Payment data intelligence API

Every payment,
checked before
you take it.

daat.red is the pre-authorization data layer for payment teams. One API key, seven checks — each one returns a verdict in the response.

base — https://api.daat.red  ·  auth — X-API-Key

POST api.daat.red/public/card
# verify the cardholder before you authorize
curl -X POST 'https://api.daat.red/public/card' \
  -H 'X-API-Key: ak_live_…' \
  -d '{ "cardNum": "<PAN>",
        "nameOnCard": "Petrenko Ivan" }'
← 200 OK
{
  "status":  "ok",
  "bin":     "411111",
  "cardLast4": "1111",
  "providerAsiCheckName": "Match",
  "providerAsiCheckResult": "A",
  "receivedAt": "2026-06-06T12:34:56Z"
}
◆ Cardholder name — match

Live shape of the /card response. A confirmed match draws credits; a provider error or “not valid” is logged at no charge.

7
Public API methods
0
Charged for a failed or rate-limited call
20 req/s
Per key, burstable
350K+
Checks run in production
One key · seven checks

The whole risk picture, one integration.

Every method is a single POST that returns a normalized verdict plus the raw provider fields. Each call is metered in prepaid credits; the exact amount charged comes back on every response.

Card check

per result
POST /public/card

Confirms the cardholder's name with the issuer before you authorize. Accepts tokenized cards with TAVV, DSRP, AAV or UCAF cryptograms.

verdict — name match + provider check code

Card info

per result
POST /public/card-info

Full profile from the PAN — issuer, country, billing currency and minor digits, product type, subtype and platform, transfer capability.

verdict — issuer · country · currency · product

BIN lookup

per result
POST /public/bin-info

Country, issuing bank and local currency for a 6–8 digit BIN. No full PAN required. A BIN that isn't in the catalog costs nothing.

verdict — countryCode · issuerName · localCurrency

IP info

per result
POST /public/ip-info

Geolocation and network context for any IPv4 or IPv6 — country, city, postal, timezone, ASN and operator, plus currency and phone-prefix enrichment.

verdict — country · city · ASN org

Email info

per result
POST /public/email-info

Names publicly associated with an email address, with occurrence counts and a match flag against the name you expect. Charged only when names come back.

verdict — names[] · match: true / false

Email check

per result
POST /public/email-check

Live SMTP probe — can this mailbox actually receive mail. Returns the result, the SMTP response code and the raw server line.

verdict — accepted / rejected + response code

Balance

no charge
GET /public/balance

Current credit balance for the key. Poll it from a billing job or wire it to an alert before you run dry mid-checkout.

Async jobs

per result
POST /public/jobs/card · /public/jobs/bin-info · GET /public/jobs/{id}

Submit card or BIN checks as queued jobs and take a signed webhook on completion. Accepted jobs keep processing through an API-key rotation.

Flagship check

Is the name on the card the name of the person paying?

Card check runs your cardholder name against the issuer's own records and comes back with a clear match / no-match plus the provider's check code — before you send the authorization.

  • Name-order aware. Send nameOnCard as “Surname First name”, matching the issuer convention.
  • Token friendly. Pass cryptogramType + cryptogramValue for network tokens; they're never echoed back.
  • Client echo. Any outInfo string up to 64 chars is returned unchanged for your correlation.
  • Honest billing. Only a useful result draws credits; a provider error or “not valid” is stored in history at no charge.
response · 200 OK
{
  "outInfo": "order-88213",
  "status": "ok",
  "cardLast4": "1111",
  "bin": "411111",
  "providerAsiCheckResult": "A",
  "providerAsiCheckName": "Match",
  "providerAsiCheckDescription":
      "Check completed, match confirmed",
  "receivedAt": "2026-06-06T12:34:56Z",
  "credits": { "balance": 997, "charged": 4 }
}
Quickstart

The same call, in your language.

Every method is one HTTPS POST with an X-API-Key header and a JSON body. Below is Card check against /public/card — swap the path for any other method.

Base URLhttps://api.daat.red
Auth headerX-API-Key: ak_live_…
Body & responseapplication/json · UTF-8
Rate limit20 req/s · 429 + Retry-After
curl -X POST 'https://api.daat.red/public/card' \
  -H 'Content-Type: application/json' \
  -H "X-API-Key: $DAAT_API_KEY" \
  -d '{
    "cardNum":    "4111111111111111",
    "expMonth":   "05",
    "expYear":    "2029",
    "nameOnCard": "Petrenko Ivan"
  }'

A successful call returns status: "ok", the provider check result and credits.charged. Out of credits returns 402 payment_required with your balance; over the limit returns 429 with Retry-After. Failed and rate-limited calls cost nothing. Every method's response fields are listed in the methods section.

Prepaid credits

You pay for answers, not attempts.

Load credits once. The meter only moves when a call returns something you can act on.

0

Failed lookups are free

Provider errors, rate-limit hits and “not found” results are written to your request history at zero credits. No surprise burn from a flaky upstream.

Tiered

Metered per method

Each method draws a set number of credits per useful result, scaled to how heavy the check is. Your rate is agreed for your account, and every response echoes the exact amount charged.

402

Predictable when empty

Run out and the API returns payment_required with your balance — never a silent failure. Top up from the console or by request.

Built to drop in

REST first. Agent-ready. No SDK lock-in.

One base URL, one header, UTF-8 JSON both ways. Everything below ships out of the box.

API keys & IP rules

X-API-Key

Create, view and rotate keys in the console. Pin an optional source-IP allowlist per key; leave it empty to accept any origin.

Rate limiting

20 req/s · 429 + Retry-After

One pre-auth bucket per client IP, configurable per key. Rate-limit hits are logged once per window at 0 credits.

Sync or async

/public/jobs/{id}

Call inline for a verdict in the response, or queue a job and take a signed webhook. Jobs survive key rotation.

Request history

per-method ledger

Every call is stored with status, cost and latency. Per-method dashboards show success rate, spend and provider health.

MCP endpoint

api.daat.red/mcp · OAuth

Point an AI agent at the Model Context Protocol server and let it run the same checks under your account, with the same billing.

Two-factor console

TOTP

Time-based 2FA on the operator console, enforced on every sign-in once enabled — required before sharing API access.

# same key, three methods, one checkout decision
POST /public/bin-info    { "bin": "512070" }        → issuer, country, UAH
POST /public/ip-info     { "ip": "8.8.8.8" }        → ASN 15169, Google LLC
POST /public/email-check { "email": "a@b.com" }     → "accepted", 250
Who runs it

For teams that carry the chargeback.

Payment providers

Add a name-match and BIN gate ahead of authorization across every merchant on the platform, without touching their checkout.

iGaming & high-risk

Screen deposits at the moment of payment — cardholder, issuer country, IP and email in one pass, tuned for CEE issuers.

Marketplaces & fintech

Enrich onboarding and payout flows with issuer, geo and email-identity signals on a pay-per-answer basis.

Before you ask

Straight answers.

Is this a payment gateway?

No. daat.red is a data API. You keep your PSP, your acquirer and your checkout — daat.red adds the risk signal you query before you authorize. Nothing routes money through it.

What exactly is a credit?

A prepaid unit of usage. Each method draws a set number of credits per useful result, scaled to how heavy the check is and agreed for your account. You're debited only when a call returns something usable; the balance and the amount charged come back on every response.

Do failed or empty lookups cost anything?

No. Provider errors, rate-limit responses and “not found” results are recorded in your request history at 0 credits.

Which markets are covered?

Card-name validation is strongest across Ukraine and neighbouring CEE issuers. BIN, IP and email coverage is global.

Synchronous or webhook?

Both. Call the method directly for a verdict in the HTTP response, or submit /public/jobs/card and /public/jobs/bin-info and receive a signed webhook when the job completes.

How do we get access?

Access is granted per account. Request it from billing@daat.red; once you're in, you generate keys and set IP rules yourself in the console.

Request access

Put a verdict in front of every authorization.

Tell us the checks you need and the volume you expect. We'll provision an account and send you a key.

Email billing@daat.red Open the console base — https://api.daat.red