GST Verification in Make.com Scenarios

Make.com (formerly Integromat) suits GST verification because its scenarios are drawn the way the process actually runs: a trigger, a check, one API call, then a router that sends active and cancelled suppliers down different paths. This guide builds the whole scenario: a Google Sheets, webhook or form trigger, a format filter that stops bad GSTINs before they cost anything, the HTTP module calling the API with your key, a router on the returned status, a write-back to the sheet, and error handler routes that retry a 429 or a 502 instead of quietly dropping the row.

The shape of the scenario

Whatever feeds it, a GST verification scenario in Make has the same five stages:

1. Trigger — a new row in Google Sheets, a custom webhook from your app, or a form submission.
2. Format filter — a filter on the link after the trigger that only passes well-formed GSTINs.
3. HTTP > Make a request — the API call, one per bundle.
4. Router — Active goes one way, Cancelled, Suspended or not registered another.
5. Write back and alert — update the source row, notify a person when it matters.

If you have built this in n8n, Zapier or Power Automate, the logic will look familiar. What is specific to Make is that each record travels as a bundle through the scenario, filters sit on the lines between modules rather than being modules themselves, and error handling is a route you attach to a module rather than a setting.

Step 1: pick a trigger

Choose the trigger that matches where the GSTIN first enters your process:

• Google Sheets > Watch New Rows for a vendor onboarding sheet. It is a polling trigger: it checks the sheet each time the scenario runs on its schedule, and its limit setting caps how many new rows it picks up per run, which becomes your throttle later.
• Webhooks > Custom webhook when your own application should ask Make to verify a GSTIN at signup or checkout. Your app POSTs JSON containing the GSTIN, the scenario runs immediately, and a Webhook response module at the end can send the result back to the caller.
• A form app — Google Forms, Typeform, Tally or similar — when suppliers or staff submit their details through a form. Most have a "watch responses" trigger in Make.

Whichever you use, clean the value once and reuse it. In the HTTP module's URL and everywhere downstream, map the GSTIN through upper(trim(...)) so a trailing space or a lowercase letter from a pasted value does not turn into a failed lookup. If you swap the trigger later, only that one mapping changes.

Step 2: check the GSTIN format before you spend a call

A GSTIN is 15 characters with a fixed structure: a two-digit state code, the holder's PAN, an entity number, a literal Z and a check character. The anchored pattern, explained character by character in GSTIN regex explained, is:

^[0-9]{2}[A-Z]{5}[0-9]{4}[A-Z][1-9A-Z]Z[0-9A-Z]$

Click the line between the trigger and the next module and set up a filter. Use the text operator for matching a pattern, with the cleaned GSTIN on the left and the pattern above on the right. Bundles that fail the filter simply stop there, and a filter does not run the HTTP module, so a malformed row never uses an operation on the call.

Stopping silently is fine for a webhook, but for a sheet you usually want to see which rows were rejected. Put a Router straight after the trigger instead: the first route carries the pattern filter and continues to the API call; a second route with the negated filter goes to a Google Sheets > Update a Row module that writes "Invalid format" into the status column. The pattern does not verify the final check character, which needs a mod-36 calculation; our API rejects a GSTIN that fails the check digit without billing a credit, so it is safe to let those through. Paste suspect values into the GSTIN validator to see which rule they break, and read validation vs verification if the difference between the two checks is not yet clear.

Step 3: the HTTP "Make a request" module

Get a key from the API access page, add an HTTP > Make a request module on the valid route, and configure it like this. Labels shift slightly between versions of the module, but every one of these settings exists in some form:

Setting	Value	Why
URL	https://gstinapi.com/api/get-taxpayer-info/ followed by the mapped, cleaned GSTIN	The GSTIN goes in the path
Method	GET	The lookup is a read; there is no request body
Headers	Name X-API-Key, value your key	The only authentication the API needs
Parse response	Yes	Turns the JSON body into fields you can map and filter on
Evaluate all states as errors	Yes	Makes a 4xx or 5xx raise an error, so the error handler route runs
Timeout	15–30 seconds	Stops a bundle hanging on a slow upstream response

The request the module sends is nothing more than this, which is also a quick way to test your key from a terminal before you build anything:

curl https://gstinapi.com/api/get-taxpayer-info/27AAACR5055K1Z7 \
  -H "X-API-Key: YOUR_API_KEY"

Run the module once with a known GSTIN so Make learns the response structure; after that, its fields show up in the mapping panel. The call answers HTTP 200 even for a GSTIN with no registration behind it, so read the body, not just the status code. The registration sits under taxpayer_data: status_code is 1 for a found registration and 0 when none exists, with the reason in taxpayer_data.error and no credit charged. Alongside it come name (the legal name), tradename, status, registrationDate, constitution and the principal address in pradr, with GSTR filing history in filing_data from the same response. The full schema is in the API documentation.

Step 4: a router for active and cancelled GSTINs

Add a Router after the HTTP module with two routes. Put the filters on the lines coming out of it:

• Active route. Filter: taxpayer_data.status_code equals 1 and taxpayer_data.status equals Active. It leads to a Google Sheets > Update a Row module that uses the row number from the trigger and writes the status, the legal name from taxpayer_data.name, the registration date and the time of the check. Record the timestamp every time; a "verified" flag with no date is useless a month later.
• Everything else. Mark this route as the router's fallback, so it catches every bundle the Active filter rejects: Cancelled, Suspended, and status_code 0 for a GSTIN with no registration. It writes the status (or "Not registered") back to the same row, then sends a Slack message or an email with the GSTIN, legal name and status.

If Cancelled and Suspended need different treatment, nest a second router on the fallback route. Suspended often deserves a review rather than an immediate block; the reasoning is in automated daily vendor GSTIN monitoring. Cancelled deserves the alert because a supplier whose registration is cancelled cannot charge GST from the cancellation date, so tax on their later invoices is not something you can take input tax credit on. For a webhook-triggered scenario, end both routes with a Webhook response so your application gets the status back in the same request.

Error handler routes: retry, break and ignore

Right-click the HTTP module and add an error handler. Make offers five directives — Resume, Ignore, Break, Rollback and Commit — and a filter on the error route lets you pick one per failure. The status codes the API returns decide which:

Response	Meaning	Directive
429	Too many requests for this key	Break, with automatic completion and a retry interval
502	The government source did not answer; not billed	Break, with automatic completion and a retry interval
401	Invalid or missing API key	Alert, then Break without retry; retrying cannot fix a wrong key
402	Insufficient credits	Alert, then Break; top up and re-run the stored executions
200 with status_code 0	Not registered, or failed validation; not billed	Not an error: the router's fallback route handles it

Break is the directive that matters. It stops processing that bundle and stores it as an incomplete execution, and with automatic completion on, Make retries it after the interval you set, a set number of times. Stored incomplete executions have to be allowed in the scenario settings for this to work. Use Ignore only where losing the bundle is genuinely fine, such as a blank GSTIN cell that slipped past an unfiltered trigger; using it for a 429 would mark nothing and tell nobody. Resume, which substitutes output you define, is the wrong tool here: it would let a failed lookup continue down the router as if it had an answer. Why a steady pace beats retries is covered in GST API rate limits, retries and webhooks, and the status page tells you whether a run of 502s is the upstream source or something on your side.

Bulk rows, operations and scheduling

Make counts an operation each time a module runs for a bundle. A verified sheet row therefore costs at least three — reading the row, the HTTP call and the write-back — plus one for an alert. Filters that stop a bundle before the HTTP module save the call. Check your plan's current allowance on Make's pricing page; a backfill of a few thousand vendors can use a meaningful share of a month's operations in a single afternoon.

• Limit rows per run. Set the Watch New Rows limit to a modest number, say 25 to 50, so each scheduled run verifies a bounded batch and stays well under the per-key rate limit in the API documentation.
• Schedule it. Run the scenario at a regular interval — every 15 minutes during onboarding, daily for a stable list — instead of on demand. The schedule plus the row limit is your pacing; add a Tools > Sleep module only if you need gaps inside a run.
• Re-verify on a cycle. For an existing vendor list, a second scenario on a weekly or monthly schedule can use Google Sheets > Search Rows to pick rows whose last check is older than your cut-off and run them through the same HTTP module and router.

For a large one-off backfill, it is usually simpler to upload the file to bulk verification and keep the Make scenario for new rows. If your team already lives in a spreadsheet, the Google Sheets guide covers doing it without a workflow tool at all. API cost is the same as any other integration: ₹0.50 per verification, or ₹0.40 once a single credit purchase crosses 2,500 credits, purchased credits do not expire, and only a lookup that returns a registration is charged.

Frequently asked questions

Is there a native GSTIN verification app in Make.com?

Not as far as we are aware at the time of writing. You do not need one: Make's built-in HTTP app can call any REST API, and a GST verification call is a single GET request with one header. If a dedicated app appears later, the scenario logic in this guide stays the same.

Where do I put the API key in a Make.com scenario?

The API expects it in an X-API-Key request header. Add it as a header on the HTTP module, or, if your account offers the API-key variant of the HTTP request module, store it in a keychain so it is not visible in the module settings. Either way, rotate the key if a scenario blueprint containing it was ever shared.

Does a malformed GSTIN cost a credit or an operation?

On our side, no: a GSTIN that fails format or check-digit validation never reaches the upstream lookup and is not billed. On Make's side, the HTTP module still runs and counts as an operation, which is why this guide checks the format with a filter before the HTTP module.

How do I stop a 429 from failing the whole scenario?

Attach an error handler to the HTTP module and use the Break directive with automatic completion turned on, so the failed bundle is stored as an incomplete execution and retried after an interval. That requires allowing incomplete executions in the scenario settings. Pacing the scenario, by limiting rows per run, keeps 429s rare in the first place.

Can Make.com verify a few thousand GSTINs from a sheet?

Yes, but every row costs several operations: the search or watch, the HTTP call and the write-back at minimum. For a one-off backfill of thousands of rows, a CSV upload to bulk verification is usually cheaper, and the Make scenario can then handle new rows as they arrive.

What should the scenario do when a GSTIN comes back Cancelled?

Write the status back to the source record and alert a person, typically in Slack or by email. A cancelled registration means the supplier cannot legally charge GST from the cancellation date, so invoices from them need review before you pay or claim input tax credit on them.