Use Authorization: Bearer cm_… and Content-Type: application/json. Every chargeable POST requires an Idempotency-Key of 8–128 ASCII letters, digits, underscores, dots, colons or hyphens. Keys are unique per account across endpoints. Same endpoint and JSON serialization replays the saved result for 24 hours, including its original balance snapshot. Property order matters. After 24 hours, retained tombstones prevent repeat billing and return 409 result_expired.
A request reserves credits before work. Validation errors and upstream/server failures refund them. Interrupted reservations are refunded after two minutes by a five-minute cron. Successful DNS lookups with no records are billed; upstream 4xx/5xx failures are not. Four disabled routes return 503 before reservation.
Get and recover a key
Verify your email from Your credits, buy a pack and wait for the signed payment webhook. Then explicitly issue your key. Email links and customer sessions last 15 minutes. Key issuance/rotation consumes the session and revokes every old key. Lost the response? Request another email link and rotate again. Email never contains a full key.
GET /billing/balance with a bearer key returns {"credits":5000}. POST /billing/checkout with the same key, a new Idempotency-Key and {"pack":5000} recharges the same account. Packs: 5000, 10000, 25000. The browser uses its verified HttpOnly session instead. Checkout returns only checkout_url.
Errors include credits_charged: 0. Errors may also include idempotency_key_required, verification_required, checkout_unavailable or purchase_mismatch. Retry a 409 request_in_progress using the same key later. Never retry an uncertain charged request with a new key.
Default quota: 60 requests per minute per key/account, 5 email recovery requests per 15 minutes per IP and 3 per email, 5 checkout attempts per 15 minutes per IP, and 10 demos per minute per IP. Fixed windows; retries count. No CORS is granted unless configured. Request bodies are not logged, but successful result JSON is stored for replay for 24 hours and may contain customer data. Billing and idempotency records are retained for reconciliation.
POST /v1/json-repair
Repair fenced JSON and trailing commas
Clean JSON copied from a code block before passing it into a workflow.
Only removes complete JSON code fences and trailing commas outside strings. Does not infer missing quotes, values or braces. The text field is limited to 50 KB of UTF-8.
All enabled routes accept a JSON object of at most 60,000 UTF-8 bytes. String limits are also measured in UTF-8 bytes.
POST /v1/utm-validator
Build and check UTM campaign URLs
Check campaign tagging while preserving existing query parameters. This API never opens the destination URL.
Requires HTTP(S) without embedded credentials. A valid result means source, medium and campaign are nonblank; it does not measure campaign performance.
All enabled routes accept a JSON object of at most 60,000 UTF-8 bytes. String limits are also measured in UTF-8 bytes.
POST /v1/invoice-validator
Check invoice arithmetic with decimal rounding
Catch invoice total mismatches before importing billing data into another system.
Arithmetic only, not tax-law validation. Up to 200 lines. Nonnegative fixed-point values only; quantities and unit prices have at most six decimals. Tax, discount and total use currency precision: JPY 0, KWD 3, others 2. Each line rounds half up before summing; discount is a fixed invoice amount. Prefer decimal strings. No scientific notation, unsafe totals or discount exceeding subtotal.
All enabled routes accept a JSON object of at most 60,000 UTF-8 bytes. String limits are also measured in UTF-8 bytes.
POST /v1/webhook-hmac
Verify generic HMAC-SHA256 signatures
Check a raw UTF-8 payload against a shared-secret hexadecimal signature.
curl -X POST 'https://staging.callmint.dev/v1/webhook-hmac' \
-H 'Authorization: Bearer YOUR_API_KEY' \
-H 'Idempotency-Key: unique-request-001' \
-H 'Content-Type: application/json' \
-d '{"secret":"key","payload":"The quick brown fox jumps over the lazy dog","signature":"f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8"}'
Response result
{
"valid": true,
"algorithm": "HMAC-SHA256",
"note": "Generic raw-body hex HMAC only; not a Stripe signature verifier"
}
Limitations
Generic raw UTF-8 HMAC only. Not a Stripe webhook verifier. Signature accepts 64 hex characters with an optional sha256= prefix. Do not send production secrets unless you accept processing them by this service; request bodies are not logged or retained.
All enabled routes accept a JSON object of at most 60,000 UTF-8 bytes. String limits are also measured in UTF-8 bytes.
POST /v1/jsonld-validator
Check JSON-LD syntax and basic structure
Confirm that a JSON-LD payload is parseable and inspect whether top-level context and type are present.
{
"valid": true,
"has_context": true,
"has_type": true,
"note": "Syntax/basic structure only; not full schema.org validation"
}
Limitations
Accepts an object or a nonempty array of objects, including an encoded JSON string. Does not resolve contexts or check Schema.org semantics. Array responses report false for the two top-level presence flags.
All enabled routes accept a JSON object of at most 60,000 UTF-8 bytes. String limits are also measured in UTF-8 bytes.
POST /v1/metadata
Public HTML metadata extraction — coming soon
Planned: extract page title, canonical URL, descriptions and social metadata for content tooling.
{
"domain": "example.org",
"mx": [
"0 ."
],
"dmarc": [],
"note": "DNS records only; does not verify a mailbox, SPF or DMARC policy correctness."
}
Limitations
Uses a fixed Cloudflare DNS-over-HTTPS resolver, never the supplied domain as an HTTP destination. Maximum 20 records per result and 32 KB per DNS response. NXDOMAIN/no records is successful data and billed. Resolver errors/timeouts are not billed. Does not verify mailbox existence, SPF or DMARC policy validity. DNS examples are illustrative and can change.
All enabled routes accept a JSON object of at most 60,000 UTF-8 bytes. String limits are also measured in UTF-8 bytes.
POST /v1/robots
Robots directive inspection — coming soon
Planned: retrieve and inspect published robots.txt directives for a website.
Unavailable: safe egress has not been verified. No authoritative bot allow/deny or RFC 9309 compliance is claimed. No outbound fetch or billing occurs.
All enabled routes accept a JSON object of at most 60,000 UTF-8 bytes. String limits are also measured in UTF-8 bytes.
POST /v1/sitemap
Sitemap structure inspection — coming soon
Planned: inspect an XML sitemap’s type and location count without crawling the site.
30 credits per successful check, including a failed policy finding. Uses invoice-validator arithmetic. Duplicate identity is the normalized vendor and invoice number within one project, retained for 90 days; a retry with the same Idempotency-Key is not a duplicate. Select an explicit policy version. Findings retain no raw invoice; policy rules may contain a vendor requirement. Not tax-law validation.
All enabled routes accept a JSON object of at most 60,000 UTF-8 bytes. String limits are also measured in UTF-8 bytes.
POST /v1/crawler-policy
AI Crawler Policy Snapshot Comparison
Compare customer-supplied crawler permission maps with a saved baseline and required crawler list.
20 credits. Customer-supplied normalized permissions only, at most 20 crawler names. Does not fetch or parse robots.txt, claim RFC 9309 compliance, grant legal permission or guarantee AI visibility. No background monitoring. Caller is responsible for obtaining accurate snapshots. External robots fetching remains disabled.
All enabled routes accept a JSON object of at most 60,000 UTF-8 bytes. String limits are also measured in UTF-8 bytes.
POST /v1/seo-guard
SEO Deployment Guard Snapshot Comparison
Compare customer-supplied deployment metadata with a baseline and versioned release requirements.
50 credits. Compares supplied title, description, canonical, indexing flag and structured-data type list. Does not fetch HTML, verify indexing, crawl redirects or validate structured-data semantics. Baselines are explicit and immutable; no scheduler or dashboard.
All enabled routes accept a JSON object of at most 60,000 UTF-8 bytes. String limits are also measured in UTF-8 bytes.