402utils.com

/v1/barcode

Generate a 1D barcode as PNG or SVG: EAN-13, EAN-8, UPC-A, Code 128, Code 39 or ITF-14. Validates the structure and check digit for each symbology — EAN/UPC/ITF compute a missing check digit or reject a wrong one. Options: format (png/svg), scale (module px 1-10), text (human-readable line, default on). Returns the raw image. Generation only — reading a barcode from an image is out of scope.

/v1/batch

Run up to 10 internal calls in one payment: POST {calls:[{path,input}]} and pay the SUM of the internal prices (≤ $0.05 total), executed in parallel, results returned in order. Batchable endpoints are the local, deterministic ones (validators, format transforms, time/locale) — no browser, network, composite or dynamic endpoints. Each result carries {path, status, body}; a bad request (unknown path, >10 calls, over cap) is a 400, not charged.

/v1/business-days

Business-day math with real holiday calendars for FR, DE, GB, US, ES, IT, NL, BE (2025-2027, official sources — same datasets as /v1/holidays). Count working/weekend/holiday days in a date range (?from&to&country) or shift a date by N business days (?from&add=10&country). Weekend configurable (?weekend=fri,sat), optional ?region= for Länder/UK divisions. Holidays that suppress a working day are listed by name.

/v1/card-check

Structural card-number check before hitting a PSP: Luhn checksum, network detection from public IIN prefixes (visa, mastercard, amex, discover, jcb, diners, unionpay) and per-network length validation. POST body on purpose: the number never appears in a URL, so it stays out of request logs and x402 payment metadata — never stored, logged or echoed back. No BIN/issuer lookup (BIN databases are licensed): well-formed does not mean the card exists.

/v1/color

Colour utilities: ?op=convert (default) turns any hex/rgb()/hsl()/CSS-name into hex, rgb, hsl, hsv, alpha, relative luminance and exact CSS name; ?op=contrast with ?fg=&bg= returns the WCAG 2.x contrast ratio and AA/AAA pass/fail for normal & large text plus UI components (accessibility / EAA); ?op=palette derives complementary, analogous, triadic, tints and shades. Send hex without '#'.

/v1/country-info

Country reference card by ISO code (alpha-2/alpha-3/numeric) or English name: ISO 3166 codes, official name, current ISO 4217 currency (Bulgaria = EUR since 2026-01-01), dialling prefix, IANA ccTLDs (incl. IDN), languages, EU/EEA/Schengen/euro-area membership and the EU VAT prefix (Greece = EL). 56 countries: EU-27, EEA/EFTA, GB, US + 24 majors. Compiled from ISO/IANA/ITU/europa.eu sources, dated `asOf`.

1 call · 1 payer · last 30 days

/v1/cron-next

Next occurrences of a cron expression in any IANA time zone, DST-aware via the runtime's ICU tzdb (times skipped by DST shift forward by the gap; ambiguous times fire once). Dialect (croner): 5-7 fields with optional seconds and year, ranges, steps, lists, JAN-DEC/SUN-SAT names, L, W, #, ? and @daily-style aliases. Each occurrence is returned as local ISO with offset plus UTC. Bad expression → 400 naming the offending field.

/v1/csv-profile

Profile a CSV before processing it: send the bytes directly or a JSON body with a public {url}. Returns per-column name, inferred type (string/int/float/bool/date/mixed), null and unique counts, min/max and samples, plus row count, detected delimiter and data-quality issues (malformed rows, inconsistent widths, duplicate headers). Query: delimiter (, ; tab |), header=false if row one is data. Max 10 MB.

/v1/csv-to-json

Convert CSV to JSON with a strict RFC 4180 parser: quoted fields, doubled quotes, delimiters and line breaks inside quotes, mixed CRLF/LF, BOM. Auto-detects comma, semicolon, tab or pipe (or set delimiter). First row becomes object keys; headers:false yields string arrays. Ragged rows and unterminated quotes are repaired and reported in errors[], never a crash. All values stay strings. Send raw CSV text or JSON {csv}. Max 5 MB.

/v1/diff

Compute the diff between two texts (a → b) — no git needed. Returns a standard unified patch (line-oriented in both modes, applies with git apply or patch), added/removed counts, and in word mode a token-level change list for inline highlighting (capped at 2000 entries). CRLF line endings and missing trailing newlines are preserved byte-exactly. Caps: 1 MB UTF-8 per input; pathologically divergent inputs return 422 diff_too_complex.

/v1/docx-extract

Extract text from a .docx (Word) document: send the docx bytes directly, or a JSON body with a public {url}. Returns the plain text, a best-effort markdown rendering (headings, bold/italic and lists; tables are flattened to paragraphs), and metadata (title, author). Text layer only — no OCR of embedded images. Max 10 MB.

/v1/domain-check

Domain availability and expiry intelligence via RDAP, the WHOIS successor. Queries the authoritative registry for any RDAP-enabled TLD: free domains return registered:false, taken ones return registrar, creation and expiry dates, nameservers and EPP status codes. TLDs without RDAP coverage return supported:false. Built for agents that buy, monitor or vet domains.

1 call · 1 payer · last 30 days

/v1/donate

Support 402utils — or use it as a parametric x402 payment-test endpoint: you set the price with ?amount= (USD, clamped to $0.001–$0.05) and the 402 demands exactly that, so you can assert a client pays the precise amount and the on-chain USDC tx matches. After payment returns {thanks, amount, message}. The amount is a pure function of ?amount, identical on the unpaid probe and the paid retry.

/v1/ecb-calendar

TARGET2/T2 settlement calendar — the SEPA banking calendar, to predict when a euro transfer settles. TARGET is closed on weekends + six fixed days (New Year, Good Friday, Easter Monday, 1 May, 25 & 26 Dec). ?year= lists the closing days; ?date= says whether it settles (and the next open day); ?date=&addBusinessDays=N returns the value date N settlement days away. The SEPA counterpart of /v1/business-days.

/v1/echo

Echoes back the JSON body you send, with a server timestamp. Useful for verifying your x402 client integration end to end.

1 call · 1 payer · last 30 days

/v1/email-check

Validate an email address before you accept a signup or send to it: RFC 5322 syntax, whether the domain resolves and its MX records, whether it is a disposable/throwaway domain (community blocklist), and whether it is a role account (info@, support@…). DNS is checked over DoH. No SMTP probing (intrusive and spammy), so a true 'domainExists' does not guarantee the mailbox exists.

2 calls · 2 payers · last 30 days

/v1/embed

Text → vector embeddings via Cloudflare Workers AI. Send {text} or {texts[]} (≤20, each ≤4000 chars); returns one float vector per input. Default model @cf/baai/bge-m3 (1024-dim, multilingual). The model is named in the response — embeddings only compare within the same model. Completes the RAG chain: readability → chunk → embed, no OpenAI account. Cosine-compare the vectors yourself. Unavailable model/binding → 503, not billed.

8 calls · 1 payer · last 30 days

/v1/epc-qr

Generate an EPC QR code (SEPA Credit Transfer / « Girocode », EPC069-12) — the QR a banking app scans to pre-fill a transfer, the payment companion to an invoice. Body { name, iban, amount?, bic?, purpose?, remittance? | reference? (RF) }. Returns PNG (default), SVG, or the raw EPC text. IBAN + RF are validated; strict EPC encoding (order, lengths, ≤331 bytes, level M). EUR only. Not a payment initiation — just the encoded data.

/v1/fx-rates

Daily euro FX reference rates from the European Central Bank. ?base (default EUR), ?quote for a single rate, ?date=YYYY-MM-DD for history (last 90 ECB business days; older dates 404). Non-EUR bases are cross-rates derived via EUR (quote-per-EUR ÷ base-per-EUR). Weekend/holiday dates resolve to the last published ECB day — the date field says which. Published ~16:00 CET on ECB business days; informational rates, not for transaction pricing.

/v1/hash

Compute cryptographic hashes / checksums of a string or of raw bytes (base64). Returns lowercase hex for each requested algorithm: sha256 (default), sha512, sha1, md5. SHA via native Web Crypto; md5 and sha1 are offered for legacy interop only and flagged — not for security. POST so the input never lands in a URL/log. Verification/checksums only, not a hash cracker.

1 call · 1 payer · last 30 days

/v1/holidays

Public and bank holidays for FR, DE, GB, US, ES, IT, NL, BE — years 2025-2027, each dataset verified against the country's official source (Etalab, Land statutes, gov.uk feed, OPM, BOE, normattiva, rijksoverheid, SPF Emploi). Movable feasts are computed (Gregorian computus), substitute days follow each country's official rule. Optional ?region= for sub-national holidays (German Länder, UK divisions, Alsace-Moselle).

/v1/html-tables

Extract every table from HTML you provide into clean JSON — no fetching, send the markup itself as {html} or a raw text/html body. Returns per table: optional caption, headers[] (from thead or an all-th first row) and rectangular rows[][]. colspan/rowspan cells are grid-expanded with the value duplicated so rows align with the visual layout; nested tables are flattened into the outer cell's text. Caps: 5 MB HTML, 200 tables, 200k cells.

/v1/iban-check

Validate an IBAN structurally before you pay or store it: ISO 7064 mod-97 check digits plus the official per-country length and BBAN layout (~90 countries), returning the bank/branch/account breakdown for FR, DE, ES, IT, BE and NL. Structural validation only — no BIC directory lookup (SWIFT's BIC registry is proprietary) and no proof the account exists. Local, instant. ?attest=1 → Ed25519-signed.

1 call · 1 payer · last 30 days

/v1/ics

Build a strictly RFC 5545-conformant .ics calendar file from a list of events: correct TEXT escaping, 75-octet line folding, generated UIDs, and unambiguous UTC timestamps (a per-event IANA timezone interprets naive wall-clock times). Supports all-day events, location, description and a passthrough RRULE. The fiddly conformance an agent shouldn't hand-roll.

1 call · 1 payer · last 30 days

/v1/image-optimize

Resize and convert an image (PNG, JPEG or WebP, up to 10 MB). Send the image bytes as the body and set options in the query: width, height, fit (contain or cover), format (webp/jpeg/png) and quality (JPEG). Returns the converted image bytes. WebP has no quality knob and AVIF is not supported (out of scope).

/v1/json-to-csv

Convert a JSON array of objects into a clean RFC 4180 CSV: header row, CRLF records, correct quoting and quote-doubling. Nested objects flatten to dot-notation columns (a.b.c), arrays are JSON-encoded into their cell, and you can select and order columns explicitly. Delimiter: comma, semicolon, tab or pipe. Caps: 100,000 rows, 5 MB body, 20 MB CSV out. Returns text/csv ready for Excel, Google Sheets or a data pipeline.

/v1/lang-detect

Detect the language of a text with franc (pure-JS trigram model, 61 languages + CJK/Indic scripts). Returns the ISO 639-1 code (639-3 when no 2-letter code exists), language name, a separation-margin confidence (0=ambiguous, 1=unambiguous), a reliable flag, and ranked alternatives. The pre-sort step of any multilingual pipeline. Short/ambiguous text returns reliable:false honestly. Processes provided text only; nothing is fetched.

/v1/link-check

Verify a link before you cite or use it: HTTP status, the full redirect chain, the final URL, latency, and the final Content-Type/Content-Length. Redirects are followed manually (max 10) with SSRF validation on every hop; probes with HEAD by default and falls back to GET automatically when a server rejects HEAD. A dead or broken target (404, 410, 500…) is a valid result, not an error. Response bodies are never downloaded.

/v1/md-to-html

Convert Markdown to sanitized HTML that is safe to embed directly in a page, email or app. GFM supported: tables, task lists, strikethrough, fenced code. Output passes a strict tag/attribute allowlist: scripts, styles, iframes, event handlers and javascript: URLs are removed; links keep only http(s)/mailto targets, images only http(s) or base64 image data URIs. Send JSON {markdown} or a raw text/markdown body, max 2 MB. Returns {html}.

/v1/meta-extract

Link preview for any web page: fetches a URL and parses only the <head> (no JS, no rendering). Returns title, meta description, canonical URL, language, an always-absolute favicon, all Open Graph and Twitter Card tags, and RSS/Atom/JSON-feed links. Tolerant of messy real-world HTML and non-UTF-8 charsets. The caller-supplied URL is SSRF-checked; the fetch is capped at 5 MB and 8 s.

/v1/og-image

Generate a polished Open Graph / social share image (PNG) from text — no browser, no design tools. Pick a template (article, product, stat), pass a title and optional subtitle, set your brand accent colour and light/dark theme, and get back a crisp 1200×630 PNG ready for og:image, Twitter cards, blog headers and launch posts. Rendered with Satori + resvg; fast and cheap.

/v1/pdf

Render HTML or a public web page into a pixel-perfect PDF using a headless Chrome browser. Send inline `html` (invoices, receipts, reports, tickets) or a `url` to snapshot; control paper size, orientation, margins, background graphics and scale. Returns the raw application/pdf bytes — no signup, no browser to run, pay per document.

/v1/pdf-extract

Extract text from a PDF: send the PDF bytes directly, or a JSON body with a public {url}. Returns the full text, per-page text, and metadata (page count, title, author). Text layer only — scanned/image-only PDFs return empty text with a no_text_layer warning (no OCR). Max 10 MB.

/v1/peppol-lookup

Look up a business in the public Peppol Directory — where to route an e-invoice (the BT-34/49 electronic address). ?id= (a Peppol id like 0225:992412536, or a value to search) or ?country=FR&name=. Returns { found, count, participants:[{peppolId, name, country, documentTypes[], schemes[]}] }. Unknown id → { found:false }. Directory down → 503, unbilled. Public source, 1h cache.

1 call · 1 payer · last 30 days

/v1/phone-check

Validate and normalize a phone number with full Google libphonenumber metadata: strict validity against each national numbering plan, E.164 / international / national formats, country detection (correct across shared codes like +1 and +44) and line type (mobile, fixed_line, toll_free, voip…) where the plan distinguishes it. Pass ?country=FR to parse national formats. Purely local; the number is never stored.

/v1/qr

Generate a QR code as PNG or SVG from any text or URL. Pick the size, error-correction level (L/M/Q/H) and foreground/background colours; a 4-module quiet zone is always included so it scans reliably. Returns the raw image bytes. No logo overlay (compositing is out of scope).

/v1/rerank

Rerank passages by relevance to a query via Cloudflare Workers AI (@cf/baai/bge-reranker-base). Send {query, documents[] (≤50, each ≤4000 chars), topK?}; returns [{index, score}] best-first — the missing link after embed/chunk, keeping the top chunks before a costly LLM call. Score is the model's relevance score (higher = better), named as it only compares within this model. Unavailable binding → 503, unbilled.

1 call · 1 payer · last 30 days

/v1/rf-reference

ISO 11649 RF creditor reference (SEPA structured reference) — validate or generate. ?ref=RF18539007547034 checks the ISO 7064 mod 97-10 checksum and format (RF + 2 check digits + up to 21 alphanumerics); ?generate=539007547034 computes the check digits and returns the full RF reference with print formatting. Complements iban-check and vat-check for SEPA invoicing agents. Purely local, instant.

/v1/robots-check

Robots.txt compliance check for polite crawlers and AI agents (GPTBot, ClaudeBot, ...). Pass a page URL and optionally your crawler's product token; returns whether the URL may be fetched, the winning Allow/Disallow rule, crawl-delay and sitemap URLs. Full RFC 9309 matching: wildcards, $ anchors, longest-match, merged groups. A 4xx robots.txt allows all; 5xx or unreachable hosts report disallowed. Cached per host for 1 hour.

/v1/routing-check

Validate a US ABA routing number before initiating a transfer: the 3-7-1 checksum, the public structure rules (9 digits; assigned prefixes 00-12 primary, 21-32 thrift, 61-72 electronic, 80 traveler's cheque) and the implied Federal Reserve district. Checksum and structure only — no bank-name directory (the Fed's is redistribution-restricted) and no proof of assignment. ?attest=1 → Ed25519-signed.

/v1/rss-to-json

Fetch an RSS 2.0 or Atom feed and return clean JSON: feed title, link and description, plus items with title, link, ISO-8601 publishedAt, summary and author. Handles both formats and normalises the dates. The caller-supplied URL is SSRF-checked; the fetch is capped at 2 MB and 8 s.

149 calls · 1 payer · last 30 days

/v1/screenshot

Capture a screenshot of any public web page with a headless Chrome browser. Set the viewport, grab the full scrollable page or just the fold, and choose PNG, JPEG or WebP with an optional quality. Returns the raw image bytes — ideal for link previews, thumbnails, visual monitoring and archiving. No browser to run, pay per capture.

5 calls · 3 payers · last 30 days

/v1/site-profile

Full profile of a web page in one paid call: <head> metadata (title, description, canonical, OpenGraph, favicon, feeds), DNS records (A/AAAA/MX/NS), robots.txt crawl permission for your user-agent, and domain registration/expiry (RDAP) — fanned out in parallel, each section with its own status. Pass ?userAgent= to test robots for a specific crawler. Page fetches are SSRF-checked. If every section fails technically you get a 503 and no charge.

/v1/sitemap-to-json

Turn any sitemap.xml into clean JSON: URL entries with loc, lastmod and priority, plus sitemap-index detection with the child sitemap list. Handles gzipped .gz sitemaps (magic-byte detection, zip-bomb guarded) and namespaced XML; pass follow=1 to also expand up to 3 child sitemaps of an index in one call. SSRF-checked fetches, 10 MB per document, up to 50,000 URLs with a truncated flag.

/v1/timezone-convert

Convert a datetime between any two IANA time zones using the runtime's ICU tzdb — always current, DST-correct, half-hour zones included. A datetime without offset is read as wall time in `from` (ambiguous fall-back times resolve to the earlier instant; times skipped by spring-forward shift ahead, flagged in `note`). Returns both ISO datetimes with offsets and DST status per side. Unknown zone → 400 with a spelling suggestion.

1 call · 1 payer · last 30 days

/v1/us-tax-rates

US sales tax STATE-LEVEL base rates for the 50 states + DC, as statutory percent. ?state=CA for one state, omit for all. Returns the state-only rate, any mandatory statewide local add-on (CA/UT/VA) and their sum. STATE BASE RATE ONLY — optional city/county/district rates are EXCLUDED and can add several points; not tax advice. Compiled from state statutes, cross-checked against two dated published trackers (asOf field included).

/v1/vat-check

Validate an EU VAT number against the official VIES registry before invoicing, onboarding or a reverse charge. Per-country syntax is checked locally first, so invalid formats never touch the network. Valid numbers return the registered company name and address when disclosed, plus an optional consultation number (requesterVat). Never a false 'invalid': if VIES is down you get a 503 and are not charged. ?attest=1 → Ed25519-signed.

/v1/vat-rates

Look up current VAT rates for any EU member state — standard, reduced, super-reduced and parking rates plus the currency — from the European Commission's official figures. Filter to one rate category if you only need one. Ideal for pricing, invoicing and tax-calculation logic that must apply the right rate per country. Returns the source and date verified. ?attest=1 → Ed25519-signed.

/v1/wallet-name

Resolve a Basename or ENS name to an address, or an address to its primary name. Pass ?name=402utils.base.eth (name→address) or ?address=0x… (address→primary name). Basenames resolve on Base L2, other .eth names on Ethereum mainnet. Reverse results are forward-verified. ASCII names only; offchain (CCIP-read) resolvers like cb.id are not supported.

/v1/x402-quote

Enriched quote for an x402 endpoint: probes it unpaid (never pays, SSRF-checked), decodes {price, asset, network, payTo}, then compares the USD price against the live Bazaar market for its category → {marketContext:{category, medianForCategory, cheaperThanMarket}}. Not just how much, but whether it's fair. Market context is best-effort; the decoded quote returns even if the Bazaar read fails. Neutral — our own endpoints are never featured.

4 calls · 3 payers · last 30 days

/v1/xlsx-extract

Extract data from an .xlsx spreadsheet: send the bytes directly or a JSON body with a public {url}. Returns each sheet as rows (array-of-arrays) with its name and used range, plus workbook metadata. Query: sheet (name or 0-based index) for a single sheet, headers=true for array-of-objects. Formula cells return their cached computed value. Capped at 500000 cells. Max 10 MB.

/v1/xml-to-json

Convert XML to clean JSON. POST raw XML (XML or text/plain Content-Type) or a JSON envelope {xml, alwaysArray}. Attributes land under "@_" keys, mixed-content text under "#text", repeated siblings become arrays, and alwaysArray forces arrays for listed tags even on a single occurrence. Numeric character references decode. DTD entities and DOCTYPE internal subsets rejected (anti-XXE / billion-laughs). Max 5 MB.

/v1/zip-inspect

Inspect a ZIP archive safely: send the bytes directly or a JSON body with a public {url}. Returns the entry list (path, size, compressedSize, isDir); entries with path traversal (../), absolute or malformed paths are flagged suspicious:true and never interpreted. Add ?extract=exact/entry/path to get that one file back (max 5 MB decompressed). Zip bombs are refused. Max 20 MB.