSTIN API rates, 50,000 verifications is ₹20,000 at ₹0.40 per verification, before any savings from deduplication and caching. Both usually cut a first full-master run substantially, because real vendor files carry a lot of repeated and malformed GSTINs.

A note on accuracy. GST rules change often. This article reflects our understanding as of 3 September 2026 and is general information, not tax or legal advice. For the authoritative position, check gst.gov.in and cbic-gst.gov.in, or speak to a qualified tax professional about your specific situation.

Check a GSTIN right now, free

Five lookups a day, no account required. Status, filing history, e-invoicing and jurisdiction.

Free GST search tool

Build it into your product

One REST call, JSON back. Get an API key and 20 free verification credits in under a minute.

Start free