Validate an Intelligence Evaluation

POST

intelligence

evaluations

validate

Validate an intelligence evaluation request

curl --request POST \
  --url https://api.antonpayments.com/v1/intelligence/evaluations/validate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'DPoP: <api-key>' \
  --data '
{
  "entity": {
    "reference_id": "<string>",
    "name": "<string>",
    "country": "US",
    "birth_date": "2023-12-25",
    "address": {
      "line_1": "<string>",
      "line_2": "<string>",
      "city": "<string>",
      "state": "<string>",
      "postal_code": "<string>",
      "country": "US"
    },
    "email": "jsmith@example.com",
    "phone": "<string>",
    "nationality": [
      "US"
    ],
    "vault_token_id": "<string>"
  },
  "client_reference_id": "<string>",
  "idempotency_key": "<string>",
  "merchant": {},
  "context": {
    "velocity": {},
    "fingerprints": {},
    "history": {},
    "industry": {},
    "metadata": {}
  }
}
'

const options = {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <token>',
    DPoP: '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    entity: {
      reference_id: '<string>',
      name: '<string>',
      country: 'US',
      birth_date: '2023-12-25',
      address: {
        line_1: '<string>',
        line_2: '<string>',
        city: '<string>',
        state: '<string>',
        postal_code: '<string>',
        country: 'US'
      },
      email: 'jsmith@example.com',
      phone: '<string>',
      nationality: ['US'],
      vault_token_id: '<string>'
    },
    client_reference_id: '<string>',
    idempotency_key: '<string>',
    merchant: {},
    context: {velocity: {}, fingerprints: {}, history: {}, industry: {}, metadata: {}}
  })
};

fetch('https://api.antonpayments.com/v1/intelligence/evaluations/validate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.antonpayments.com/v1/intelligence/evaluations/validate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'entity' => [
        'reference_id' => '<string>',
        'name' => '<string>',
        'country' => 'US',
        'birth_date' => '2023-12-25',
        'address' => [
                'line_1' => '<string>',
                'line_2' => '<string>',
                'city' => '<string>',
                'state' => '<string>',
                'postal_code' => '<string>',
                'country' => 'US'
        ],
        'email' => 'jsmith@example.com',
        'phone' => '<string>',
        'nationality' => [
                'US'
        ],
        'vault_token_id' => '<string>'
    ],
    'client_reference_id' => '<string>',
    'idempotency_key' => '<string>',
    'merchant' => [
        
    ],
    'context' => [
        'velocity' => [
                
        ],
        'fingerprints' => [
                
        ],
        'history' => [
                
        ],
        'industry' => [
                
        ],
        'metadata' => [
                
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "DPoP: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.antonpayments.com/v1/intelligence/evaluations/validate"

	payload := strings.NewReader("{\n  \"entity\": {\n    \"reference_id\": \"<string>\",\n    \"name\": \"<string>\",\n    \"country\": \"US\",\n    \"birth_date\": \"2023-12-25\",\n    \"address\": {\n      \"line_1\": \"<string>\",\n      \"line_2\": \"<string>\",\n      \"city\": \"<string>\",\n      \"state\": \"<string>\",\n      \"postal_code\": \"<string>\",\n      \"country\": \"US\"\n    },\n    \"email\": \"jsmith@example.com\",\n    \"phone\": \"<string>\",\n    \"nationality\": [\n      \"US\"\n    ],\n    \"vault_token_id\": \"<string>\"\n  },\n  \"client_reference_id\": \"<string>\",\n  \"idempotency_key\": \"<string>\",\n  \"merchant\": {},\n  \"context\": {\n    \"velocity\": {},\n    \"fingerprints\": {},\n    \"history\": {},\n    \"industry\": {},\n    \"metadata\": {}\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("DPoP", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

{
  "data": {
    "valid": true,
    "contract_version": "intelligence-public-v1"
  }
}

{
  "error": {
    "message": "insufficient funds for this payout",
    "code": "insufficient_balance"
  }
}

{
  "error": {
    "message": "request failed validation",
    "code": "validation_error",
    "details": [
      {
        "field": "individual.first_name",
        "message": "is required"
      },
      {
        "field": "country",
        "message": "must be a valid ISO-3166 alpha-2 country code"
      }
    ]
  }
}

{
  "error": {
    "code": "rate_limit_exceeded",
    "message": "rate limit exceeded, retry after 60 seconds"
  }
}

Authorizations

Authorization

string

header

required

OAuth 2.0 client_credentials grant (RFC 6749 §4.4) bound to a DPoP keypair (RFC 9449).

Flow (every authenticated /v1 call requires both an access token AND a fresh per-request DPoP proof):

Register a credential via the merchant portal. Anton issues a client_id (ant_oc_<env>_<32hex>) and a client_secret (ant_ocs_<env>_<48hex>, shown ONCE). The portal generates an ES256 or Ed25519 DPoP keypair in your browser; you store the private half.
Mint an access token: POST /oauth/token with Authorization: Basic <client_id:client_secret> and Content-Type: application/x-www-form-urlencoded. Body: grant_type=client_credentials. A DPoP header carrying a proof signed for the token endpoint is required (no ath claim on this proof).
Use the token: send Authorization: DPoP <access_token> plus a fresh DPoP: <proof> header on every /v1 request. The proof JWT MUST carry htm (request method), htu (request URL, no query/fragment), iat (within ±60s), jti (unique within 5 min), and ath (SHA-256 of the access token, base64url).

Tokens expire in 1 hour in production / staging and 8 hours in sandbox. There are no refresh tokens — call /oauth/token again with your secret. Anton's public signing key is published at /.well-known/jwks.json.

OpenAPI 3.0 has no native DPoP scheme; this declaration plus dpopHeader together convey both the access-token Authorization and the per-request proof header.

DPoP

string

header

required

Per-request DPoP proof JWT (RFC 9449). MUST accompany the Authorization: DPoP <access_token> header on every protected operation. The proof is signed by the merchant's private DPoP key and carries htm, htu, iat, jti, and ath claims.

Headers

Idempotency-Key

string

Optional. If both this header and body idempotency_key are supplied, the header wins during validation mapping.

Maximum string length: 255

Body

application/json

use_case

enum<string>

required

Available options:

payee_registration,

instrument_screening,

payout_screening,

merchant_onboarding,

monitoring

entity

object

required

Show child attributes

client_reference_id

string

Client-supplied reference for reconciliation. Not used for merchant scoping.

idempotency_key

string

Body fallback for testing. Prefer the Idempotency-Key header.

instrument

object

Show child attributes

payout

object

Show child attributes

merchant

object

Accepted for future compatibility but ignored on the public test endpoint.

context

object

Show child attributes

Response

Request is valid and can be mapped to an internal event.

data

object

required

Show child attributes

List Intelligence EvaluationsPages the authenticated merchant's evaluations, newest first. Authenticated-only — there is no anonymous variant. Strictly merchant-scoped: only evaluations created under your account appear. Requires the `intelligence` credential scope and account capability.

⌘I

Validate an intelligence evaluation request

curl --request POST \
  --url https://api.antonpayments.com/v1/intelligence/evaluations/validate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'DPoP: <api-key>' \
  --data '
{
  "entity": {
    "reference_id": "<string>",
    "name": "<string>",
    "country": "US",
    "birth_date": "2023-12-25",
    "address": {
      "line_1": "<string>",
      "line_2": "<string>",
      "city": "<string>",
      "state": "<string>",
      "postal_code": "<string>",
      "country": "US"
    },
    "email": "jsmith@example.com",
    "phone": "<string>",
    "nationality": [
      "US"
    ],
    "vault_token_id": "<string>"
  },
  "client_reference_id": "<string>",
  "idempotency_key": "<string>",
  "merchant": {},
  "context": {
    "velocity": {},
    "fingerprints": {},
    "history": {},
    "industry": {},
    "metadata": {}
  }
}
'

const options = {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <token>',
    DPoP: '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    entity: {
      reference_id: '<string>',
      name: '<string>',
      country: 'US',
      birth_date: '2023-12-25',
      address: {
        line_1: '<string>',
        line_2: '<string>',
        city: '<string>',
        state: '<string>',
        postal_code: '<string>',
        country: 'US'
      },
      email: 'jsmith@example.com',
      phone: '<string>',
      nationality: ['US'],
      vault_token_id: '<string>'
    },
    client_reference_id: '<string>',
    idempotency_key: '<string>',
    merchant: {},
    context: {velocity: {}, fingerprints: {}, history: {}, industry: {}, metadata: {}}
  })
};

fetch('https://api.antonpayments.com/v1/intelligence/evaluations/validate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.antonpayments.com/v1/intelligence/evaluations/validate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'entity' => [
        'reference_id' => '<string>',
        'name' => '<string>',
        'country' => 'US',
        'birth_date' => '2023-12-25',
        'address' => [
                'line_1' => '<string>',
                'line_2' => '<string>',
                'city' => '<string>',
                'state' => '<string>',
                'postal_code' => '<string>',
                'country' => 'US'
        ],
        'email' => 'jsmith@example.com',
        'phone' => '<string>',
        'nationality' => [
                'US'
        ],
        'vault_token_id' => '<string>'
    ],
    'client_reference_id' => '<string>',
    'idempotency_key' => '<string>',
    'merchant' => [
        
    ],
    'context' => [
        'velocity' => [
                
        ],
        'fingerprints' => [
                
        ],
        'history' => [
                
        ],
        'industry' => [
                
        ],
        'metadata' => [
                
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "DPoP: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.antonpayments.com/v1/intelligence/evaluations/validate"

	payload := strings.NewReader("{\n  \"entity\": {\n    \"reference_id\": \"<string>\",\n    \"name\": \"<string>\",\n    \"country\": \"US\",\n    \"birth_date\": \"2023-12-25\",\n    \"address\": {\n      \"line_1\": \"<string>\",\n      \"line_2\": \"<string>\",\n      \"city\": \"<string>\",\n      \"state\": \"<string>\",\n      \"postal_code\": \"<string>\",\n      \"country\": \"US\"\n    },\n    \"email\": \"jsmith@example.com\",\n    \"phone\": \"<string>\",\n    \"nationality\": [\n      \"US\"\n    ],\n    \"vault_token_id\": \"<string>\"\n  },\n  \"client_reference_id\": \"<string>\",\n  \"idempotency_key\": \"<string>\",\n  \"merchant\": {},\n  \"context\": {\n    \"velocity\": {},\n    \"fingerprints\": {},\n    \"history\": {},\n    \"industry\": {},\n    \"metadata\": {}\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("DPoP", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

{
  "data": {
    "valid": true,
    "contract_version": "intelligence-public-v1"
  }
}

{
  "error": {
    "message": "insufficient funds for this payout",
    "code": "insufficient_balance"
  }
}

{
  "error": {
    "message": "request failed validation",
    "code": "validation_error",
    "details": [
      {
        "field": "individual.first_name",
        "message": "is required"
      },
      {
        "field": "country",
        "message": "must be a valid ISO-3166 alpha-2 country code"
      }
    ]
  }
}

{
  "error": {
    "code": "rate_limit_exceeded",
    "message": "rate limit exceeded, retry after 60 seconds"
  }
}

Overview

Cross-Cutting

Reference Data

Beneficiaries

Instruments

Intelligence

Payouts

Batches

Balances

Accounts

Webhooks

Pricing

FX

Corridors

Sandbox

Validate an Intelligence Evaluation

Authorizations

Headers

Body

Response