Every payment,
checked before
you take it.
daat.red is the pre-authorization data layer for payment teams. One API key, seven checks — each one returns a verdict in the response.
base — https://api.daat.red · auth — X-API-Key
# verify the cardholder before you authorize curl -X POST 'https://api.daat.red/public/card' \ -H 'X-API-Key: ak_live_…' \ -d '{ "cardNum": "<PAN>", "nameOnCard": "Petrenko Ivan" }'
← 200 OK { "status": "ok", "bin": "411111", "cardLast4": "1111", "providerAsiCheckName": "Match", "providerAsiCheckResult": "A", "receivedAt": "2026-06-06T12:34:56Z" }
Live shape of the /card response. A confirmed match draws credits; a provider error or “not valid” is logged at no charge.
The whole risk picture, one integration.
Every method is a single POST that returns a normalized verdict plus the raw provider fields. Each call is metered in prepaid credits; the exact amount charged comes back on every response.
Card check
per resultConfirms the cardholder's name with the issuer before you authorize. Accepts tokenized cards with TAVV, DSRP, AAV or UCAF cryptograms.
Card info
per resultFull profile from the PAN — issuer, country, billing currency and minor digits, product type, subtype and platform, transfer capability.
BIN lookup
per resultCountry, issuing bank and local currency for a 6–8 digit BIN. No full PAN required. A BIN that isn't in the catalog costs nothing.
IP info
per resultGeolocation and network context for any IPv4 or IPv6 — country, city, postal, timezone, ASN and operator, plus currency and phone-prefix enrichment.
Email info
per resultNames publicly associated with an email address, with occurrence counts and a match flag against the name you expect. Charged only when names come back.
Email check
per resultLive SMTP probe — can this mailbox actually receive mail. Returns the result, the SMTP response code and the raw server line.
Balance
no chargeCurrent credit balance for the key. Poll it from a billing job or wire it to an alert before you run dry mid-checkout.
Async jobs
per resultSubmit card or BIN checks as queued jobs and take a signed webhook on completion. Accepted jobs keep processing through an API-key rotation.
Is the name on the card the name of the person paying?
Card check runs your cardholder name against the issuer's own records and comes back with a clear match / no-match plus the provider's check code — before you send the authorization.
- Name-order aware. Send nameOnCard as “Surname First name”, matching the issuer convention.
- Token friendly. Pass cryptogramType + cryptogramValue for network tokens; they're never echoed back.
- Client echo. Any outInfo string up to 64 chars is returned unchanged for your correlation.
- Honest billing. Only a useful result draws credits; a provider error or “not valid” is stored in history at no charge.
{
"outInfo": "order-88213",
"status": "ok",
"cardLast4": "1111",
"bin": "411111",
"providerAsiCheckResult": "A",
"providerAsiCheckName": "Match",
"providerAsiCheckDescription":
"Check completed, match confirmed",
"receivedAt": "2026-06-06T12:34:56Z",
"credits": { "balance": 997, "charged": 4 }
}
The same call, in your language.
Every method is one HTTPS POST with an X-API-Key header and a JSON body. Below is Card check against /public/card — swap the path for any other method.
curl -X POST 'https://api.daat.red/public/card' \
-H 'Content-Type: application/json' \
-H "X-API-Key: $DAAT_API_KEY" \
-d '{
"cardNum": "4111111111111111",
"expMonth": "05",
"expYear": "2029",
"nameOnCard": "Petrenko Ivan"
}'
<?php
$ch = curl_init('https://api.daat.red/public/card');
curl_setopt_array($ch, [
CURLOPT_POST => true,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
'Content-Type: application/json',
'X-API-Key: ' . getenv('DAAT_API_KEY'),
],
CURLOPT_POSTFIELDS => json_encode([
'cardNum' => '4111111111111111',
'expMonth' => '05',
'expYear' => '2029',
'nameOnCard' => 'Petrenko Ivan',
], JSON_UNESCAPED_UNICODE),
]);
$res = json_decode(curl_exec($ch), true);
curl_close($ch);
echo $res['providerAsiCheckName']; // "Match"
echo $res['credits']['charged']; // credits used by this call
import os, requests
res = requests.post(
"https://api.daat.red/public/card",
headers={"X-API-Key": os.environ["DAAT_API_KEY"]},
json={
"cardNum": "4111111111111111",
"expMonth": "05",
"expYear": "2029",
"nameOnCard": "Petrenko Ivan",
},
timeout=15,
)
res.raise_for_status()
data = res.json()
print(data["providerAsiCheckName"], data["credits"]["charged"])
const res = await fetch("https://api.daat.red/public/card", {
method: "POST",
headers: {
"Content-Type": "application/json",
"X-API-Key": process.env.DAAT_API_KEY,
},
body: JSON.stringify({
cardNum: "4111111111111111",
expMonth: "05",
expYear: "2029",
nameOnCard: "Petrenko Ivan",
}),
});
if (!res.ok) throw new Error(`daat.red returned ${res.status}`);
const data = await res.json();
console.log(data.providerAsiCheckName, data.credits.charged);
package main
import (
"bytes"
"encoding/json"
"fmt"
"net/http"
"os"
)
func main() {
payload, _ := json.Marshal(map[string]string{
"cardNum": "4111111111111111",
"expMonth": "05",
"expYear": "2029",
"nameOnCard": "Petrenko Ivan",
})
req, _ := http.NewRequest("POST", "https://api.daat.red/public/card", bytes.NewReader(payload))
req.Header.Set("Content-Type", "application/json")
req.Header.Set("X-API-Key", os.Getenv("DAAT_API_KEY"))
resp, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
var out map[string]any
json.NewDecoder(resp.Body).Decode(&out)
fmt.Println(out["providerAsiCheckName"])
}
use serde_json::{json, Value};
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
let res = reqwest::Client::new()
.post("https://api.daat.red/public/card")
.header("X-API-Key", std::env::var("DAAT_API_KEY")?)
.json(&json!({
"cardNum": "4111111111111111",
"expMonth": "05",
"expYear": "2029",
"nameOnCard": "Petrenko Ivan"
}))
.send()
.await?
.error_for_status()?;
let data: Value = res.json().await?;
println!("{}", data["providerAsiCheckName"]);
Ok(())
}
import java.net.URI;
import java.net.http.*;
var body = """
{
"cardNum": "4111111111111111",
"expMonth": "05",
"expYear": "2029",
"nameOnCard": "Petrenko Ivan"
}
""";
var req = HttpRequest.newBuilder()
.uri(URI.create("https://api.daat.red/public/card"))
.header("Content-Type", "application/json")
.header("X-API-Key", System.getenv("DAAT_API_KEY"))
.POST(HttpRequest.BodyPublishers.ofString(body))
.build();
var res = HttpClient.newHttpClient()
.send(req, HttpResponse.BodyHandlers.ofString());
System.out.println(res.statusCode()); // 200
System.out.println(res.body());
A successful call returns status: "ok", the provider check result and credits.charged. Out of credits returns 402 payment_required with your balance; over the limit returns 429 with Retry-After. Failed and rate-limited calls cost nothing. Every method's response fields are listed in the methods section.
You pay for answers, not attempts.
Load credits once. The meter only moves when a call returns something you can act on.
Failed lookups are free
Provider errors, rate-limit hits and “not found” results are written to your request history at zero credits. No surprise burn from a flaky upstream.
Metered per method
Each method draws a set number of credits per useful result, scaled to how heavy the check is. Your rate is agreed for your account, and every response echoes the exact amount charged.
Predictable when empty
Run out and the API returns payment_required with your balance — never a silent failure. Top up from the console or by request.
REST first. Agent-ready. No SDK lock-in.
One base URL, one header, UTF-8 JSON both ways. Everything below ships out of the box.
API keys & IP rules
Create, view and rotate keys in the console. Pin an optional source-IP allowlist per key; leave it empty to accept any origin.
Rate limiting
One pre-auth bucket per client IP, configurable per key. Rate-limit hits are logged once per window at 0 credits.
Sync or async
Call inline for a verdict in the response, or queue a job and take a signed webhook. Jobs survive key rotation.
Request history
Every call is stored with status, cost and latency. Per-method dashboards show success rate, spend and provider health.
MCP endpoint
Point an AI agent at the Model Context Protocol server and let it run the same checks under your account, with the same billing.
Two-factor console
Time-based 2FA on the operator console, enforced on every sign-in once enabled — required before sharing API access.
# same key, three methods, one checkout decision POST /public/bin-info { "bin": "512070" } → issuer, country, UAH POST /public/ip-info { "ip": "8.8.8.8" } → ASN 15169, Google LLC POST /public/email-check { "email": "a@b.com" } → "accepted", 250
For teams that carry the chargeback.
Payment providers
Add a name-match and BIN gate ahead of authorization across every merchant on the platform, without touching their checkout.
iGaming & high-risk
Screen deposits at the moment of payment — cardholder, issuer country, IP and email in one pass, tuned for CEE issuers.
Marketplaces & fintech
Enrich onboarding and payout flows with issuer, geo and email-identity signals on a pay-per-answer basis.
Straight answers.
Is this a payment gateway?
No. daat.red is a data API. You keep your PSP, your acquirer and your checkout — daat.red adds the risk signal you query before you authorize. Nothing routes money through it.
What exactly is a credit?
A prepaid unit of usage. Each method draws a set number of credits per useful result, scaled to how heavy the check is and agreed for your account. You're debited only when a call returns something usable; the balance and the amount charged come back on every response.
Do failed or empty lookups cost anything?
No. Provider errors, rate-limit responses and “not found” results are recorded in your request history at 0 credits.
Which markets are covered?
Card-name validation is strongest across Ukraine and neighbouring CEE issuers. BIN, IP and email coverage is global.
Synchronous or webhook?
Both. Call the method directly for a verdict in the HTTP response, or submit /public/jobs/card and /public/jobs/bin-info and receive a signed webhook when the job completes.
How do we get access?
Access is granted per account. Request it from billing@daat.red; once you're in, you generate keys and set IP rules yourself in the console.
Put a verdict in front of every authorization.
Tell us the checks you need and the volume you expect. We'll provision an account and send you a key.