Payment data intelligence API

Every payment,
checked before
you take it.

daat.red is the pre-authorization data layer for payment teams. One API key, seven checks — each one returns a verdict in the response.

base — https://api.daat.red  ·  auth — X-API-Key

POST api.daat.red/public/card
# verify the cardholder before you authorize
curl -X POST 'https://api.daat.red/public/card' \
  -H 'X-API-Key: ak_live_…' \
  -d '{ "cardNum": "<PAN>",
        "nameOnCard": "Doe John" }'
← 200 OK
{
  "status":  "ok",
  "bin":     "411111",
  "cardLast4": "1111",
  "providerAsiCheckName": "Match",
  "providerAsiCheckResult": "A",
  "receivedAt": "2026-06-06T12:34:56Z"
}
◆ Cardholder name — match

Live shape of the /card response. A confirmed match draws credits; an upstream error or “not valid” is logged at no charge.

7
Checks, one key
0
Card numbers stored
REST
JSON in, JSON out
99.9%
Monthly uptime target
One key · seven checks

The whole risk picture, one integration.

Every method is a single POST that returns a normalized verdict plus the raw response fields. Each call is metered in prepaid credits; the exact amount charged comes back on every response.

Card check

per result
POST /public/card

Confirms the cardholder's name with the card network before you authorize. Accepts tokenized cards with TAVV, DSRP, AAV or UCAF cryptograms.

verdict — name match + network check code

Card info

per result
POST /public/card-info

Full profile from the PAN — issuer, country, billing currency and minor digits, product type, subtype and platform, transfer capability.

verdict — issuer · country · currency · product

BIN lookup

per result
POST /public/bin-info

Country, issuing bank and local currency for a 6–8 digit BIN. No full PAN required. A BIN that isn't in the catalog costs nothing.

verdict — countryCode · issuerName · localCurrency

IP info

per result
POST /public/ip-info

Geolocation and network context for any IPv4 or IPv6 — country, city, postal, timezone, ASN and operator, plus currency and phone-prefix enrichment.

verdict — country · city · ASN org

Email info

per result
POST /public/email-info

Names publicly associated with an email address, with occurrence counts and a match flag against the name you expect. Charged only when names come back.

verdict — names[] · match: true / false

Email check

per result
POST /public/email-check

Live SMTP probe — can this mailbox actually receive mail. Returns the result, the SMTP response code and the raw server line.

verdict — accepted / rejected + response code

Balance

no charge
GET /public/balance

Current credit balance for the key. Poll it from a billing job or wire it to an alert before you run dry mid-checkout.

Async jobs

per result
POST /public/jobs/card · /public/jobs/bin-info · GET /public/jobs/{id}

Submit card or BIN checks as queued jobs and take a signed webhook on completion. Accepted jobs keep processing through an API-key rotation.

Flagship check

Is the name on the card the name of the person paying?

You send the card details. daat.red forwards the verification to the relevant card network — under our own direct agreements with those networks — and returns the network's verdict: a clear match / no-match plus its check code, before you send the authorization. The card number passes through for that one check and is never stored.

  • Name-order aware. Send nameOnCard as “Surname First name”, matching the network convention.
  • Token friendly. Pass cryptogramType + cryptogramValue for network tokens; they're never echoed back.
  • Client echo. Any outInfo string up to 64 chars is returned unchanged for your correlation.
  • Honest billing. Only a useful result draws credits; an upstream error or “not valid” is stored in history at no charge.
response · 200 OK
{
  "outInfo": "order-88213",
  "status": "ok",
  "cardLast4": "1111",
  "bin": "411111",
  "providerAsiCheckResult": "A",
  "providerAsiCheckName": "Match",
  "providerAsiCheckDescription":
      "Check completed, match confirmed",
  "receivedAt": "2026-06-06T12:34:56Z",
  "credits": { "balance": 997, "charged": 4 }
}
Security & data handling

You're sending card data. Here's what happens to it.

daat.red sits in the payment path, so the boring guarantees matter more than the features.

Isolated

Dedicated, not shared

Card-data processing runs on dedicated, access-controlled infrastructure — not a shared multi-tenant pool. Network exposure is kept to the minimum the API needs.

Zero retention

Card numbers are never stored

A card number sent for Card check or Card info is used for that one lookup, forwarded to the network, and discarded. We don't keep PANs, expiry dates or security codes — ever.

Minimal footprint

We keep only what the law requires

Request metadata and results are retained for the minimum period required by applicable law, then deleted. No shadow profiles, no resale of your data.

In transit

Encrypted end to end

TLS on every connection. API keys are shown once and stored hashed; rotate them any time from the console.

Scoped access

Keys you can lock down

Pin a source-IP allow-list per key, rotate on a schedule, and enforce time-based 2FA on the operator console before anyone touches API access.

GDPR

Processor, with a DPA

For the data you submit through the API, daat.red acts as your data processor. A Data Processing Agreement is available; the Privacy Policy has the detail.

Quickstart

The same call, in your language.

Every method is one HTTPS POST with an X-API-Key header and a JSON body. Below is Card check against /public/card — swap the path for any other method.

Base URLhttps://api.daat.red
Auth headerX-API-Key: ak_live_…
Body & responseapplication/json · UTF-8
ThroughputHigh-capacity · scaled to your volume
curl -X POST 'https://api.daat.red/public/card' \
  -H 'Content-Type: application/json' \
  -H "X-API-Key: $DAAT_API_KEY" \
  -d '{
    "cardNum":    "4111111111111111",
    "expMonth":   "05",
    "expYear":    "2029",
    "nameOnCard": "Doe John"
  }'

A successful call returns status: "ok", the check result and credits.charged. Out of credits returns 402 payment_required with your balance; a throttled request returns 429 with Retry-After. Failed and throttled calls cost nothing. Full request/response fields, the error table and the OpenAPI spec are in the API reference.

Prepaid credits

You pay for answers, not attempts.

Load credits once. The meter only moves when a call returns something you can act on — no minimum spend, no subscription, no contract.

0

Failed lookups are free

Upstream errors, throttled requests and “not found” results are written to your request history at zero credits. No surprise burn.

Tiered

Metered per method

Each method draws a set number of credits per useful result, scaled to how heavy the check is. Your rate is agreed for your account, and every response echoes the exact amount charged.

None

No lock-in

No minimum, no monthly fee, no annual commitment. Prepay what you want, use it at your pace, stop any time.

402

Predictable when empty

Run out and the API returns payment_required with your balance — never a silent failure. Top up from the console or by request.

Built to drop in

REST first. Agent-ready. No SDK lock-in.

One base URL, one header, UTF-8 JSON both ways. Everything below ships out of the box.

API keys & IP rules

X-API-Key

Create, view and rotate keys in the console. Pin an optional source-IP allowlist per key; leave it empty to accept any origin.

Built for volume

high-throughput

Capacity is provisioned to your traffic — screen every transaction inline, at peak, without back-pressure. We size the pipe to your numbers; throttled calls cost 0.

Sync or async

/public/jobs/{id}

Call inline for a verdict in the response, or queue a job and take a signed webhook. Jobs survive key rotation.

Request history

per-method ledger

Every call is stored with its status and cost. Per-method dashboards show success rate and spend so you can tune what you screen.

MCP endpoint

api.daat.red/mcp · OAuth

Point an AI agent at the Model Context Protocol server and let it run the same checks under your account, with the same billing.

Two-factor console

TOTP

Time-based 2FA on the operator console, enforced on every sign-in once enabled — required before sharing API access.

# same key, three methods, one checkout decision
POST /public/bin-info    { "bin": "531260" }        → issuer, country, EUR
POST /public/ip-info     { "ip": "8.8.8.8" }        → ASN 15169, Google LLC
POST /public/email-check { "email": "a@b.com" }     → "accepted", 250
Who it's for

For teams that carry the chargeback.

Microfinance & lenders

Verify the person behind an application — name-on-card match, issuer country, email and IP context — before you disburse.

Fintech

Add an identity and payment-data layer to onboarding, top-ups and payouts without building the data pipes yourself.

Payment providers

Gate authorization for every merchant on the platform with a name-match and BIN check — no change to their checkout.

Banks

Enrich transaction and onboarding decisions with independent card, geo and email intelligence.

Money transfer & remittance

Screen sender and beneficiary details at the point of transfer — card, name, email and network context in one call.

Before you ask

Straight answers.

Is this a payment gateway?

No. daat.red is a data API. You keep your PSP, your acquirer and your checkout — daat.red adds the risk signal you query before you authorize. Nothing routes money through it.

What happens to the card data we send?

A card number passes through for a single lookup and is discarded — never stored, along with expiry dates and security codes. Request metadata and results are kept only for the minimum period the law requires, then deleted. See Security.

Which cards and regions are covered?

Card-name verification runs against the major international card networks, under our own direct agreements with them. BIN, IP and email coverage is global. Our data is continuously refreshed from a blend of proprietary systems and vetted data partners.

What exactly is a credit?

A prepaid unit of usage. Each method draws a set number of credits per useful result, scaled to how heavy the check is and agreed for your account. You're debited only when a call returns something usable; the balance and the amount charged come back on every response.

How is pricing set?

Per account. Credit prices depend on your volume and method mix — tell us what you need and we'll quote it. There's no free tier and no published rate card.

Is there a minimum, a monthly fee or a contract?

None of those. You prepay credits and use them at your pace — no minimum spend, no subscription, no annual commitment.

Is there a sandbox or free trial?

Not yet — a dedicated test environment is in development. For now you start with a prepaid balance on a live key.

Do failed or empty lookups cost anything?

No. Upstream errors, throttled requests and “not found” results are recorded in your request history at 0 credits.

Synchronous or webhook?

Both. Call the method directly for a verdict in the HTTP response, or submit /public/jobs/card or /public/jobs/bin-info and receive a signed webhook when the job completes.

Do you offer a DPA? Are you GDPR-compliant?

Yes. For the data you submit through the API, daat.red acts as your data processor; a Data Processing Agreement is available and the Privacy Policy covers the detail.

How do we get access, and how does support work?

Accounts are provisioned by our team — request one from billing@daat.red; self-serve signup is on the way. Once you're in, you generate keys and set IP rules yourself in the console. Support is by email at support@daat.red.

Request access

Put a verdict in front of every authorization.

Tell us the checks you need and the volume you expect. We'll provision an account and send you a key — set up by hand today, self-serve signup on the way.

Email billing@daat.red Open the console base — https://api.daat.red