API docs

Free validation API

POST /v1/validate is live. No API key. Higher limits and API keys stay on the waitlist.

Free tier

Send one SEPA XML file. The check is the same baseline as the website: pain.001.001.03 and pain.001.001.09 structure, IBAN mod-97, CtrlSum, NbOfTxs, and charge bearer SLEV. pain.008, camt, and other ISO 20022 messages are recognised and rejected with valid: false. They are not validated yet.

30 validations per IP per hour.
200 validations per IP per UTC day.
Maximum upload 2 MB. Larger files get HTTP 413.
Over either limit: HTTP 429, Retry-After, and X-RateLimit-* headers.

Higher limits and API keys are planned from EUR 79/month. Joining the waitlist is free. The monthly price is charged only after confirmation.

Join the waitlist for higher limits · info@bobook.club

Request

Multipart form field file, or a raw XML body (Content-Type: application/xml).

curl -F "file=@pain001.xml" https://checksepa.com/v1/validate

curl -X POST https://checksepa.com/v1/validate -H "Content-Type: application/xml" --data-binary @pain001.xml

GET /v1/validate returns 405. The machine-readable contract is /openapi.json.

Response

HTTP 200 is a validation report. valid is true only when there are no errors. format is the message family (pain.001, pain.008, camt.053, …) and version is the full ISO 20022 identifier when the file carries one. errors and warnings use code, message, path, and line. path is an XPath-like location. line is 1-based, or null when the parser cannot place the finding.

The example below is the first error from the invalid pain.001.001.03 sample. The full report has more errors. The website route POST /api/validate is unchanged and still returns ok, issues, resultClass, and session fields. Those are not part of /v1/validate.

{
  "valid": false,
  "format": "pain.001",
  "version": "pain.001.001.03",
  "errors": [
    {
      "code": "EPC-CTRLSUM",
      "message": "CtrlSum is 999.00 but the transactions sum to 175.50.",
      "path": "/Document/CstmrCdtTrfInitn/GrpHdr/CtrlSum",
      "line": 8
    }
  ],
  "warnings": []
}

400 means the body is empty or the multipart field file is missing. 413 means the file is larger than 2 MB. 429 means the hourly or daily free limit is used up. The JSON error field is rate_limit, and limit is hourly or daily.

Rate-limit headers on a counted response: X-RateLimit-Limit and X-RateLimit-Remaining are the hourly window (30). X-RateLimit-Reset is the Unix time when that hour ends. X-RateLimit-Limit-Day and X-RateLimit-Remaining-Day are the UTC day window (200).

What is checked

pain.001.001.03 and pain.001.001.09.
Required ISO particles, types, and version-specific ReqdExctnDt.
IBAN mod-97 and official length per country.
CtrlSum and NbOfTxs at group and payment-info level.
Charge bearer must be SLEV. DEBT, CRED, and SHAR are errors.
pain.001.001.11, pain.008, and camt are not supported yet.
No bank login, no EBICS, no Verification of Payee, and no payment initiation.

Privacy

The file is validated in memory for that request and discarded. It is not written to disk.
Server logs keep message version, byte size, pass/fail, error codes, and a hash of the client IP. The XML is not logged.
XML is never rewritten by or sent to a language model.
The waitlist stores the email you submit, and an optional company name. It does not take the payment file.

Scope

Checks are an ISO 20022 structure pass plus a basic EPC SEPA Credit Transfer baseline. They are not a bank Implementation Guideline. A file that passes can still be rejected by a bank.

Samples

Sample files (dummy IBANs only) · OpenAPI · llms.txt · llms-full.txt · Higher limits waitlist

Operator

Bobook Limited, Venture Hub, 136 Capel Street, Dublin 1, D01 T2C9, Ireland · info@bobook.club