zip-codes.com
Paid content
Categories: Development
USPS and Canada Post licensed postal code data. REST API and downloadable databases for U.S. ZIP Codes, Canadian Postal Codes, ZIP+4, and boundary data. Address validation, radius search, demographics, and 90+ data fields. Trusted since 2003.
Related questions
More questions →What Does a Postal Code API Return? Fields, Formats, and Common Use Cases
A postal code API returns structured location data for a given ZIP Code or Canadian postal code. A typical response includes the code itself, city, state or province, county, latitude/longitude, and — where available — ZIP+4 detail. More complete services add time zone, area codes, boundary geometry, and demographic fields. You send a code (or an address), and the API sends back a machine-readable record you can store, validate, or display.
This article explains what those responses contain, how requests are usually shaped, and where postal code data fits into real applications.
First, clear up the word "code"
The keyword "code" is overloaded, and that causes real confusion for developers:
- Postal code — the ZIP Code (U.S.) or postal code (Canada) that identifies a delivery area.
- API key — the credential you use to authenticate your requests. It is not postal data.
- Source code — the program you write to call the API.
When someone searches for "postal code API code," they usually want example request/response code for a postal code service. The rest of this article treats it that way.
What a postal code API actually returns
Response fields vary by provider and endpoint, but the core set is fairly consistent. A single-code lookup commonly returns:
| Field | Example | Notes |
|---|---|---|
| Postal code | 90210 |
The code you queried |
| City | Beverly Hills |
May be one of several acceptable place names |
| State / Province | CA |
Two-letter abbreviation |
| County | Los Angeles |
Useful for tax, territory, and reporting logic |
| Latitude / Longitude | 34.0901, -118.4065 |
Usually the centroid of the area |
| ZIP+4 | 90210-1234 |
Present only when a specific delivery segment is known |
| Time zone | America/Los_Angeles |
Helps with scheduling and display |
| Area codes | 310, 424 |
Regional phone context |
Richer datasets add 90+ fields: boundaries, population, income, elevation, and more. You rarely need all of them — request only what your application uses.
A representative JSON response
{
"postal_code": "90210",
"city": "Beverly Hills",
"state": "CA",
"county": "Los Angeles",
"latitude": 34.0901,
"longitude": -118.4065,
"timezone": "America/Los_Angeles",
"area_codes": ["310", "424"]
}
XML responses carry the same information in tag form. Choose based on what your stack parses most easily; JSON is the common default.
Common request patterns
Most postal code APIs support four patterns. Knowing which one you need prevents wasted calls.
1. Lookup by code
You have a code and want its details. This is the simplest and fastest call.
GET /lookup?code=90210
2. Reverse lookup by address
You have a street address and want to confirm or complete the code. This is the pattern behind checkout address validation.
GET /validate?street=...&city=...&state=...
3. Radius search
You have a center point and want all codes within a distance. Useful for store locators and delivery zones.
GET /radius?code=90210&miles=10
4. Batch validation
You have a file of addresses and want them cleaned in bulk. Batch endpoints trade latency for throughput and usually have their own limits.
Handling missing and ambiguous matches
Real data is messy. Plan for these cases:
- No match — the code doesn't exist or the address is malformed. Return a clear error rather than a silent empty object.
- Multiple matches — a city name may map to several codes, or a code may span several acceptable city names. Decide whether to pick the primary or return a list.
- Partial match — the street is valid but the ZIP+4 isn't. Fall back to the 5-digit code.
- Stale data — codes are added, retired, and reassigned. Refresh your dataset on a regular schedule.
A practical rule: validate at the point of entry, store the normalized result, and never re-derive it later from raw user input.
Practical use cases
- Checkout address validation — catch typos before shipping, reduce failed deliveries.
- Shipping zone lookup — map a code to a zone, carrier route, or rate table.
- Data enrichment — append county, coordinates, or demographics to existing records.
- Store and service locators — radius search to find nearby branches or coverage areas.
- Territory and tax logic — county and boundary data drive jurisdiction rules.
Licensing and data-source considerations
Postal code data originates with national authorities — USPS in the United States and Canada Post in Canada. Providers license and repackage it, which is why accuracy, update frequency, and field coverage differ between services. Before committing:
- Confirm the data source and how often it refreshes.
- Check whether ZIP+4 and boundary data are included or sold separately.
- Review usage limits and whether batch processing is allowed.
- Read the license terms for redistribution and storage.
Pricing and plan details change, so check the provider's current documentation rather than relying on secondhand figures.
Getting started
- Decide which request pattern you need (lookup, reverse, radius, or batch).
- Pick the fields you'll actually store.
- Write a small test call and inspect the raw response.
- Add error handling for no-match and ambiguous cases.
- Cache results where the same codes repeat.
A postal code API is ultimately a translation layer: you give it a code or an address, and it gives back structured location facts. Understand the fields, match them to your use case, and handle the messy edges — that's most of the work.
What Is OpenAPI-Generated API Documentation and How Does It Work?
OpenAPI-generated API documentation is reference documentation that is produced automatically from an OpenAPI description file rather than written by hand. You write (or generate) a machine-readable specification of your API — endpoints, parameters, request bodies, responses, schemas, and auth — and a documentation tool reads that file and renders a browsable, often interactive reference site. The spec becomes the single source of truth; the docs become a build artifact.
This differs from manually written docs in one fundamental way: with hand-written docs, the prose is the source of truth and the API is described separately. With spec-driven docs, the API description is the source, and every page, table, and code sample is derived from it.
How the workflow actually runs
A typical spec-driven documentation pipeline has five stages:
- Author or generate the spec. You either write an OpenAPI document by hand (YAML or JSON), or generate it from code annotations, framework metadata, or a design-first editor. Design-first means the spec is written before implementation; code-first means it is extracted from existing code.
- Validate and lint. The spec is checked against the OpenAPI schema and against style rules — consistent naming, required descriptions, no undocumented
4xxresponses, no orphaned schemas. - Bundle and transform. Multi-file specs are combined,
$refpointers are resolved, and the document is optionally split into per-tag or per-version outputs. - Render. A documentation tool converts the spec into HTML: an endpoint list, a sidebar of operations, parameter tables, response schemas, and a "try it" console.
- Publish and version. The rendered site is deployed, and each API version gets its own snapshot so consumers can read docs matching the version they call.
Steps 2 through 5 are usually automated in CI. If the spec fails validation, the docs build fails — which is the point.
Spec-driven vs. hand-written documentation
| Dimension | OpenAPI-generated | Hand-written |
|---|---|---|
| Source of truth | The spec file | The prose |
| Consistency with the API | High, if the spec is accurate | Drifts as the API changes |
| Effort per endpoint | Low after setup | Repeated for every endpoint |
| Narrative and tutorials | Weak; needs separate pages | Strong |
| Code samples | Generated per language from schemas | Written and maintained manually |
| Customization | Bounded by the tool's templates | Unlimited |
| Failure mode | Accurate spec, poor docs, or stale spec | Beautiful docs that describe an API that no longer exists |
The practical conclusion most teams reach: generate the reference, write the guides. Reference material is repetitive and mechanical, which is exactly what generation is good at. Conceptual explanations, migration notes, and tutorials carry judgment that a spec cannot express.
What you get out of the box
Generated reference pages commonly include:
- An operation list grouped by tag or path, with HTTP method and path.
- Parameter tables showing name, location (path, query, header, cookie), type, required flag, and description.
- Request and response schemas rendered as expandable trees, including nested objects and arrays.
- Authentication details pulled from the
securitySchemessection. - Interactive request consoles that let a reader send a real call from the browser.
- Generated code samples in several languages, derived from the same schemas.
- Multiple output formats, such as a static site, a single HTML file, or a mock server.
Because all of these come from one document, changing a field name in the spec updates the parameter table, the schema tree, and every code sample at once.
Where spec-driven documentation breaks down
Generation is not free. The trade-offs are real:
Spec quality becomes documentation quality. A field with no description produces a table row with an empty cell. A vague summary produces a vague heading. Tools can enforce presence of descriptions via linting, but they cannot enforce that the description is useful.
Customization has limits. If you need a page that does not map to an OpenAPI concept — a conceptual overview, a pricing explanation, a comparison of two endpoints — you write it outside the generator and link to it.
Not everything is expressible. Webhooks, streaming responses, long-polling behavior, and complex multi-step flows are awkward or impossible to describe fully in OpenAPI. Those need prose.
The spec can go stale. If the spec is maintained separately from the implementation, it drifts just like hand-written docs. The mitigation is to generate the spec from code, or to test the implementation against the spec in CI.
Interactive consoles need care. A "try it" button that hits a production API with real credentials is a security and rate-limit problem. Point it at a sandbox, or disable it.
Deciding whether to adopt it
Adopt spec-driven reference documentation if most of these are true:
- Your API has more than a handful of endpoints, or changes frequently.
- You ship client SDKs or code samples in more than one language.
- Multiple teams consume the API and need a consistent, always-current reference.
- You already have, or are willing to maintain, an OpenAPI description.
Stay with hand-written docs, or a hybrid, if:
- Your API is small and stable, and the reference fits on one page.
- Your documentation is mostly conceptual and contains little endpoint-level detail.
- You cannot commit to keeping the spec in sync with the implementation.
A reasonable middle path: generate the reference from the spec, and hand-write the getting-started guide, authentication walkthrough, and error-handling page. Link the two directions so readers can move from concept to endpoint and back.
A minimal starting checklist
- Produce one valid OpenAPI document for a single API version.
- Add a linter with rules for descriptions, operation IDs, and error responses.
- Wire the docs build into CI so a failing spec fails the build.
- Render the reference and review it as a reader, not as the author.
- Write the two or three conceptual pages the generator cannot produce.
- Version the published docs alongside the API version.
The core idea is simple: describe the API once, in a format both machines and humans can read, and let the reference documentation fall out of that description. Everything else — tooling, hosting, interactivity — is a detail on top of that decision.
Website Overview
An established domain and managed infrastructure suggest continuity of operations and may support dependable delivery, although neither guarantees service quality. Several search or sharing settings need attention. Together they may make snippets, preview images or preferred URLs less consistent across platforms.
Domain and Registration
Registered in 1998, this domain has about 28 years of history. That suggests continuity, although ownership and purpose may have changed. Transfer-protection status is present, helping reduce the risk of unauthorized domain transfers. The registrar is Tucows Domains Inc., a widely used domain service provider. The domain uses the common .com extension, which is not an independent safety signal.
DNS and Email
Nameservers are provided by zip-codes.com, indicating managed DNS hosting. MX records point to the zip-codes.com email service. CAA records restrict which certificate authorities are authorized to issue certificates. No CNAME was found; the observed records resolve directly to addresses. SPF and DMARC are configured. DKIM status is unknown.
TLS and Certificates
The certificate issuer is DigiCert Inc, a commercial certificate authority. The certificate uses an RSA 2048-bit public key, offering broad client compatibility. The server supplied a complete certificate chain. No organization name is present in the certificate; the available fields are consistent with domain validation. The certificate is valid for about 198 days in total, with 47 days remaining.
HTTP and Browser Security
The response lacks these common security headers: CSP. CORS permits any origin to read this response. This is common for public resources; sensitive responses need narrower handling. No X-Powered-By header was found, reducing one common source of backend fingerprinting information. No obvious internal addresses or debug information were found in the headers. Cookie security attributes are unknown.
Technology Stack Analysis
The public page identifies jQuery, Bootstrap without precise versions, leaving fewer clues for version-specific scanning.
Search and Social Sharing
The title has 82 characters and may be truncated in search results. The meta description has 242 characters and may be shortened in search results. Open Graph is partially configured; og:description is missing. Twitter Card metadata is configured. JSON-LD includes Organization data, helping describe the organization as an entity.
Hosting and Email
Pages, Search and Sharing
| Meta description | USPS and Canada Post licensed postal code data. REST API and downloadable databases for U.S. ZIP Codes, Canadian Postal Codes, ZIP+4, and boundary data. Address validation, radius search, demographics, and 90+ data fields. Trusted since 2003. |
|---|---|
| Canonical URL | https://www.zip-codes.com/ |
| Language | English (default) |
| Twitter Card | summary_large_image |
Social Sharing Preview
9 fieldsrobots.txt (opens in a new tab)
3 rulesAll bots 0 allowed · 3 disallowed
/cgi-bin//admin//cache/
No matching rules.
Sitemaps
1
Registration details RDAP / WHOIS
| Registrar | Tucows Domains Inc. |
|---|---|
| Registered | 1998-07-20 |
| Expires | 2028-07-19 |
| Domain status | client transfer prohibited、client update prohibited |
| Nameservers | ns1.zip-codes.com、ns2.zip-codes.com |
| DNSSEC | unsigned |
DNS records
| Type | Name | Value | TTL | Priority |
|---|---|---|---|---|
| A | www.zip-codes.com | 74.208.235.117 | 3307 | — |
| MX | zip-codes.com | mail.zip-codes.com | 3600 | 10 |
| NS | zip-codes.com | ns1.zip-codes.com | 3600 | — |
| NS | zip-codes.com | ns2.zip-codes.com | 3600 | — |
| TXT | zip-codes.com | _pbe3wzwv3wgfb5ppa7rqpgiswvgdcmh | 3600 | — |
| TXT | zip-codes.com | v=spf1 +a +mx ip4:50.21.183.178 ip4:74.208.223.30 ip4:74.208.135.117 ip4:74.208.235.117 -all | 3600 | — |
| CAA | zip-codes.com | 0 iodef "mailto:[email protected]" | 3600 | — |
| CAA | zip-codes.com | 0 issue "digicert.com" | 3600 | — |
| DMARC | _dmarc.zip-codes.com | v=DMARC1; p=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected] | 3600 | — |
TLS and certificates
| Assessment | Normal configuration |
|---|---|
| Supported protocols | TLSv1.2 |
| Negotiated protocol | TLSv1.2 |
| Certificate subject | *.zip-codes.com |
| Issuer | DigiCert Inc |
| Valid until | 2026-11-07T23:59 · Remaining when checked: 47 days |
| Verification details | Certificate trust: Passed · Hostname match: Passed |
HTTP response headers
| Header | Value |
|---|---|
| content-type | text/html |
| cache-control | private |
| server | |
| strict-transport-security | max-age=31536000; includeSubdomains |
| x-frame-options | SAMEORIGIN |
| x-content-type-options | nosniff |
| referrer-policy | origin-when-cross-origin |
| permissions-policy | geolocation=*, camera=(), microphone=(), payment=(self), usb=(), magnetometer=(), gyroscope=(), accelerometer=() |
| access-control-allow-origin | * |
| set-cookie | Redacted |
User reviews (0)