402utils

Endpoints (101 live)

• GET /v1/vat-check — Validate an EU VAT number against the official VIES registry before invoicing, onboarding or a reverse charge. Per-country syntax is checked locally first, so invalid formats never touch the network. Valid numbers return the registered company name and address when disclosed, plus an optional consultation number (requesterVat). Never a false 'invalid': if VIES is down you get a 503 and are not charged. ?attest=1 → Ed25519-signed. (free)
• GET /v1/fx-rates — Daily euro FX reference rates from the European Central Bank. ?base (default EUR), ?quote for a single rate, ?date=YYYY-MM-DD for history (last 90 ECB business days; older dates 404). Non-EUR bases are cross-rates derived via EUR (quote-per-EUR ÷ base-per-EUR). Weekend/holiday dates resolve to the last published ECB day — the date field says which. Published ~16:00 CET on ECB business days; informational rates, not for transaction pricing. (free)
• GET /v1/x402-probe — Quote an x402-paid API before you buy: probes a third-party endpoint with one unpaid GET (no payment is ever sent) and decodes its payment requirements — x402 v2 base64 PAYMENT-REQUIRED header or v1 JSON body. Returns normalised prices (atomic amount, asset, network, payTo), description, resource URL and Bazaar discovery metadata. Non-402 targets return {isX402:false, status}. SSRF-checked, 1 redirect max, 8 s timeout. (free)
• GET /v1/x402-lint — Lint an x402 endpoint before agents find it broken. Probes a third-party 402 (unpaid, SSRF-checked) and audits it: description ≥450 chars (CDP silently rejects at settle → 402 {} with no charge), missing Bazaar discovery or input/output schemas, resource.url host mismatch or *.workers.dev identity, x402Version 1 (frozen), non-CAIP-2 network, unparseable amount, unknown asset, odd maxTimeoutSeconds. Returns pass/warn/fail/info checks + summary. (free)
• GET /v1/email-check — Validate an email address before you accept a signup or send to it: RFC 5322 syntax, whether the domain resolves and its MX records, whether it is a disposable/throwaway domain (community blocklist), and whether it is a role account (info@, support@…). DNS is checked over DoH. No SMTP probing (intrusive and spammy), so a true 'domainExists' does not guarantee the mailbox exists. (free)
• GET /v1/vat-rates — Look up current VAT rates for any EU member state — standard, reduced, super-reduced and parking rates plus the currency — from the European Commission's official figures. Filter to one rate category if you only need one. Ideal for pricing, invoicing and tax-calculation logic that must apply the right rate per country. Returns the source and date verified. ?attest=1 → Ed25519-signed. (free)
• GET /v1/iban-check — Validate an IBAN structurally before you pay or store it: ISO 7064 mod-97 check digits plus the official per-country length and BBAN layout (~90 countries), returning the bank/branch/account breakdown for FR, DE, ES, IT, BE and NL. Structural validation only — no BIC directory lookup (SWIFT's BIC registry is proprietary) and no proof the account exists. Local, instant. ?attest=1 → Ed25519-signed. (free)
• GET /v1/market-price — Live market price stats for a kind of x402 service, from the public Bazaar catalog. Pass ?category=vat or ?query=pdf extraction and get {sampleSize, priceUsd:{min,p25,median,max,p75}, networks, examples} in USD — is your price fair, what should you charge? Computed over a live sample of up to 1000 resources; <3 matches returns an honest 'insufficient market data'. Neutral: our own endpoints are never featured. (free)
• POST /v1/diff — Compute the diff between two texts (a → b) — no git needed. Returns a standard unified patch (line-oriented in both modes, applies with git apply or patch), added/removed counts, and in word mode a token-level change list for inline highlighting (capped at 2000 entries). CRLF line endings and missing trailing newlines are preserved byte-exactly. Caps: 1 MB UTF-8 per input; pathologically divergent inputs return 422 diff_too_complex. (free)
• POST /v1/pdf — Render HTML or a public web page into a pixel-perfect PDF using a headless Chrome browser. Send inline `html` (invoices, receipts, reports, tickets) or a `url` to snapshot; control paper size, orientation, margins, background graphics and scale. Returns the raw application/pdf bytes — no signup, no browser to run, pay per document. (free)
• POST /v1/zip-inspect — Inspect a ZIP archive safely: send the bytes directly or a JSON body with a public {url}. Returns the entry list (path, size, compressedSize, isDir); entries with path traversal (../), absolute or malformed paths are flagged suspicious:true and never interpreted. Add ?extract=exact/entry/path to get that one file back (max 5 MB decompressed). Zip bombs are refused. Max 20 MB. (free)
• POST /v1/docx-extract — Extract text from a .docx (Word) document: send the docx bytes directly, or a JSON body with a public {url}. Returns the plain text, a best-effort markdown rendering (headings, bold/italic and lists; tables are flattened to paragraphs), and metadata (title, author). Text layer only — no OCR of embedded images. Max 10 MB. (free)
• POST /v1/embed — Text → vector embeddings via Cloudflare Workers AI. Send {text} or {texts[]} (≤20, each ≤4000 chars); returns one float vector per input. Default model @cf/baai/bge-m3 (1024-dim, multilingual). The model is named in the response — embeddings only compare within the same model. Completes the RAG chain: readability → chunk → embed, no OpenAI account. Cosine-compare the vectors yourself. Unavailable model/binding → 503, not billed. (free)
• POST /v1/lang-detect — Detect the language of a text with franc (pure-JS trigram model, 61 languages + CJK/Indic scripts). Returns the ISO 639-1 code (639-3 when no 2-letter code exists), language name, a separation-margin confidence (0=ambiguous, 1=unambiguous), a reliable flag, and ranked alternatives. The pre-sort step of any multilingual pipeline. Short/ambiguous text returns reliable:false honestly. Processes provided text only; nothing is fetched. (free)
• POST /v1/regex-test — Test a regex against one or many inputs, safely. Send {pattern, flags?, input|inputs[], mode?}: 'match' returns the first match + capture groups, 'matchAll' every match, 'replace' the rewritten string (needs {replacement}). A mandatory ReDoS guard statically rejects catastrophic patterns (nested quantifiers, `.*.*$`, backrefs) BEFORE running — on Workers no timeout can stop a runaway regex. For agents that generate and dry-run regexes. (free)
• POST /v1/image-optimize — Resize and convert an image (PNG, JPEG or WebP, up to 10 MB). Send the image bytes as the body and set options in the query: width, height, fit (contain or cover), format (webp/jpeg/png) and quality (JPEG). Returns the converted image bytes. WebP has no quality knob and AVIF is not supported (out of scope). (free)
• POST /v1/structured-data — Extract a page's structured data: JSON-LD (schema.org), Open Graph tags, and best-effort microdata. Returns the parsed JSON-LD objects, detected schema.org types (Product, Offer, Review, Event, Recipe, Article…), microdata items and the og:* map. Send inline {html} or a public {url} (SSRF-checked). Malformed JSON-LD yields a {parseError} entry, never a crash. Microdata is best-effort; JSON-LD is the reliable path. Max 5 MB. (free)
• POST /v1/c2pa-verify — Verify C2PA / Content Credentials (provenance & tamper detection) in an image: send the image bytes or a JSON {url}. Returns Trusted/Valid/Invalid/None with per-manifest signature, trust-chain (issuer) and asset-hash checks plus C2PA actions. 'Trusted' only if the signer chains to the C2PA trust list, otherwise 'Valid'. Relevant to EU AI Act Art. 50. Verification only (embedded manifests) — not generation. (free)
• POST /v1/md-to-html — Convert Markdown to sanitized HTML that is safe to embed directly in a page, email or app. GFM supported: tables, task lists, strikethrough, fenced code. Output passes a strict tag/attribute allowlist: scripts, styles, iframes, event handlers and javascript: URLs are removed; links keep only http(s)/mailto targets, images only http(s) or base64 image data URIs. Send JSON {markdown} or a raw text/markdown body, max 2 MB. Returns {html}. (free)
• POST /v1/csv-diff — Row-level diff of two CSVs (a→b) — reconcile two exports. With `key` (a column name, or a column index when header:false), rows pair by key → added / removed / changed (per-field old→new). Without a key, a whole-row multiset diff gives added/removed only. Delimiter auto-detected (, ; tab |); tolerant RFC-4180 parsing. First row is the header unless header:false. Max 5 MB per input; reported buckets cap at 10000. (free)

+81 more endpoints.