# Validate an NPI

URL: https://docs.healthcare.dev/reference/providers/validate-an-npi

```http
GET https://api.healthcare.dev/v1/providers/{npi}/validate
```

Format and check digit (Luhn with the 80840 prefix), whether CMS has issued it, whether it is active, and its deactivation history. Any string is accepted; a malformed NPI is reported, not rejected.

Requires an API key: `Authorization: Bearer hdev_live_...`. See [Authentication](/authentication).

## Path parameters

| Name | Type | Required | Description | Example |
| --- | --- | --- | --- | --- |
| `npi` | string | yes | NPI to check | `1234567893` |

## Examples

**curl**

```sh
curl "https://api.healthcare.dev/v1/providers/1234567893/validate" \
  -H "Authorization: Bearer $HDEV_API_KEY"
```

**TypeScript**

```ts
const res = await fetch("https://api.healthcare.dev/v1/providers/1234567893/validate", {
  headers: { Authorization: `Bearer ${process.env.HDEV_API_KEY}` },
});
const { data, meta } = await res.json();
```

**Python**

```python
import os
import requests

res = requests.get("https://api.healthcare.dev/v1/providers/1234567893/validate", headers={"Authorization": f"Bearer {os.environ['HDEV_API_KEY']}"})
body = res.json()
```

## Response

The result

```json
{
  "data": {
    "npi": "string",
    "valid_format": true,
    "valid_check_digit": true,
    "exists": true,
    "status": "active",
    "deactivation_history": [
      {
        "deactivated_on": "2026-10-01",
        "reactivated_on": "2026-10-01"
      }
    ]
  },
  "meta": {
    "source": "cms-icd10",
    "data_version": "2026.1",
    "retrieved_at": "2026-10-24T12:00:00Z",
    "license": "Public domain (CMS). Reference data, not medical advice."
  },
  "links": {
    "self": "/v1/providers/1234567893/validate",
    "next": null
  }
}
```

### Fields

| Field | Type | Always present | Description |
| --- | --- | --- | --- |
| `npi` | string | yes |  |
| `valid_format` | boolean | yes |  |
| `valid_check_digit` | boolean | yes |  |
| `exists` | boolean | yes |  |
| `status` | "active" \| "deactivated" \| null | yes |  |
| `deactivation_history` | object[] | yes |  |

## Errors

Errors are `application/problem+json` ([RFC 9457](https://www.rfc-editor.org/rfc/rfc9457)). Branch on `type`, not on `title`. See [Errors](/errors).

| Status | `type` | When |
| --- | --- | --- |
| 400 | `invalid-request` | A parameter or the body failed validation; `errors` lists each field. |
| 401 | `unauthorized` | Missing, malformed or revoked API key. |
| 404 | `not-found` | No record with that id (retired records are still returned). |
| 429 | `rate-limited / quota-exceeded` | Too many requests per second (retry after `Retry-After`), or the monthly quota is used up. |
| 503 | `dataset-unavailable / unavailable` | The dataset has no published version yet, or the service is degraded. |