402utils.com

Structural card-number check before hitting a PSP: Luhn checksum, network detection from public IIN prefixes (visa, mastercard, amex, discover, jcb, diners, unionpay) and per-network length validation. POST body on purpose: the number never appears in a URL, so it stays out of request logs and x402 payment metadata — never stored, logged or echoed back. No BIN/issuer lookup (BIN databases are licensed): well-formed does not mean the card exists.

Country reference card by ISO code (alpha-2/alpha-3/numeric) or English name: ISO 3166 codes, official name, current ISO 4217 currency (Bulgaria = EUR since 2026-01-01), dialling prefix, IANA ccTLDs (incl. IDN), languages, EU/EEA/Schengen/euro-area membership and the EU VAT prefix (Greece = EL). 56 countries: EU-27, EEA/EFTA, GB, US + 24 majors. Compiled from ISO/IANA/ITU/europa.eu sources, dated `asOf`.

Resolve DNS records for a domain over DNS-over-HTTPS: A, AAAA, MX, TXT, NS and CNAME, one or several types per call (type=A,MX). Records come back normalised — MX priority split out, trailing dots stripped, TXT quoting removed — each with its TTL. Cloudflare DoH with automatic Google DoH fallback for resilience; NXDOMAIN is reported explicitly instead of as an error.

Echoes back the JSON body you send, with a server timestamp. Useful for verifying your x402 client integration end to end.

Daily euro FX reference rates from the European Central Bank. ?base (default EUR), ?quote for a single rate, ?date=YYYY-MM-DD for history (last 90 ECB business days; older dates 404). Non-EUR bases are cross-rates derived via EUR (quote-per-EUR ÷ base-per-EUR). Weekend/holiday dates resolve to the last published ECB day — the date field says which. Published ~16:00 CET on ECB business days; informational rates, not for transaction pricing.

Validate an IBAN structurally before you pay or store it: ISO 7064 mod-97 check digits plus the official per-country length and BBAN layout (~90 countries), returning the bank/branch/account breakdown for FR, DE, ES, IT, BE and NL. Structural validation only — no BIC directory lookup (SWIFT's BIC registry is proprietary) and no proof the account exists. Local, instant. ?attest=1 → Ed25519-signed.

Detect the language of a text with franc (pure-JS trigram model, 61 languages + CJK/Indic scripts). Returns the ISO 639-1 code (639-3 when no 2-letter code exists), language name, a separation-margin confidence (0=ambiguous, 1=unambiguous), a reliable flag, and ranked alternatives. The pre-sort step of any multilingual pipeline. Short/ambiguous text returns reliable:false honestly. Processes provided text only; nothing is fetched.

ISO 11649 RF creditor reference (SEPA structured reference) — validate or generate. ?ref=RF18539007547034 checks the ISO 7064 mod 97-10 checksum and format (RF + 2 check digits + up to 21 alphanumerics); ?generate=539007547034 computes the check digits and returns the full RF reference with print formatting. Complements iban-check and vat-check for SEPA invoicing agents. Purely local, instant.

Robots.txt compliance check for polite crawlers and AI agents (GPTBot, ClaudeBot, ...). Pass a page URL and optionally your crawler's product token; returns whether the URL may be fetched, the winning Allow/Disallow rule, crawl-delay and sitemap URLs. Full RFC 9309 matching: wildcards, $ anchors, longest-match, merged groups. A 4xx robots.txt allows all; 5xx or unreachable hosts report disallowed. Cached per host for 1 hour.

Validate a US ABA routing number before initiating a transfer: the 3-7-1 checksum, the public structure rules (9 digits; assigned prefixes 00-12 primary, 21-32 thrift, 61-72 electronic, 80 traveler's cheque) and the implied Federal Reserve district. Checksum and structure only — no bank-name directory (the Fed's is redistribution-restricted) and no proof of assignment. ?attest=1 → Ed25519-signed.

Convert a datetime between any two IANA time zones using the runtime's ICU tzdb — always current, DST-correct, half-hour zones included. A datetime without offset is read as wall time in `from` (ambiguous fall-back times resolve to the earlier instant; times skipped by spring-forward shift ahead, flagged in `note`). Returns both ISO datetimes with offsets and DST status per side. Unknown zone → 400 with a spelling suggestion.

Count BPE tokens in a text with tiktoken (o200k_base = GPT-4o default, or cl100k_base). An agent can check content fits an LLM context window before paying for an expensive call. Returns token count, char count and encoding. Honest scope: an OpenAI-style estimate — no open-source Claude tokenizer exists (exact Claude counts need the Anthropic API), Gemini differs too. Provided text only; nothing is fetched. Max 1 MB.

Look up current VAT rates for any EU member state — standard, reduced, super-reduced and parking rates plus the currency — from the European Commission's official figures. Filter to one rate category if you only need one. Ideal for pricing, invoicing and tax-calculation logic that must apply the right rate per country. Returns the source and date verified. ?attest=1 → Ed25519-signed.

Convert between YAML and JSON in one call. to:"json" parses a YAML document (config files, docker-compose, Kubernetes manifests, CI pipelines) into a plain JSON value; to:"yaml" renders any JSON value as clean block-style YAML. Hardened: safe core schema (tags like !!js/function never execute), alias bombs rejected, one document per call, parse errors return line/column. YAML input up to 2 MB UTF-8.

Run up to 10 internal calls in one payment: POST {calls:[{path,input}]} and pay the SUM of the internal prices (≤ $0.05 total), executed in parallel, results returned in order. Batchable endpoints are the local, deterministic ones (validators, format transforms, time/locale) — no browser, network, composite or dynamic endpoints. Each result carries {path, status, body}; a bad request (unknown path, >10 calls, over cap) is a 400, not charged.

Business-day math with real holiday calendars for FR, DE, GB, US, ES, IT, NL, BE (2025-2027, official sources — same datasets as /v1/holidays). Count working/weekend/holiday days in a date range (?from&to&country) or shift a date by N business days (?from&add=10&country). Weekend configurable (?weekend=fri,sat), optional ?region= for Länder/UK divisions. Holidays that suppress a working day are listed by name.

Split a long text into token-sized chunks for RAG ingestion. Chunks are measured in REAL tokens (tiktoken o200k_base/cl100k_base), honour a token overlap, and cut on sentence, paragraph or word boundaries (strategy). Returns each chunk text, its exact token count and char offsets. The natural composite of token-count; counts are OpenAI-style estimates (no Claude tokenizer exists). Provided text only; nothing is fetched. Over 1 MB is truncated.

Next occurrences of a cron expression in any IANA time zone, DST-aware via the runtime's ICU tzdb (times skipped by DST shift forward by the gap; ambiguous times fire once). Dialect (croner): 5-7 fields with optional seconds and year, ranges, steps, lists, JAN-DEC/SUN-SAT names, L, W, #, ? and @daily-style aliases. Each occurrence is returned as local ISO with offset plus UTC. Bad expression → 400 naming the offending field.

Convert CSV to JSON with a strict RFC 4180 parser: quoted fields, doubled quotes, delimiters and line breaks inside quotes, mixed CRLF/LF, BOM. Auto-detects comma, semicolon, tab or pipe (or set delimiter). First row becomes object keys; headers:false yields string arrays. Ragged rows and unterminated quotes are repaired and reported in errors[], never a crash. All values stay strings. Send raw CSV text or JSON {csv}. Max 5 MB.

Compute the diff between two texts (a → b) — no git needed. Returns a standard unified patch (line-oriented in both modes, applies with git apply or patch), added/removed counts, and in word mode a token-level change list for inline highlighting (capped at 2000 entries). CRLF line endings and missing trailing newlines are preserved byte-exactly. Caps: 1 MB UTF-8 per input; pathologically divergent inputs return 422 diff_too_complex.

Domain availability and expiry intelligence via RDAP, the WHOIS successor. Queries the authoritative registry for any RDAP-enabled TLD: free domains return registered:false, taken ones return registrar, creation and expiry dates, nameservers and EPP status codes. TLDs without RDAP coverage return supported:false. Built for agents that buy, monitor or vet domains.

Generate an EPC QR code (SEPA Credit Transfer / « Girocode », EPC069-12) — the QR a banking app scans to pre-fill a transfer, the payment companion to an invoice. Body { name, iban, amount?, bic?, purpose?, remittance? | reference? (RF) }. Returns PNG (default), SVG, or the raw EPC text. IBAN + RF are validated; strict EPC encoding (order, lengths, ≤331 bytes, level M). EUR only. Not a payment initiation — just the encoded data.

Extract emails, http(s) URLs, international phone numbers, @mentions and #hashtags from provided text OR html — normalized and de-duplicated. From html, also reads href/src attributes and mailto: links. Emails are syntax-validated; phones use Google libphonenumber (international format). Pattern-based extraction, NOT ML named-entity recognition. What a crawl agent pulls from every page. Processes provided content only; nothing is fetched.

Public and bank holidays for FR, DE, GB, US, ES, IT, NL, BE — years 2025-2027, each dataset verified against the country's official source (Etalab, Land statutes, gov.uk feed, OPM, BOE, normattiva, rijksoverheid, SPF Emploi). Movable feasts are computed (Gregorian computus), substitute days follow each country's official rule. Optional ?region= for sub-national holidays (German Länder, UK divisions, Alsace-Moselle).

Extract every table from HTML you provide into clean JSON — no fetching, send the markup itself as {html} or a raw text/html body. Returns per table: optional caption, headers[] (from thead or an all-th first row) and rectangular rows[][]. colspan/rowspan cells are grid-expanded with the value duplicated so rows align with the visual layout; nested tables are flattened into the outer cell's text. Caps: 5 MB HTML, 200 tables, 200k cells.

Build a strictly RFC 5545-conformant .ics calendar file from a list of events: correct TEXT escaping, 75-octet line folding, generated UIDs, and unambiguous UTC timestamps (a per-event IANA timezone interprets naive wall-clock times). Supports all-day events, location, description and a passthrough RRULE. The fiddly conformance an agent shouldn't hand-roll.

Convert a JSON array of objects into a clean RFC 4180 CSV: header row, CRLF records, correct quoting and quote-doubling. Nested objects flatten to dot-notation columns (a.b.c), arrays are JSON-encoded into their cell, and you can select and order columns explicitly. Delimiter: comma, semicolon, tab or pipe. Caps: 100,000 rows, 5 MB body, 20 MB CSV out. Returns text/csv ready for Excel, Google Sheets or a data pipeline.

Verify a link before you cite or use it: HTTP status, the full redirect chain, the final URL, latency, and the final Content-Type/Content-Length. Redirects are followed manually (max 10) with SSRF validation on every hop; probes with HEAD by default and falls back to GET automatically when a server rejects HEAD. A dead or broken target (404, 410, 500…) is a valid result, not an error. Response bodies are never downloaded.

Convert Markdown to sanitized HTML that is safe to embed directly in a page, email or app. GFM supported: tables, task lists, strikethrough, fenced code. Output passes a strict tag/attribute allowlist: scripts, styles, iframes, event handlers and javascript: URLs are removed; links keep only http(s)/mailto targets, images only http(s) or base64 image data URIs. Send JSON {markdown} or a raw text/markdown body, max 2 MB. Returns {html}.

Validate and normalize a phone number with full Google libphonenumber metadata: strict validity against each national numbering plan, E.164 / international / national formats, country detection (correct across shared codes like +1 and +44) and line type (mobile, fixed_line, toll_free, voip…) where the plan distinguishes it. Pass ?country=FR to parse national formats. Purely local; the number is never stored.

Generate a QR code as PNG or SVG from any text or URL. Pick the size, error-correction level (L/M/Q/H) and foreground/background colours; a 4-module quiet zone is always included so it scans reliably. Returns the raw image bytes. No logo overlay (compositing is out of scope).

Fetch an RSS 2.0 or Atom feed and return clean JSON: feed title, link and description, plus items with title, link, ISO-8601 publishedAt, summary and author. Handles both formats and normalises the dates. The caller-supplied URL is SSRF-checked; the fetch is capped at 2 MB and 8 s.

US sales tax STATE-LEVEL base rates for the 50 states + DC, as statutory percent. ?state=CA for one state, omit for all. Returns the state-only rate, any mandatory statewide local add-on (CA/UT/VA) and their sum. STATE BASE RATE ONLY — optional city/county/district rates are EXCLUDED and can add several points; not tax advice. Compiled from state statutes, cross-checked against two dated published trackers (asOf field included).

Validate an EU VAT number against the official VIES registry before invoicing, onboarding or a reverse charge. Per-country syntax is checked locally first, so invalid formats never touch the network. Valid numbers return the registered company name and address when disclosed, plus an optional consultation number (requesterVat). Never a false 'invalid': if VIES is down you get a 503 and are not charged. ?attest=1 → Ed25519-signed.

Resolve a Basename or ENS name to an address, or an address to its primary name. Pass ?name=402utils.base.eth (name→address) or ?address=0x… (address→primary name). Basenames resolve on Base L2, other .eth names on Ethereum mainnet. Reverse results are forward-verified. ASCII names only; offchain (CCIP-read) resolvers like cb.id are not supported.

Quote an x402-paid API before you buy: probes a third-party endpoint with one unpaid GET (no payment is ever sent) and decodes its payment requirements — x402 v2 base64 PAYMENT-REQUIRED header or v1 JSON body. Returns normalised prices (atomic amount, asset, network, payTo), description, resource URL and Bazaar discovery metadata. Non-402 targets return {isX402:false, status}. SSRF-checked, 1 redirect max, 8 s timeout.

Convert XML to clean JSON. POST raw XML (XML or text/plain Content-Type) or a JSON envelope {xml, alwaysArray}. Attributes land under "@_" keys, mixed-content text under "#text", repeated siblings become arrays, and alwaysArray forces arrays for listed tags even on a single occurrence. Numeric character references decode. DTD entities and DOCTYPE internal subsets rejected (anti-XXE / billion-laughs). Max 5 MB.

Profile a CSV before processing it: send the bytes directly or a JSON body with a public {url}. Returns per-column name, inferred type (string/int/float/bool/date/mixed), null and unique counts, min/max and samples, plus row count, detected delimiter and data-quality issues (malformed rows, inconsistent widths, duplicate headers). Query: delimiter (, ; tab |), header=false if row one is data. Max 10 MB.

Validate an email address before you accept a signup or send to it: RFC 5322 syntax, whether the domain resolves and its MX records, whether it is a disposable/throwaway domain (community blocklist), and whether it is a role account (info@, support@…). DNS is checked over DoH. No SMTP probing (intrusive and spammy), so a true 'domainExists' does not guarantee the mailbox exists.

Convert raw HTML into clean GitHub-Flavored Markdown: ATX headings, fenced code, pipe tables, strikethrough, task lists; script/style/iframe text is always stripped. mode=article isolates the main article with Mozilla Readability (returns title, byline, excerpt; drops nav/footer boilerplate; resolves relative links), else converts the whole document. Converts provided HTML only — never fetches URLs. Max 5 MB.

Link preview for any web page: fetches a URL and parses only the <head> (no JS, no rendering). Returns title, meta description, canonical URL, language, an always-absolute favicon, all Open Graph and Twitter Card tags, and RSS/Atom/JSON-feed links. Tolerant of messy real-world HTML and non-UTF-8 charsets. The caller-supplied URL is SSRF-checked; the fetch is capped at 5 MB and 8 s.

Generate a polished Open Graph / social share image (PNG) from text — no browser, no design tools. Pick a template (article, product, stat), pass a title and optional subtitle, set your brand accent colour and light/dark theme, and get back a crisp 1200×630 PNG ready for og:image, Twitter cards, blog headers and launch posts. Rendered with Satori + resvg; fast and cheap.

Look up a business in the public Peppol Directory — where to route an e-invoice (the BT-34/49 electronic address). ?id= (a Peppol id like 0225:992412536, or a value to search) or ?country=FR&name=. Returns { found, count, participants:[{peppolId, name, country, documentTypes[], schemes[]}] }. Unknown id → { found:false }. Directory down → 503, unbilled. Public source, 1h cache.

Extract the main article from a web page with Mozilla Readability — drops nav, ads, sidebars and footer boilerplate. Send inline {html} or a public {url} to fetch (SSRF-checked). Returns the article title, byline, cleaned HTML content, plain textContent, excerpt, character length, language and site name. THE pre-processing step before sending a page to an LLM. Distinct from html-to-md (which renders Markdown). Max 5 MB.

Verify on-chain that a transaction is the USDC payment you expected. Pass ?tx=0x… plus optional ?expectedPayTo=0x… and ?expectedAmount=0.01 (USD); ?network defaults to the deployment chain (base or base-sepolia). Decodes the tx's USDC Transfer logs and returns {verified, actualPayTo, actualAmount, asset, blockTime, confirmations, mismatch}. Unknown/unmined tx → 503 (unbilled). Add ?attest=1 for a signed receipt.

Turn any sitemap.xml into clean JSON: URL entries with loc, lastmod and priority, plus sitemap-index detection with the child sitemap list. Handles gzipped .gz sitemaps (magic-byte detection, zip-bomb guarded) and namespaced XML; pass follow=1 to also expand up to 3 child sitemaps of an index in one call. SSRF-checked fetches, 10 MB per document, up to 50,000 URLs with a truncated flag.

Extractive summary: selects the N most salient sentences via TextRank (TF-IDF cosine + PageRank) — a pure algorithm, no LLM, so deterministic and free of inference cost. Returns the summary and each chosen sentence with a salience score and index. Extractive (selects existing sentences), NOT abstractive/generative — that is the point: reproducible and model-free. Pre-condense a page before an LLM call. Provided text only. Over 1 MB truncated.

Lint an x402 endpoint before agents find it broken. Probes a third-party 402 (unpaid, SSRF-checked) and audits it: description ≥450 chars (CDP silently rejects at settle → 402 {} with no charge), missing Bazaar discovery or input/output schemas, resource.url host mismatch or *.workers.dev identity, x402Version 1 (frozen), non-CAIP-2 network, unparseable amount, unknown asset, odd maxTimeoutSeconds. Returns pass/warn/fail/info checks + summary.

Inspect a ZIP archive safely: send the bytes directly or a JSON body with a public {url}. Returns the entry list (path, size, compressedSize, isDir); entries with path traversal (../), absolute or malformed paths are flagged suspicious:true and never interpreted. Add ?extract=exact/entry/path to get that one file back (max 5 MB decompressed). Zip bombs are refused. Max 20 MB.

Read a Factur-X / ZUGFeRD invoice: send PDF bytes or a JSON { url }. Extracts the embedded EN 16931 CII into normalised data — seller, buyer, lines, VAT, totals, payment, dates, references — with the detected profile. The read side of e-invoicing (the FR mandate starts with reception). No embedded CII → { profile:"none", warning:"no_embedded_cii" }. ?attest=1 → Ed25519-signed.

Resize and convert an image (PNG, JPEG or WebP, up to 10 MB). Send the image bytes as the body and set options in the query: width, height, fit (contain or cover), format (webp/jpeg/png) and quality (JPEG). Returns the converted image bytes. WebP has no quality knob and AVIF is not supported (out of scope).

Pre-flight a SEPA invoice's identifiers in one paid call: validate the customer VAT (VIES, with company name), the IBAN (ISO 7064 mod-97 + BBAN layout) and an ISO 11649 RF creditor reference, run together with a per-field status. summary.allProvidedValid is true only if every provided identifier checked out. If all provided checks fail technically you get a 503 and no charge. ?attest=1 → Ed25519-signed.

Extract text from a .docx (Word) document: send the docx bytes directly, or a JSON body with a public {url}. Returns the plain text, a best-effort markdown rendering (headings, bold/italic and lists; tables are flattened to paragraphs), and metadata (title, author). Text layer only — no OCR of embedded images. Max 10 MB.

Validate a Factur-X / ZUGFeRD invoice: send PDF bytes, JSON { url } or { pdfBase64 }, or raw CII { xml }. Returns a rule-based report — PDF/A-3 structure, EN 16931 CII anchors, arithmetic rules (BR-CO) and French PA « Flux 2 » checks (BR-FR) — with the detected profile. Structural + heuristic, not a certified conformance service. ?attest=1 → Ed25519-signed audit trail.

Live market price stats for a kind of x402 service, from the public Bazaar catalog. Pass ?category=vat or ?query=pdf extraction and get {sampleSize, priceUsd:{min,p25,median,max,p75}, networks, examples} in USD — is your price fair, what should you charge? Computed over a live sample of up to 1000 resources; <3 matches returns an honest 'insufficient market data'. Neutral: our own endpoints are never featured.

Extract text from a PDF: send the PDF bytes directly, or a JSON body with a public {url}. Returns the full text, per-page text, and metadata (page count, title, author). Text layer only — scanned/image-only PDFs return empty text with a no_text_layer warning (no OCR). Max 10 MB.

Extract data from an .xlsx spreadsheet: send the bytes directly or a JSON body with a public {url}. Returns each sheet as rows (array-of-arrays) with its name and used range, plus workbook metadata. Query: sheet (name or 0-based index) for a single sheet, headers=true for array-of-objects. Formula cells return their cached computed value. Capped at 500000 cells. Max 10 MB.

Vet a supplier in one paid call instead of four: give any of a VAT number, IBAN and domain and get VAT validity (VIES) with company name, IBAN structure (mod-97 + BBAN), domain status (RDAP) and the country (from the VAT prefix) — run in parallel, each with a per-field status. summary.allProvidedValid is true only if every provided check confirmed. If all provided checks fail technically you get a 503 and no charge. ?attest=1 → Ed25519-signed.

Full profile of a web page in one paid call: <head> metadata (title, description, canonical, OpenGraph, favicon, feeds), DNS records (A/AAAA/MX/NS), robots.txt crawl permission for your user-agent, and domain registration/expiry (RDAP) — fanned out in parallel, each section with its own status. Pass ?userAgent= to test robots for a specific crawler. Page fetches are SSRF-checked. If every section fails technically you get a 503 and no charge.

Capture a screenshot of any public web page with a headless Chrome browser. Set the viewport, grab the full scrollable page or just the fold, and choose PNG, JPEG or WebP with an optional quality. Returns the raw image bytes — ideal for link previews, thumbnails, visual monitoring and archiving. No browser to run, pay per capture.

Support 402utils — or use it as a parametric x402 payment-test endpoint: you set the price with ?amount= (USD, clamped to $0.001–$0.05) and the 402 demands exactly that, so you can assert a client pays the precise amount and the on-chain USDC tx matches. After payment returns {thanks, amount, message}. The amount is a pure function of ?amount, identical on the unpaid probe and the paid retry.

Render HTML or a public web page into a pixel-perfect PDF using a headless Chrome browser. Send inline `html` (invoices, receipts, reports, tickets) or a `url` to snapshot; control paper size, orientation, margins, background graphics and scale. Returns the raw application/pdf bytes — no signup, no browser to run, pay per document.

On-chain + config reliability report for any x402 seller, public data only, computed live. Pass ?payTo=0x… or ?url= (a third-party x402 endpoint) → {onchain:{firstSeenAt,totalIncomingTransfers,uniqueSenders,last30dInflows,note}, config, liveness, discovery} plus factual flags (new_seller, single_sender, config_issues, unreachable). On-chain counts all incoming USDC transfers, not only x402 settlements. No score, no verdict; fails open.

Generate a Factur-X invoice (PDF/A-3 + embedded EN 16931 CII XML) from structured data: send { invoice, profile }, get the PDF bytes (or JSON with base64 + conformity report via Accept: application/json). Targets EN 16931 and the French PA « Flux 2 » rules (payment mentions, business process, electronic addresses) ahead of the 2026-09 mandate. Technical artifact, not tax/legal advice; you remain responsible for data accuracy and PA transmission.