Do I have to validate client-side?

No, but it cuts failed submissions and improves UX. The API validates authoritatively regardless.

What formats are valid?

Eight digits, or a two-letter prefix (like SC or NI) plus six digits. Uppercase the input before checking.

Quickstart: Validate a UK company number before

Basic format check

A UK company number is eight characters: eight digits, or two letters followed by six digits (for example SC123456). Check the shape before you submit:

const ok = /^(?:\d{8}|[A-Z]{2}\d{6})$/.test(number.toUpperCase());
if (!ok) showError('Enter a valid 8-character company number');

Let the API be the authority

Client-side validation improves UX but is not authoritative. The enquiry endpoint validates properly and returns a 400 with a field-level error if the number is wrong — always handle that path too.

Normalise before you check

Users paste company numbers with spaces, lower-case letters and sometimes a leading apostrophe from a spreadsheet. Strip whitespace and upper-case the value before the format check, so a valid number is not rejected on a cosmetic difference:

const clean = raw.trim().toUpperCase().replace(/\s+/g, '');
const ok = /^(?:\d{8}|[A-Z]{2}\d{6})$/.test(clean);

The two-letter prefixes cover the UK registrars — SC for Scotland, NI for Northern Ireland, OC/SO for LLPs and others — so a company registered outside England and Wales still validates. When in doubt, accept the input and let the API be the final judge; over-strict client rules block real companies.

Show the error where it happened

If the API returns a 400 naming the company number, surface that message next to the field, not as a page-level banner. A field-level error the applicant can see and fix in place recovers far more submissions than a generic 'something went wrong'.