How do I validate an ISIN before calling an API?

The algorithm

1. Uppercase; require ^[A-Z]{2}[A-Z0-9]{9}[0-9]$.
2. Replace each letter with its number: A=10, B=11, …, Z=35, producing a digit string.
3. Apply Luhn to that string: from the right, double every second digit, subtract 9 from doubles above 9, sum everything; the total must be divisible by 10.

Python

python
import re
​
def is_valid_isin(s: str) -> bool:
    s = s.strip().upper()
    if not re.fullmatch(r"[A-Z]{2}[A-Z0-9]{9}[0-9]", s):
        return False
    digits = "".join(str(ord(c) - 55) if c.isalpha() else c for c in s)
    total, double = 0, False
    for ch in reversed(digits):
        n = int(ch)
        if double:
            n = n * 2
            if n > 9:
                n -= 9
        total += n
        double = not double
    return total % 10 == 0
​
assert is_valid_isin("IE00B4L5Y983") and not is_valid_isin("IE00B4L5Y984")

TypeScript

typescript
export function isValidIsin(input: string): boolean {
  const s = input.trim().toUpperCase();
  if (!/^[A-Z]{2}[A-Z0-9]{9}[0-9]$/.test(s)) return false;
  const digits = [...s].map((c) => (c >= "A" ? String(c.charCodeAt(0) - 55) : c)).join("");
  let sum = 0, dbl = false;
  for (let i = digits.length - 1; i >= 0; i--) {
    let n = Number(digits[i]);
    if (dbl) { n *= 2; if (n > 9) n -= 9; }
    sum += n; dbl = !dbl;
  }
  return sum % 10 === 0;
}

SQL (PostgreSQL)

sql
-- format only; use the application for the check digit
select isin from positions where isin !~ '^[A-Z]{2}[A-Z0-9]{9}[0-9]$';

What validation does not tell you

A valid ISIN can be a stock, a bond or an index. Only the API (or a search by name) tells you whether it is a covered fund; a 404 fund_not_found on a valid ISIN is the answer "not a fund", and it is counted. The ISIN validator also computes a missing check digit, and what is an ISIN covers the structure and the national identifiers inside it.