Every payment,
checked before
you take it.
daat.red is the pre-authorization data layer for payment teams. One API key, seven checks — each one returns a verdict in the response.
base — https://api.daat.red · auth — X-API-Key
# verify the cardholder before you authorize curl -X POST 'https://api.daat.red/public/card' \ -H 'X-API-Key: ak_live_…' \ -d '{ "cardNum": "<PAN>", "nameOnCard": "Doe John" }'
← 200 OK { "status": "ok", "bin": "411111", "cardLast4": "1111", "providerAsiCheckName": "Match", "providerAsiCheckResult": "A", "receivedAt": "2026-06-06T12:34:56Z" }
Live shape of the /card response. A confirmed match draws credits; an upstream error or “not valid” is logged at no charge.
The whole risk picture, one integration.
Every method is a single POST that returns a normalized verdict plus the raw response fields. Each call is metered in prepaid credits; the exact amount charged comes back on every response.
Card check
per resultConfirms the cardholder's name with the card network before you authorize. Accepts tokenized cards with TAVV, DSRP, AAV or UCAF cryptograms.
Card info
per resultFull profile from the PAN — issuer, country, billing currency and minor digits, product type, subtype and platform, transfer capability.
BIN lookup
per resultCountry, issuing bank and local currency for a 6–8 digit BIN. No full PAN required. A BIN that isn't in the catalog costs nothing.
IP info
per resultGeolocation and network context for any IPv4 or IPv6 — country, city, postal, timezone, ASN and operator, plus currency and phone-prefix enrichment.
Email info
per resultNames publicly associated with an email address, with occurrence counts and a match flag against the name you expect. Charged only when names come back.
Email check
per resultLive SMTP probe — can this mailbox actually receive mail. Returns the result, the SMTP response code and the raw server line.
Balance
no chargeCurrent credit balance for the key. Poll it from a billing job or wire it to an alert before you run dry mid-checkout.
Async jobs
per resultSubmit card or BIN checks as queued jobs and take a signed webhook on completion. Accepted jobs keep processing through an API-key rotation.
Is the name on the card the name of the person paying?
You send the card details. daat.red forwards the verification to the relevant card network — under our own direct agreements with those networks — and returns the network's verdict: a clear match / no-match plus its check code, before you send the authorization. The card number passes through for that one check and is never stored.
- Name-order aware. Send nameOnCard as “Surname First name”, matching the network convention.
- Token friendly. Pass cryptogramType + cryptogramValue for network tokens; they're never echoed back.
- Client echo. Any outInfo string up to 64 chars is returned unchanged for your correlation.
- Honest billing. Only a useful result draws credits; an upstream error or “not valid” is stored in history at no charge.
{
"outInfo": "order-88213",
"status": "ok",
"cardLast4": "1111",
"bin": "411111",
"providerAsiCheckResult": "A",
"providerAsiCheckName": "Match",
"providerAsiCheckDescription":
"Check completed, match confirmed",
"receivedAt": "2026-06-06T12:34:56Z",
"credits": { "balance": 997, "charged": 4 }
}
You're sending card data. Here's what happens to it.
daat.red sits in the payment path, so the boring guarantees matter more than the features.
Dedicated, not shared
Card-data processing runs on dedicated, access-controlled infrastructure — not a shared multi-tenant pool. Network exposure is kept to the minimum the API needs.
Card numbers are never stored
A card number sent for Card check or Card info is used for that one lookup, forwarded to the network, and discarded. We don't keep PANs, expiry dates or security codes — ever.
We keep only what the law requires
Request metadata and results are retained for the minimum period required by applicable law, then deleted. No shadow profiles, no resale of your data.
Encrypted end to end
TLS on every connection. API keys are shown once and stored hashed; rotate them any time from the console.
Keys you can lock down
Pin a source-IP allow-list per key, rotate on a schedule, and enforce time-based 2FA on the operator console before anyone touches API access.
Processor, with a DPA
For the data you submit through the API, daat.red acts as your data processor. A Data Processing Agreement is available; the Privacy Policy has the detail.
The same call, in your language.
Every method is one HTTPS POST with an X-API-Key header and a JSON body. Below is Card check against /public/card — swap the path for any other method.
curl -X POST 'https://api.daat.red/public/card' \
-H 'Content-Type: application/json' \
-H "X-API-Key: $DAAT_API_KEY" \
-d '{
"cardNum": "4111111111111111",
"expMonth": "05",
"expYear": "2029",
"nameOnCard": "Doe John"
}'
<?php
$ch = curl_init('https://api.daat.red/public/card');
curl_setopt_array($ch, [
CURLOPT_POST => true,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
'Content-Type: application/json',
'X-API-Key: ' . getenv('DAAT_API_KEY'),
],
CURLOPT_POSTFIELDS => json_encode([
'cardNum' => '4111111111111111',
'expMonth' => '05',
'expYear' => '2029',
'nameOnCard' => 'Doe John',
], JSON_UNESCAPED_UNICODE),
]);
$res = json_decode(curl_exec($ch), true);
curl_close($ch);
echo $res['providerAsiCheckName']; // "Match"
echo $res['credits']['charged']; // credits used by this call
import os, requests
res = requests.post(
"https://api.daat.red/public/card",
headers={"X-API-Key": os.environ["DAAT_API_KEY"]},
json={
"cardNum": "4111111111111111",
"expMonth": "05",
"expYear": "2029",
"nameOnCard": "Doe John",
},
timeout=15,
)
res.raise_for_status()
data = res.json()
print(data["providerAsiCheckName"], data["credits"]["charged"])
const res = await fetch("https://api.daat.red/public/card", {
method: "POST",
headers: {
"Content-Type": "application/json",
"X-API-Key": process.env.DAAT_API_KEY,
},
body: JSON.stringify({
cardNum: "4111111111111111",
expMonth: "05",
expYear: "2029",
nameOnCard: "Doe John",
}),
});
if (!res.ok) throw new Error(`daat.red returned ${res.status}`);
const data = await res.json();
console.log(data.providerAsiCheckName, data.credits.charged);
package main
import (
"bytes"
"encoding/json"
"fmt"
"net/http"
"os"
)
func main() {
payload, _ := json.Marshal(map[string]string{
"cardNum": "4111111111111111",
"expMonth": "05",
"expYear": "2029",
"nameOnCard": "Doe John",
})
req, _ := http.NewRequest("POST", "https://api.daat.red/public/card", bytes.NewReader(payload))
req.Header.Set("Content-Type", "application/json")
req.Header.Set("X-API-Key", os.Getenv("DAAT_API_KEY"))
resp, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
var out map[string]any
json.NewDecoder(resp.Body).Decode(&out)
fmt.Println(out["providerAsiCheckName"])
}
use serde_json::{json, Value};
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
let res = reqwest::Client::new()
.post("https://api.daat.red/public/card")
.header("X-API-Key", std::env::var("DAAT_API_KEY")?)
.json(&json!({
"cardNum": "4111111111111111",
"expMonth": "05",
"expYear": "2029",
"nameOnCard": "Doe John"
}))
.send()
.await?
.error_for_status()?;
let data: Value = res.json().await?;
println!("{}", data["providerAsiCheckName"]);
Ok(())
}
import java.net.URI;
import java.net.http.*;
var body = """
{
"cardNum": "4111111111111111",
"expMonth": "05",
"expYear": "2029",
"nameOnCard": "Doe John"
}
""";
var req = HttpRequest.newBuilder()
.uri(URI.create("https://api.daat.red/public/card"))
.header("Content-Type", "application/json")
.header("X-API-Key", System.getenv("DAAT_API_KEY"))
.POST(HttpRequest.BodyPublishers.ofString(body))
.build();
var res = HttpClient.newHttpClient()
.send(req, HttpResponse.BodyHandlers.ofString());
System.out.println(res.statusCode()); // 200
System.out.println(res.body());
A successful call returns status: "ok", the check result and credits.charged. Out of credits returns 402 payment_required with your balance; a throttled request returns 429 with Retry-After. Failed and throttled calls cost nothing. Full request/response fields, the error table and the OpenAPI spec are in the API reference.
You pay for answers, not attempts.
Load credits once. The meter only moves when a call returns something you can act on — no minimum spend, no subscription, no contract.
Failed lookups are free
Upstream errors, throttled requests and “not found” results are written to your request history at zero credits. No surprise burn.
Metered per method
Each method draws a set number of credits per useful result, scaled to how heavy the check is. Your rate is agreed for your account, and every response echoes the exact amount charged.
No lock-in
No minimum, no monthly fee, no annual commitment. Prepay what you want, use it at your pace, stop any time.
Predictable when empty
Run out and the API returns payment_required with your balance — never a silent failure. Top up from the console or by request.
REST first. Agent-ready. No SDK lock-in.
One base URL, one header, UTF-8 JSON both ways. Everything below ships out of the box.
API keys & IP rules
Create, view and rotate keys in the console. Pin an optional source-IP allowlist per key; leave it empty to accept any origin.
Built for volume
Capacity is provisioned to your traffic — screen every transaction inline, at peak, without back-pressure. We size the pipe to your numbers; throttled calls cost 0.
Sync or async
Call inline for a verdict in the response, or queue a job and take a signed webhook. Jobs survive key rotation.
Request history
Every call is stored with its status and cost. Per-method dashboards show success rate and spend so you can tune what you screen.
MCP endpoint
Point an AI agent at the Model Context Protocol server and let it run the same checks under your account, with the same billing.
Two-factor console
Time-based 2FA on the operator console, enforced on every sign-in once enabled — required before sharing API access.
# same key, three methods, one checkout decision POST /public/bin-info { "bin": "531260" } → issuer, country, EUR POST /public/ip-info { "ip": "8.8.8.8" } → ASN 15169, Google LLC POST /public/email-check { "email": "a@b.com" } → "accepted", 250
For teams that carry the chargeback.
Microfinance & lenders
Verify the person behind an application — name-on-card match, issuer country, email and IP context — before you disburse.
Fintech
Add an identity and payment-data layer to onboarding, top-ups and payouts without building the data pipes yourself.
Payment providers
Gate authorization for every merchant on the platform with a name-match and BIN check — no change to their checkout.
Banks
Enrich transaction and onboarding decisions with independent card, geo and email intelligence.
Money transfer & remittance
Screen sender and beneficiary details at the point of transfer — card, name, email and network context in one call.
Straight answers.
Is this a payment gateway?
No. daat.red is a data API. You keep your PSP, your acquirer and your checkout — daat.red adds the risk signal you query before you authorize. Nothing routes money through it.
What happens to the card data we send?
A card number passes through for a single lookup and is discarded — never stored, along with expiry dates and security codes. Request metadata and results are kept only for the minimum period the law requires, then deleted. See Security.
Which cards and regions are covered?
Card-name verification runs against the major international card networks, under our own direct agreements with them. BIN, IP and email coverage is global. Our data is continuously refreshed from a blend of proprietary systems and vetted data partners.
What exactly is a credit?
A prepaid unit of usage. Each method draws a set number of credits per useful result, scaled to how heavy the check is and agreed for your account. You're debited only when a call returns something usable; the balance and the amount charged come back on every response.
How is pricing set?
Per account. Credit prices depend on your volume and method mix — tell us what you need and we'll quote it. There's no free tier and no published rate card.
Is there a minimum, a monthly fee or a contract?
None of those. You prepay credits and use them at your pace — no minimum spend, no subscription, no annual commitment.
Is there a sandbox or free trial?
Not yet — a dedicated test environment is in development. For now you start with a prepaid balance on a live key.
Do failed or empty lookups cost anything?
No. Upstream errors, throttled requests and “not found” results are recorded in your request history at 0 credits.
Synchronous or webhook?
Both. Call the method directly for a verdict in the HTTP response, or submit /public/jobs/card or /public/jobs/bin-info and receive a signed webhook when the job completes.
Do you offer a DPA? Are you GDPR-compliant?
Yes. For the data you submit through the API, daat.red acts as your data processor; a Data Processing Agreement is available and the Privacy Policy covers the detail.
How do we get access, and how does support work?
Accounts are provisioned by our team — request one from billing@daat.red; self-serve signup is on the way. Once you're in, you generate keys and set IP rules yourself in the console. Support is by email at support@daat.red.
Put a verdict in front of every authorization.
Tell us the checks you need and the volume you expect. We'll provision an account and send you a key — set up by hand today, self-serve signup on the way.