API reference

Base URL https://api.daat.red · all endpoints are prefixed with /public

Every method is a single HTTPS request with an X-API-Key header. Bodies and responses are UTF-8 JSON. Create and rotate keys, and set an optional source-IP allow-list, in the operator console.

Base URLhttps://api.daat.red

Auth headerX-API-Key: ak_live_…

Content typeapplication/json · UTF-8

Every response also carries receivedAt (ISO-8601 UTC), a credits object ({ "balance": …, "charged": … }), and — if you sent one — your outInfo string echoed back unchanged (printable ASCII, ≤ 64 characters). You are charged only when a call returns a useful result; failed and throttled calls cost 0 credits.

1 · Card check 2 · Card info 3 · BIN lookup 4 · IP info 5 · Email info 6 · Email check 7 · Balance Async jobs Webhooks Errors OpenAPI

POST/public/cardCard check

Verifies whether the cardholder name you supply matches the card network's records. You send the card details; daat.red forwards the check to the relevant card network under its own direct agreements with those networks, and returns the network's verdict. The card number is used for this one lookup and is never stored.

Request

Field	Type	Notes
`cardNum`	string	Required. Card number (PAN).
`expMonth`	string	Required. Two digits, e.g. `05`.
`expYear`	string	Required. Four digits, e.g. `2029`.
`nameOnCard`	string	Required. Order: `Surname First name`.
`cryptogramType`	string	Optional. For network tokens, e.g. `TAVV`, `DSRP`, `AAV`, `UCAF`. Send with `cryptogramValue`.
`cryptogramValue`	string	Optional. Token cryptogram. Never echoed back.
`outInfo`	string	Optional. Your correlation string, returned unchanged.

Response

Field	Type	Notes
`status`	string	`ok` · `not_valid` · `provider_err`
`cardLast4`	string	Last four digits of the card.
`bin`	string	Card BIN (leading digits).
`providerAsiCheckResult`	string	Network check code, e.g. `A`.
`providerAsiCheckName`	string	Human label, e.g. `Match`.
`providerAsiCheckDescription`	string	Free-text description of the result.

curl -X POST 'https://api.daat.red/public/card' \
  -H 'Content-Type: application/json' \
  -H "X-API-Key: $DAAT_API_KEY" \
  -d '{ "cardNum": "<PAN>", "expMonth": "05", "expYear": "2029",
        "nameOnCard": "Doe John", "outInfo": "order-88213" }'

→ 200 OK
{
  "outInfo": "order-88213",
  "status": "ok",
  "cardLast4": "1111",
  "bin": "411111",
  "providerAsiCheckResult": "A",
  "providerAsiCheckName": "Match",
  "providerAsiCheckDescription": "Check completed, match confirmed",
  "receivedAt": "2026-06-06T12:34:56Z",
  "credits": { "balance": 997, "charged": 4 }
}

POST/public/card-infoCard info

Issuer, country, currency and product metadata derived from a card number.

Request

Field	Type	Notes
`cardNum`	string	Required. Card number (PAN). Not stored.
`outInfo`	string	Optional.

Response

Field	Type	Notes
`status`	string	`ok` · `not_valid`
`cardLast4`	string
`bin`	string
`issuerName`	string	Issuing bank.
`country`	object	`{ code, numericCode, name }`
`currency`	object	`{ code, numericCode, name, minorDigits }`
`product`	object	`{ type, subTypeCode, platformCode }`

→ 200 OK
{
  "status": "ok",
  "cardLast4": "7949",
  "bin": "424200",
  "issuerName": "…",
  "country":  { "code": "DE", "numericCode": "276", "name": "Germany" },
  "currency": { "code": "EUR", "numericCode": "978", "name": "Euro", "minorDigits": "2" },
  "product":  { "type": "P", "subTypeCode": "R", "platformCode": "CN" },
  "receivedAt": "…", "credits": { "balance": 995, "charged": 2 }
}

POST/public/bin-infoBIN lookup

Country, issuing bank and local currency for a card BIN. No full card number needed. A BIN that isn't in the catalog returns not_valid and costs 0 credits.

Request

Field	Type	Notes
`bin`	string	Required. 6–8 digits.
`outInfo`	string	Optional.

Response

Field	Type	Notes
`status`	string	`ok` · `not_valid`
`countryCode`	string	ISO 3166-1 alpha-2.
`countryName`	string
`issuerName`	string
`localCurrency`	object	`{ code, name }`

curl -X POST 'https://api.daat.red/public/bin-info' \
  -H "X-API-Key: $DAAT_API_KEY" -H 'Content-Type: application/json' \
  -d '{ "bin": "531260" }'

→ 200 OK
{ "status": "ok", "countryCode": "DE", "countryName": "GERMANY",
  "issuerName": "…", "localCurrency": { "code": "EUR", "name": "Euro" },
  "receivedAt": "…", "credits": { "balance": 996, "charged": 1 } }

POST/public/ip-infoIP info

Geolocation and network context for an IPv4 or IPv6 address. Leave ip empty to use the calling client's IP.

Request

Field	Type	Notes
`ip`	string	Optional. IPv4 or IPv6. Empty = effective client IP.
`outInfo`	string	Optional.

Response

Field	Type	Notes
`ip`	string	The address that was looked up.
`status`	string	`ok` · `not_valid`
`countryCode` / `countryName`	string
`cityName` / `postalCode` / `timeZone`	string
`asn`	number	Autonomous system number.
`asnOrganization`	string	Network operator.
`geoNames`	object	`{ currencyCode, currencyName, phonePrefix, postalCodeFormat }`

→ 200 OK
{
  "ip": "8.8.8.8", "status": "ok",
  "countryCode": "US", "countryName": "United States",
  "cityName": "Mountain View", "postalCode": "94035",
  "timeZone": "America/Los_Angeles",
  "asn": 15169, "asnOrganization": "Google LLC",
  "geoNames": { "currencyCode": "USD", "currencyName": "Dollar",
                "phonePrefix": "1", "postalCodeFormat": "#####" },
  "receivedAt": "…", "credits": { "balance": 995, "charged": 1 }
}

POST/public/email-infoEmail info

Names publicly associated with an email address, with occurrence counts and a match flag. Charged only when names are returned.

Request

Field	Type	Notes
`email`	string	Required.
`outInfo`	string	Optional.

Response

Field	Type	Notes
`email`	string
`emailNameCheck`	object	`{ status, match, names: [ { value, count } ], checkedAt }`

→ 200 OK
{
  "email": "user@example.com",
  "emailNameCheck": {
    "status": "found", "match": false,
    "names": [ { "value": "JOHN DOE", "count": 2 } ],
    "checkedAt": "…"
  },
  "receivedAt": "…", "credits": { "balance": 987, "charged": 8 }
}

POST/public/email-checkEmail check

Live SMTP deliverability probe — can this mailbox receive mail. Use it for deliverability, not name lookup.

Request

Field	Type	Notes
`email`	string	Required.
`outInfo`	string	Optional.

Response

Field	Type	Notes
`ok`	boolean	Whether the check itself completed.
`email`	string
`result`	string	`accepted` · `rejected`
`responseCode`	number	SMTP code, e.g. `250`, `550`.
`info`	string	Raw SMTP response line.
`error`	string	Empty on success.

→ 200 OK
{ "ok": true, "email": "user@example.com", "result": "accepted",
  "responseCode": 250, "info": "250 2.1.5 OK", "error": "",
  "receivedAt": "…", "credits": { "balance": 994, "charged": 1 } }

GET/public/balanceBalance

The current prepaid credit balance for the API key. Free — always charged: 0.

curl 'https://api.daat.red/public/balance?outInfo=ping' \
  -H "X-API-Key: $DAAT_API_KEY"

→ 200 OK
{ "outInfo": "ping", "receivedAt": "…",
  "credits": { "balance": 997, "charged": 0 } }

Async jobs

Card check and BIN lookup can also run as queued jobs — submit and poll, or submit and receive a webhook.

Endpoint	Purpose
`POST /public/jobs/card`	Queue a Card check. Returns a job id.
`POST /public/jobs/bin-info`	Queue a BIN lookup. Returns a job id.
`GET /public/jobs/{id}`	Poll job status; the result payload once complete.

Job bodies are identical to the synchronous method. An accepted job keeps processing even if the submitting key is rotated — poll it with the account's current active key.

Webhooks

If a webhook URL is configured on your account, daat.red POSTs the completed job result to it as JSON. Each delivery carries an HMAC signature header computed over the raw request body with your account's signing secret — verify it before trusting the payload, and reject anything that doesn't match. Deliveries are retried with backoff on non-2xx responses. The exact header name, signing secret and retry schedule are provided with your account.

Errors

Status	Body `error`	Meaning
`400`	`bad_request`	Malformed request or missing required field.
`401`	`unauthorized`	Missing or invalid `X-API-Key`, or source IP not allow-listed.
`402`	`payment_required`	Insufficient credits. Body includes your `credits.balance`.
`429`	`too_many_requests`	Throttled. Retry after the `Retry-After` header. Costs 0 credits.
`5xx`	—	Transient server-side error. Retry with backoff.

A method that runs but returns no useful result (for example status: "not_valid", or an upstream provider_err) responds 200 and is charged 0 credits — it's logged in your request history for reference.

OpenAPI

Machine-readable spec: openapi.yaml. Import it into Postman, Insomnia, or your client generator of choice.