We Built an n8n Flow That Cuts Vendor Onboarding From 6 Days to 90 Minutes

A 90-person auto-components manufacturer in Pune onboarded a new vendor in six working days. The form sat in a shared inbox, an accounts clerk keyed the GSTIN into the government portal by hand, a second person created the contact in Zoho Books, and a manager approved it over WhatsApp. We replaced the whole chain with an 11-node n8n workflow that validates PAN and GSTIN against live sources, creates the vendor in Zoho Books, and posts an approval card to Slack. New time-to-active: 90 minutes, most of it the human approval click. ## The Answer in 60 Words A vendor fills one form. n8n receives it via a Webhook, validates the PAN format and the GSTIN checksum, calls a GSTIN-verification API to confirm the entity is active, creates the vendor as a contact in Zoho Books over its v3 API, and posts an interactive approval card to Slack. A manager clicks Approve; the vendor flips to active. Build time: one developer, four days. ## Why This Matters Now (July 2025) Vendor onboarding got slower, not faster, after GST tightened input-tax-credit matching. If you book a bill against a vendor whose GSTIN is cancelled or suspended, your ITC claim breaks at GSTR-2B reconciliation. So accounts teams now manually re-check every GSTIN before they pay. That manual check is exactly the step a workflow does in 400 milliseconds. We built this in July 2025 for a client whose finance head was spending six hours a week on vendor verification alone. As Hrishikesh, our CTO, puts it: the slowest part of onboarding was never the data entry. It was the four handoffs between four people, each of whom checked the previous person's work. ## What Onboarding Actually Looked Like Before - Day 0: Vendor emails a filled PDF to purchase@ inbox. - Day 1-2: Clerk copies GSTIN into the GST portal, screenshots the "active" status, pastes PAN into a separate check. - Day 3: Second clerk creates the contact in Zoho Books, types the same fields again. - Day 4-5: Manager reviews over WhatsApp, often on a Friday, so it slips to Monday. - Day 6: Vendor marked active. First PO can be raised. Four people touched it. The data was typed three times. Each retype is a chance for a transposed digit in a 15-character GSTIN. ## The 11-Node Workflow (Architecture) The node order, end to end: Webhook → Set (normalise fields) → Code (PAN + GSTIN format check) → IF (valid format?) → HTTP Request (GSTIN status) → IF (active?) → Zoho Books (create contact) → Slack (approval card) → Webhook (approve callback) → Zoho Books (update status) → Respond to Webhook. Eleven nodes, two of them IF gates. ## What You'll Need

• An n8n instance (self-hosted on Hetzner, or n8n Cloud)
• A Zoho Books organisation + a self-client OAuth app for API access
• A Slack workspace with an app that has chat:write and an Interactivity request URL
• A GSTIN verification API key (a GSP like Masters India, or the free-tier of a public verifier for low volume)
• A form that can POST JSON — Tally, Typeform, or a hand-rolled HTML page

## Step 1: The Webhook Trigger Drop a Webhook node. Set the method to POST and pick a hard-to-guess path. This is the URL your vendor form posts to.

{
    "parameters": {
      "httpMethod": "POST",
      "path": "vendor-intake-7f3a",
      "responseMode": "responseNode",
      "options": {}
    },
    "name": "Vendor Form Intake",
    "type": "n8n-nodes-base.webhook",
    "typeVersion": 2,
    "position": [240, 300],
    "webhookId": "vendor-intake-7f3a"
  }

## Step 2: Validate PAN and GSTIN Locally (Free, Instant) Before you spend an API credit, reject malformed input. PAN is five letters, four digits, one letter. GSTIN is 15 characters and carries a check digit you can verify offline. A Code node does both with zero external calls.

// Code node — runs in n8n's NodeVM
  const item = $input.first().json;
  const pan = (item.pan || '').toUpperCase().trim();
  const gstin = (item.gstin || '').toUpperCase().trim();
  
  const panOk = /^[A-Z]{5}[0-9]{4}[A-Z]$/.test(pan);
  
  // GSTIN check-digit (base-36, factor alternating 1/2)
  function gstinChecksum(g) {
    if (!/^[0-9]{2}[A-Z0-9]{13}$/.test(g)) return false;
    const code = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ';
    let sum = 0;
    for (let i = 0; i < 14; i++) {
      const v = code.indexOf(g[i]) * (i % 2 === 0 ? 1 : 2);
      sum += Math.floor(v / 36) + (v % 36);
    }
    const check = code[(36 - (sum % 36)) % 36];
    return check === g[14];
  }
  
  const gstinOk = gstinChecksum(gstin);
  // PAN inside GSTIN must match the standalone PAN (chars 3-12)
  const panMatches = gstin.substring(2, 12) === pan;
  
  return [{ json: { ...item, pan, gstin, panOk, gstinOk, panMatches,
    formatValid: panOk && gstinOk && panMatches } }];

This one node kills the most common failure — a typo'd GSTIN — before it ever reaches a paid API or your accountant. We caught a transposed digit on the second real submission. ## Step 3: Confirm the GSTIN Is Actually Active Format-valid is not the same as active. A GSTIN can be perfectly formed and cancelled. An HTTP Request node calls a verification API and you check the returned status.

{
    "parameters": {
      "method": "POST",
      "url": "https://api.gst-verifier.example/v1/gstin/status",
      "authentication": "genericCredentialType",
      "genericAuthType": "httpHeaderAuth",
      "sendBody": true,
      "specifyBody": "json",
      "jsonBody": "={{ { \"gstin\": $json.gstin } }}",
      "options": { "timeout": 8000 }
    },
    "name": "GSTIN Status Check",
    "type": "n8n-nodes-base.httpRequest",
    "typeVersion": 4.2,
    "position": [900, 300]
  }

Follow it with an IF node that passes only when the response status equals Active. Route Cancelled and Suspended to a Slack alert so a human can call the vendor — do not silently drop them. ## Step 4: Create the Vendor in Zoho Books Zoho Books treats vendors as contacts with contact_type set to vendor. You can use the dedicated Zoho Books node, but for full control over custom fields we use an HTTP Request node against the v3 API. Every request needs the organization_id as a query parameter.

{
    "parameters": {
      "method": "POST",
      "url": "https://www.zohoapis.com/books/v3/contacts",
      "authentication": "predefinedCredentialType",
      "nodeCredentialType": "zohoOAuth2Api",
      "sendQuery": true,
      "queryParameters": { "parameters": [
        { "name": "organization_id", "value": "={{ $vars.zohoOrgId }}" }
      ]},
      "sendBody": true,
      "specifyBody": "json",
      "jsonBody": "={{ {\n  \"contact_name\": $json.legalName,\n  \"company_name\": $json.legalName,\n  \"contact_type\": \"vendor\",\n  \"gst_no\": $json.gstin,\n  \"gst_treatment\": \"business_gst\",\n  \"pan_no\": $json.pan,\n  \"contact_persons\": [{ \"email\": $json.email, \"phone\": $json.phone }]\n} }}",
      "options": {}
    },
    "name": "Zoho Books — Create Vendor",
    "type": "n8n-nodes-base.httpRequest",
    "typeVersion": 4.2,
    "position": [1560, 300]
  }

The response returns a contact.contact_id. Store it — you need it in Step 6 to flip the vendor active after approval. We also set the new contact to a "Pending Approval" custom field so it cannot be selected on a bill until a human signs off. ## Step 5: Post a One-Click Approval Card to Slack The Slack node sends a Block Kit message with Approve and Reject buttons. The buttons carry the Zoho contact_id in their value so the callback knows which vendor to act on.

{
    "parameters": {
      "resource": "message",
      "operation": "post",
      "channel": "#vendor-approvals",
      "messageType": "block",
      "blocksUi": "={{ JSON.stringify([\n  { \"type\": \"section\", \"text\": { \"type\": \"mrkdwn\",\n    \"text\": \"New vendor: \" + $json.legalName + \"\\nGSTIN \" + $json.gstin + \" — status Active\" } },\n  { \"type\": \"actions\", \"elements\": [\n    { \"type\": \"button\", \"text\": { \"type\": \"plain_text\", \"text\": \"Approve\" }, \"style\": \"primary\", \"value\": $json.contact_id, \"action_id\": \"approve_vendor\" },\n    { \"type\": \"button\", \"text\": { \"type\": \"plain_text\", \"text\": \"Reject\" }, \"style\": \"danger\", \"value\": $json.contact_id, \"action_id\": \"reject_vendor\" }\n  ]}\n]) }}"
    },
    "name": "Slack — Approval Card",
    "type": "n8n-nodes-base.slack",
    "typeVersion": 2.2,
    "position": [1880, 300]
  }

The manager sees the vendor name, GSTIN, and verified status in the channel they already watch. No new app to log into. One click. ## Step 6: The Approval Callback Closes the Loop Slack posts the button click to a second Webhook in n8n (set as your app's Interactivity request URL). That webhook reads the action_id and value (the contact_id), then a Zoho Books HTTP Request flips the vendor's "Pending Approval" field to "Active". The vendor is now selectable on a PO. Total elapsed time is whatever the manager took to click — minutes, not days. ## Error Handling (The Part Most Tutorials Skip) Set an Error Trigger workflow that catches any failed execution and posts the node name plus error to a #n8n-errors Slack channel. Specific guardrails we added:

• 8-second timeout on the GSTIN API, with 2 retries spaced 5 seconds apart
• Cancelled or suspended GSTIN routes to a human-callback alert, never silently dropped
• Zoho 401 (token expired) is caught and re-auths; n8n refreshes OAuth tokens automatically if the credential is set up right
• Duplicate-GSTIN check: query Zoho for the GSTIN before creating, so re-submits do not create twins
• Every execution logged; we keep 30 days of execution data for audit

## What It Costs to Run (₹ INR, July 2025) The marginal cost is the GSTIN API. A GSP like Masters India charges roughly ₹2-3 per verification at low volume; at 200 vendors a month that is about ₹600. The n8n box runs every other workflow you build too, so the ₹740 is shared. Build cost was 4 developer-days — a one-time spend that paid back in under two months against six hours of finance time a week. ## When NOT to Build This Skip this workflow if you onboard fewer than three or four vendors a month. At that volume, a clerk doing it by hand for ten minutes is cheaper than four days of build plus a monthly API bill. Also skip it if your vendors are all long-standing and rarely change — automation pays back on repetition, and a stable 30-vendor list does not change enough to justify the build. Finally, do not build the Slack approval step if your approver does not already live in Slack; forcing a new tool on one manager kills adoption faster than any technical bug. We learned that the hard way on an earlier project where the approver checked Slack twice a week. ## Real Example: The Pune Manufacturer The client makes precision auto components, supplies three Tier-1 OEMs, and onboards 15-20 new vendors a month during expansion. Their finance head, a chartered accountant, was personally verifying each GSTIN because a single bad ITC claim had cost them ₹1.8 lakh in a prior year. After we shipped this in July 2025, vendor onboarding dropped from a six-day average to 90 minutes, and the CA's weekly verification load went from six hours to about 20 minutes of clicking Approve. We built the same backbone — validate, push to accounting, route for approval — for Radiant Finance, where the validated entity was a loan applicant rather than a vendor. This kind of build sits squarely in our AI and automation practice, and it pairs naturally with custom accounting integrations from our CRM development team. ## FAQ ### How long does it take to build this n8n vendor-onboarding flow? One mid-level developer builds and tests it in about four working days — roughly a day for the form and webhook, a day for validation and the GSTIN API, a day for the Zoho Books and Slack integration, and a day for error handling and a real test run. ### Can n8n validate a GSTIN without a paid API? Partly. n8n can verify the GSTIN format and check digit offline for free in a Code node, which catches most typos. But confirming the GSTIN is currently active — not cancelled or suspended — needs a call to a GST verification API, which is a paid service in India. ### Does this work with Tally instead of Zoho Books? Yes. Swap the Zoho Books HTTP Request node for Tally's XML import over its ODBC or HTTP gateway. The validation and Slack-approval halves of the workflow are identical. Tally needs a connector running on a machine that can reach the Tally instance. ### Is self-hosted n8n safe for vendor PII and bank details? Yes, if you run it on your own server over HTTPS, restrict the editor behind authentication, and avoid logging full bank fields in execution data. Self-hosting actually keeps the data inside your infrastructure, which is the privacy posture most Indian SMBs want under the DPDP Act. ### What happens if the Slack approval is never clicked? The vendor stays in "Pending Approval" and cannot be selected on a bill. We add a cron-based reminder workflow that re-pings the channel after 24 hours, so nothing rots silently in a queue. ### How much does the whole thing cost per month to run? About ₹740 for a shared self-hosted n8n box plus roughly ₹600 for 200 GSTIN verifications — under ₹1,400 a month, with Zoho Books and Slack costs you already pay. The n8n box runs your other workflows too, so the real marginal cost is just the API.