Two endpoints. One of them is the product.

# header on every /api/validate call
Authorization: Bearer ibn_test_9f2a…_4c1b…

POST /api/signup

Create a free-plan account and receive its id and API key. The key is returned only in this response, so store it now.

# request
curl -X POST https://ibanly.app/api/signup \
  -H "Content-Type: application/json" \
  -d '{"email": "you@company.com"}'

# 201 Created
{
  "account_id": "acct_9f2a3b…",
  "plan": "free",
  "api_key": "ibn_test_9f2a3b…_4c1bde…"
}

A second sign-up with the same email returns 409: the account already exists and the key is not shown again.

POST /api/validate

Validate one IBAN. Whitespace and case are normalised for you.

# request
curl -X POST https://ibanly.app/api/validate \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"input": {"iban": "GB82 WEST 1234 5698 7654 32"}}'

# 200 OK — valid
{
  "output": {
    "iban": "GB82WEST12345698765432",
    "valid": true,
    "country": "GB",
    "check_digits": "82",
    "bban": "WEST12345698765432",
    "formatted": "GB82 WEST 1234 5698 7654 32",
    "reason": null,
    "note": null
  },
  "usage": { "used": 1, "limit": 100 }
}

# 200 OK — invalid (a swapped digit)
{
  "output": {
    "iban": "GB28WEST12345698765432",
    "valid": false,
    "country": "GB",
    "check_digits": "28",
    "bban": "WEST12345698765432",
    "reason": "checksum failed (mod 97)"
  },
  "usage": { "used": 2, "limit": 100 }
}

A well-formed IBAN whose country is outside the length table still gets checksum-validated, with a note that the length was not checked.