Temsor API — Turkey & EU business data MCP Server

Notify an optional audio chunk / customer URI for a live or archived call (idle $0). Prefer customer storage URI. Temsor keeps a pointer; STT only while a call is active.

Record virtual multi-agent bridge intent + shared memory hint (open promises). Idle $0, no live Asterisk. POST /v1/pbx/bridge/multi-agent {call_id, agents:[{role,label}]}. Records a virtual RTP agent bridge intent in the PBX index (no live Asterisk/ExternalMedia). Returns shared_memory linking open promises on the call for co-agents. No Telnyx/DID/LLM.

List recent calls with transfer path crumbs — site + customer archive browser. GET /v1/pbx/calls?limit=20. Scoped by x-temsor-pbx-key when set. Idle $0. No DID sales.

Get one call by id with transfer graph — customer detail drawer. GET /v1/pbx/calls/get?call_id=…. Scoped by x-temsor-pbx-key. found=false if missing. Idle $0.

GET call graph + transfer edges for a call — who→whom→where the promise stuck (moat). GET /v1/pbx/calls/graph?call_id=…&stuck_at=310. Returns path, path_tr (plain Turkish), edges, and raw transfers. Compounding asset: Transfer edges, not a bot transcript. Idle $0. No DID sales.

Managed SaaS domain dictionary (E4) — example packs thicken per pilot (tenant-scoped aliases). Boosts search + Fact extract. No invented premiums. GET /v1/pbx/dictionary?domain=otel|santral_firmasi|sigorta|finans|enerji|otomotiv|msp|all (msp = legacy alias for santral_firmasi). Idle $0, no LLM. Synonyms feed archive search (match crumbs) and transcript Fact extraction. Write path: POST /v1/pbx/dictionary/add.

Add a synonym/alias (tenant-scoped or global demo) — E4 compounding thickens search boost + Fact extract. ≤60/hour/key → 429. Idle $0. No invented premiums. POST /v1/pbx/dictionary/add {term, alias, domain:otel|santral_firmasi|sigorta|finans|enerji|otomotiv, scope?:pbx|global}. Managed SaaS compounding (E4): tenant-scoped aliases thicken search + fact extract. No invented premiums/prices. Idle $0, no LLM. Legacy msp → santral_firmasi.

Ingest Asterisk programming-interface (ARI) / Stasis (call-app channel) events. Optional x-temsor-pbx-key or HMAC-SHA256 request signature. Body ≤256 KiB → 429. Idle $0 when no calls. Demo stores events in memory/file. Auth: omit, x-temsor-pbx-key, or x-temsor-signature = hex(HMAC-SHA256(api_key, body)); bad signature rejected when header present. BridgeEnter → transfer crumbs. Utterance/text → open Promise docs via heuristic (no LLM).

List extracted facts (IMEI, room, tariff…) from the durable index — filter by call_id, kind, domain, q. GET /v1/pbx/facts?call_id=&kind=&domain=otel|santral_firmasi|all&q=&limit=50. Facts come from transcript extract + domain dictionary; persist in pbx-index. Scoped by x-temsor-pbx-key. Idle $0. No DID sales; Asterisk on customer; KVKK forget ready.

Get one extracted fact by id — detail drawer for site + customer. GET /v1/pbx/facts/get?id=…. Scoped by x-temsor-pbx-key. found=false if missing. Idle $0. No DID sales.

Upsert mid-call partial index (utterances → fact/promise hints). Path to ≤400ms whisper; ≤600/hour/key → 429; idle $0. POST /v1/pbx/index/partial {call_id, text?, speaker?, t_ms?, is_final?, live?, end_call?, promote?}. Streams partial STT queue into accumulating Fact/Promise hints while the call is live. No Temsor STT/LLM — customer posts text. Managed SaaS in-call index; no DID sales. Own PBX optional footnote. Idle $0.

GET mid-call partial index — accumulating facts/promises/snippets while live. GET /v1/pbx/index/partial/get?call_id=…. Returns live partial state for whisper ≤400ms path. Idle $0 when no live call. Managed SaaS in-call index; no DID sales. Own PBX optional footnote.

Heuristic TR promise extractor from transcript text — creates open Promise docs (idle $0, no LLM). Detects promise-like sentences (söz, vaat, edeceğiz, iade, iptal, yarın…). Optional persist_promises=false for extract without writing. Also wired via utterance text on POST /v1/pbx/events.

GET last gece-ikizi report persisted on forge volume (null if never run). Idle $0. GET /v1/pbx/night-twin/last — last report from POST /v1/pbx/night-twin/run. No LLM/Telnyx.

Night scan: open promises older than N hours → unresolved candidates (iptal/iade/söz). ≤20/hour/key → 429. Idle $0, no LLM. POST /v1/pbx/night-twin/run {pbx_id?, older_than_hours?}. Heuristic night twin — still-open promises older than N hours whose text matches iptal/iade/söz. Persists last report on forge volume. No Telnyx/LLM.

Query→act on managed SaaS runtime: whisper / hold / transfer / pci_stop / snoop. Intent + optional webhook. ≤120/hour/key → 429. No DID sales. Own PBX optional footnote. POST /v1/pbx/orchestra/act {call_id, action, params?, stasis_webhook_url?}. Turns search/promise/suggest hits into ARI orchestra intents on Temsor managed runtime (optional own-PBX webhook forward). No live RTP required for stub. Idle $0. Not a receptionist bot. Prefer POST /v1/pbx/promises/act for promise→graph closed loop (E1).

List recent managed orchestra intents (whisper/hold/transfer/PCI). Number→flow SaaS · idle $0 · no DID. Own PBX optional footnote. GET /v1/pbx/orchestra/acts?limit=20&call_id=. Tenant-scoped recent ARI orchestra intents (E.5). Pairs with POST /v1/pbx/orchestra/act and POST /v1/pbx/promises/act (E1 closed loop). Managed SaaS runtime — not Asterisk-first glue. Idle $0. Not PSTN.

Light CRM from call graph / facts — caller phones+names and extension identities seen on transfers. GET /v1/pbx/persons?call_id=&kind=caller|extension|all&q=&limit=50. Durable Person rows from pbx-index plus derived extension identities (ext_NNN) from Transfer edges / promise.ext. Scoped by x-temsor-pbx-key. Idle $0. No DID sales; Asterisk on customer; KVKK forget ready.

Get one light-CRM identity by id — caller Person or derived extension. GET /v1/pbx/persons/get?id=per_001|ext_101. Scoped by x-temsor-pbx-key. found=false if missing. Idle $0. No DID sales.

List broken/open promises from the call graph — the hotel / PBX-provider sales demo list. GET /v1/pbx/promises?status=open returns open/unclosed promises with transfer path. Scoped by x-temsor-pbx-key when set.

E1 moat: who→whom→promise → managed orchestra intent (whisper/transfer/hold). Idle $0. No PSTN. Own PBX optional footnote. POST /v1/pbx/promises/act {promise_id, action?}. Loads the promise + call graph, suggests whisper/transfer/hold, records orchestra intent with source_type=promise. Managed SaaS runtime — not Asterisk-first glue. ≤120/hour/key (shares orchestra bucket). Idle $0. carrier/pstn always false. No cross-tenant graph merge.

Mark an open promise kept or broken with an optional KVKK-safe note — makes the sales demo writable, not read-only. ≤60/hour/key → 429. POST /v1/pbx/promises/close {promise_id, status:kept|broken, note?}. Phones/emails in note are scrubbed. Scoped by x-temsor-pbx-key when set. Idle $0 — no LLM/PSTN.

Export open/broken promises as CSV or JSON — hotel / PBX-provider unclosed-promise sales list. GET /v1/pbx/promises/export?status=open|closed&format=csv|json. CSV/JSON include closed_at, close_note, path crumbs. Scoped by x-temsor-pbx-key when set. Idle $0.

Undo a kept/broken close — restore an open promise so the sales demo can reverse a mis-click. ≤60/hour/key → 429. POST /v1/pbx/promises/reopen {promise_id}. Only kept|broken → open; clears closed_at/close_note. Scoped by x-temsor-pbx-key when set. Idle $0.

KVKK-first forget (default-on SaaS): clear derived index by id/phone; durable audit who/what/when + tenant scope. ≤30/hour/key → 429. Managed pointer only — not a legal deletion SLA. E.3 KVKK-first redaction for managed SaaS. mode=anonymize|delete. Lookup by target_id or phone. Clears Person/Promise/Fact/partial index + Temsor audio pointers in your tenant only (no cross-tenant). Durable audit. Raw media stays on your side. Not a legal deletion SLA. List: GET /v1/pbx/redact/audit.

List recent KVKK forget actions — who/what/when + tenant scope. Managed SaaS derived-index audit; not a legal deletion SLA. GET /v1/pbx/redact/audit?limit=20. Durable audit from POST /v1/pbx/redact (E.3). Tenant-scoped. Derived index cleared; raw media not deleted by Temsor. Number→flow managed SaaS; own PBX optional. No DID sales.

Register a pilot PBX; returns pbx_id + API key once (hashed at rest). ≤5/hour/IP → 429. Idle $0. Control-plane register. API key shown once; stored hashed at rest. Send x-temsor-pbx-key to scope GET /v1/pbx/promises to this pbx_id. No speech recognition while idle.

Archive search over call promises and facts — voice-Google for the PBX, not a receptionist bot. Demo index + domain dictionary v0. Filters: status, date, ext, competitor, stuck_after (transfer hop). Returns call-graph path + transfer edges.

Control-plane status for a registered PBX — counts + idle. No DID sales. GET /v1/pbx/status. Scoped by x-temsor-pbx-key when set. Asterisk on customer; derived index on Temsor. Idle $0.

Load demo: sample call utterances → promise extractor → stats (calls, promises_open). ≤10/hour/key → 429. Idle $0, no LLM/PSTN. POST /v1/pbx/synthetic/run {scenario:ivr_menu|promise_heavy, count:10..500}. Generates deterministic fake utterances, runs heuristic ingest/transcript extract, returns calls + promises_open. No Telnyx/DID/LLM.

Register or list outbound webhooks — customer URL receives promise/fact/orchestra/redact events (HMAC if secret). POST write ≤30/hour/key → 429. POST /v1/pbx/webhooks {url, secret?, events?, ping?} registers. GET lists. ping:true sends a test delivery. Events: promise.opened, promise.closed, fact.extracted, orchestra.act, redact. Signed with x-temsor-signature when secret set. Idle $0. No DID sales; Asterisk on customer; KVKK.

List last N outbound webhook deliveries (stub or live) — promise/fact/orchestra/redact/ping. GET /v1/pbx/webhooks/deliveries?limit=20&webhook_id=. Durable log of Temsor→customer POSTs. HMAC when secret set. Idle $0. No DID sales; Asterisk on customer; KVKK.

Capability: mode=stub|ready from TEMSOR_RTP_*. No live RTP on forge; idle $0. GET /v1/pbx/whisper/status. Reports MediaBridge config presence (TEMSOR_RTP_PATH). mode=ready means path env set — not that Asterisk RTP is flowing. live_rtp/listening always false on forge (R2–R3 IVR sidecar; R4 lab E2E harness). No ≤400ms production claim. TEMSOR_RTP_LAB=1 → optional lab_latency_ms on suggest. No DID sales.

Demo: ≤3 context cards; prefers in-call partial index when present — mock latency_ms; idle $0. Lab: TEMSOR_RTP_LAB=1 → lab_latency_ms. POST /v1/pbx/whisper/suggest {call_id, partial_text}. Returns open promises and facts as whisper cards. Mock latency_ms field under 400ms (compat stub). Optional lab_latency_ms when TEMSOR_RTP_LAB=1 (measured; not prod SLA). No Telnyx/DID.

Dated EU-27 VAT rates (standard, reduced, super-reduced, parking) plus the Union OSS threshold. Not a goods classification. Invoice software that hard-codes “Germany is 19%” breaks the day a member state moves a rate, and it never knew the reduced list. This is a point-in-time schedule of published rates for the EU VAT area, keyed by country and asOf. It is a schedule of rates, not which goods fall in which reduced band — there is no HS or NACE mapping. Great Britain, Northern Ireland, Switzerland, Norway and Türkiye are recognised and returned with null rates. If the table has no row for that date the rates are null; the last known line is not reused.

Validates an EU VAT number against the official VIES register, with per-country format checks and honest handling of upstream outages. VIES is free but unreliable: member-state services drop out individually and a failed lookup can easily be mistaken for a rejection. Treating an outage as "invalid" means charging VAT to a customer who should have been exempt — an error with a price tag. So this endpoint never returns `invalid` when the service could not answer; it returns `unknown` and names the reason, and reports whether that country's service is currently up. Format is checked locally first, so an obvious typo never becomes an upstream call. Results are cached for 24 hours. Note that most member states do not publish the company name; when they do, it is returned.

Splits a Turkish amount into net, VAT and (optionally) withholding: who pays the seller, who remits the withheld VAT. For invoice lines and checkout totals that have to show KDV dahil / hariç and, when the parties are in a withholding (tevkifat) situation, the split between what the buyer pays the seller and what the buyer remits to the tax office. Rates are 0, 1, 10 and 20 percent. Withholding is a fraction of the VAT (2/10 through 10/10), or a named code from the GİB partial-withholding list. The 2026 threshold (TRY 12,000 gross) is reported and compared with the amount, but `applies` is always null: whether withholding actually applies depends on the taxpayer status of both parties, which this endpoint does not know. Feeding it a fraction is not a legal opinion.

Validates an IBAN from any of 70+ countries: checksum, country length and in-country account structure, and resolves the bank and branch codes. Most free libraries stop at the mod-97 checksum. That only says the digits are self-consistent — not that the number could exist in that country. This checks the country's BBAN structure too, so a wrong-length or wrong-shaped account is rejected before your payment file reaches the bank. When only the two check digits are wrong, the correct ones are computed and returned as a suggestion, because that is what people actually mistype. Turkish, Dutch and Belgian IBANs additionally resolve to a bank name when the national code is in our table; otherwise bankName is null. This is not a SWIFT directory.

Builds a Turkish IBAN from a 5-digit bank code and account number, computing ISO 7064 check digits. A Turkish IBAN is TR + 2 check digits + 5-digit bank code + 1 reserved digit + 16-character account. This pads the account on the left, defaults the reserved digit to 0, computes the mod-97 check digits, and resolves the bank name from the same national table used by IBAN validation when the code is known. Unknown bank codes still produce a structurally valid IBAN with bankName null — existence at the bank is not claimed.

Builds a UBL-TR e-Invoice or e-Archive XML document from plain JSON, computing every total and validating the parties. Selling into Türkiye means issuing a UBL-TR document whose element order is fixed by schema and whose totals must agree to the kuruş, or the integrator rejects it. This endpoint takes the invoice as ordinary JSON and returns the XML. Totals you send are ignored on purpose — line amounts, per-rate VAT subtotals and the payable amount are all recomputed here, because a rounding difference of one kuruş is the most common rejection. VKN and TCKN checksums are verified, and the amount is written out in Turkish words as invoices require. It does not sign the document and does not transmit it: the financial seal and the submission to the tax authority belong to your certificate and your integrator. What comes back is a document ready to enter that step.

Turns a UBL-TR e-Invoice or e-Archive XML document into clean JSON: parties, line items, taxes and totals. Works regardless of the namespace prefix the sender used (cbc:, cac:, ns0:), normalises single-line documents into arrays, and reports amount mismatches in `warnings` instead of returning quietly wrong totals. The job that costs accounting and expense software the most engineering time.

Looks up a Legal Entity Identifier in the GLEIF register: legal name, registration status, country, and BIC. Checksum-valid is not the same as currently registered — a LAPSED or MERGED LEI still passes ISO 7064. This endpoint checks the digits locally first (a typo never becomes an upstream call) then GET the GLEIF lei-records API. Results are cached for 24 hours. GLEIF allows 60 requests per minute; above that, or on timeout/5xx, we return `unknown` rather than invent a registration. HTTP 404 means the service answered and the LEI is not in the index (`invalid`). This is not a replacement for GLEIF’s own API for bulk. `status` is registration.status (ISSUED/LAPSED/MERGED/…), not entity.status (ACTIVE).

Validates a 20-character Legal Entity Identifier (ISO 17442) with the ISO 7064 mod-97 check digits. KYC and MiFID reporting reject an LEI that fails the check digits before anyone looks the entity up. The algorithm is the same family as IBAN (ISO 7064 mod 97-10) over all 20 characters; the remainder must be 1. The first 4 characters are the issuing LOU prefix, the next 14 the entity, the last 2 the check digits. This does not call GLEIF. A checksum-valid LEI can be lapsed, merged, or never issued. Use GLEIF's free API if you need "this legal entity is currently registered".

Dated archive of LLM prices, context windows, announced retirement dates and quiet delistings across 400+ models and 50+ providers. Providers overwrite their pricing pages and drop models from their catalogs without publishing what changed. This endpoint keeps a daily record, so three otherwise unanswerable questions become answerable: what a model cost on a given date (a contract and budget question), which models were quietly removed (a dependency-audit question), and when a retirement date was first announced and whether it later moved (a migration-planning question). Price points land in the shared time series, so a full range query is available through `series/history` under `model.price.<provider>/<model>.<input|output|cache_read>`. The archive can only accumulate forward — it cannot be reconstructed after the fact.

Independent daily record of what changed behind a provider endpoint: which alias resolved to which model, and when behaviour shifted. Providers update models behind stable endpoint names. This endpoint publishes an independent measurement: a fixed probe suite is sent daily at temperature 0, three repeats per probe, and the identity a provider declares in its own response (`modelVersion`, `system_fingerprint`, region) is recorded alongside. A change is only reported as drift when the repeats agree with each other and disagree with the previous run — same-day disagreement is noise, not drift. `aliases` answers "what was actually behind `gemini-flash-latest` on that day"; a question that cannot be answered retroactively.

Splits a free-form Turkish address into neighbourhood, street, building, floor, flat, district, province and postcode. Handles the abbreviation chaos (Mah./Mh., Cd./Cad., Sk./Sok., No:12/5, K:3 D:7), cross-checks the province against the postcode, repairs misspelled district names against a dictionary, and returns a confidence score. Anything it could not place is listed in `unparsed` — nothing is dropped silently. Built for shipping, checkout and CRM systems that receive Turkish addresses typed by humans.

Checks a SWIFT/BIC against ISO 9362 structure (8 or 11 characters), splits bank/country/location/branch, and names well-known institutions. Payment files reject a BIC that is the wrong length or uses a forbidden character in the location code long before they care which bank it is. This checks the ISO 9362 pattern, flags test BICs (a 0 in the location code), and treats XXX as the primary office. A handful of well-known 8-character bank codes resolve to a name; anything else returns bankName null rather than a guess. This is not a lookup in the SWIFT directory. A structurally valid BIC can still be unissued, deactivated or mistyped by one letter that still fits the pattern.

Adds business days or counts them between two dates, accounting for Turkish public and religious holidays including half-day eves. Ramadan and Sacrifice feasts follow the Hijri calendar and cannot be derived reliably by formula, so announced dates are read from a table; years without an official announcement are returned with `confirmed:false` rather than guessed silently. For delivery promises, SLA clocks, payment terms and shipping estimates.

Validates an ISO 6346 freight-container number: owner code, category letter, serial and check digit. Bills of lading and terminal scans mistype container numbers constantly; the check digit (ISO 6346) catches almost all of those before a customs filing. The fourth letter is the category (U freight, J equipment, Z chassis, R reefer). Owner codes are not resolved to a company — BIC's owner-code register is a separate paid product. A valid number is arithmetically self-consistent, not proof the box exists.

Validates or generates an ISO 11649 RF creditor reference (mod-97 check digits). SEPA credit transfers carry an RF creditor reference so remittance data survives the payment chain. The check digits are the same ISO 7064 mod-97 used for IBAN: RF and the two digits move to the end, letters become 10–35, remainder must be 1. If the input already starts with RF and two digits it is validated; otherwise a 1–21 character alphanumeric payload is encoded. A bad checksum is rejected with 400 — a self-inconsistent reference must not enter a payment file.

Validates GTIN-8, UPC-A (12), EAN-13 and GTIN-14 check digits for retail barcodes. Retail GTINs share one GS1 check-digit algorithm with length-dependent packing (8 / 12 / 13 / 14). This endpoint stays on that retail identity: it does not guess shipping carriers. For 13-digit codes the leading three digits are returned as a GS1 company-prefix hint; 868/869 mark Türkiye. A matching check digit is arithmetic consistency, not proof the SKU is listed in a brand catalogue.

Checks an e-mail address: syntax, whether the domain can actually receive mail, disposable and role-account detection, and typo correction. No SMTP probing. Most competitors connect to the target server and try RCPT TO, which sounds thorough but produces a confident-looking number you cannot trust: most servers are catch-all, the big providers refuse to answer, and doing it in bulk gets the probing IP blacklisted. We report only what is provable — whether the domain has a mail exchanger, whether it is a known disposable service, whether the mailbox belongs to a role rather than a person, and whether the domain looks like a typo of a common one (gmial.com → gmail.com). Addresses are also normalised, so Gmail dots and +tags stop creating duplicate signups.

Petrol, diesel and heating-oil pump prices for all 81 Turkish provinces, including the price in force on any past date. The distributor publishes today's pump price and a per-district history query, one district and one range at a time. This endpoint answers the question that actually costs money, in a single call: what was diesel in Ankara on 12 March? Pass `asOf` for the price in force on that day — if the distributor did not change prices that day, the previous price is carried forward and `effectiveFrom` says when it started, with `carriedForward: true`. Pass `from`/`to` to get the change events in a window, each with the percentage move. Every figure carries the source URL and a content hash of the page it was read from, so the number can still be defended in an audit years later. Leave `province` empty to list coverage.

Validates ISBN-10 and ISBN-13 check digits and converts between them when the 978 prefix allows it. Catalogue and retail systems still mix ISBN-10 and ISBN-13. This checks the ISBN-10 weighted mod-11 digit (X allowed) and the ISBN-13 / EAN-13 alternating 1–3 check digit. When an ISBN-10 is valid it returns the ISBN-13 form (978 + body + new check). ISBN-13 values starting with 978 convert back to ISBN-10; 979 prefixes have no ISBN-10 equivalent and isbn10 stays null. Hyphens and spaces are stripped. A valid checksum is not proof the title exists in a national bibliography.

Validates an ISIN (ISO 6166): country code, national identifier and the letter-aware check digit. Portfolio imports and corporate-action files fail on a single mistyped ISIN. The check digit is a Luhn variant that first expands letters to two digits (A=10…Z=35), so a swapped letter is caught, not just a swapped digit. XS (international), EU and other reserved prefixes are accepted as country codes even though they are not ISO 3166 territories. A valid ISIN is self-consistent. It is not proof the security exists, is listed, or is the one you meant.

Computes Turkish severance (kıdem), notice (ihbar) and annual-leave entitlement from service dates and the gross wage, using the official ceiling and minimum-wage tables for the given day. Payroll and HR tools in Turkey chase a parameter that changes every January and July: the severance ceiling, the SGK cap, the minimum wage. This endpoint applies the statutory formulae (Labour Law 4857 arts. 17 and 53, former 1475 art. 14) to those tables. The ceiling is applied to the monthly wage, not the total. Stamp tax (0.759%) is deducted from severance; income tax is not — kıdem is exempt. Notice pay IS taxable; we return the gross and say so, because the actual withholding depends on the employee's cumulative tax base. What this will not tell you: whether the employee is entitled to severance at all. That depends on the reason for termination (retirement, just cause, marriage, military service…). Treating the number as "what is owed" is how you lose at trial.

Searchable, dated archive of what every public MCP server actually exposes — tool definitions, daily change feed, and rug-pull detection. The official MCP registry publishes a server’s name and address but not its tool surface; the only way to learn what a server exposes is to connect and call `tools/list`. This endpoint does that daily across every public remote server and keeps the result. Three things become answerable that the source cannot answer: tool-level search (the registry has none), uptime, and — the one that matters for security — what a tool’s description said yesterday. In MCP a tool description is part of the context handed to the model, so it is prompt text; if it changes after the user approved the server, the server has silently injected new instructions. Each indexed tool also carries a review score with the matched evidence, so the claim can be checked rather than trusted. Measurement boundary: only `initialize` and `tools/list` are ever called — never `tools/call`.

Single-balance access to upstream LLMs; billed per token, no subscription.

Writes a monetary amount out in Turkish words, the way invoices, cheques and promissory notes require. Applies the rules that trip up generic libraries: Turkish says "bin", never "bir bin"; the kuruş part is read separately; and both "1.234,56" and "1,234.56" are accepted and told apart automatically. A mandatory field on Turkish e-invoices, cheques and notes — with no off-the-shelf API until now.

Parses ICAO 9303 TD1/TD3 MRZ and verifies check digits — format check, not identity proof. Machine-readable zones on passports and ID cards carry ICAO 9303 check digits (weights 7,3,1). This parses TD3 (2×44, typical passport) and TD1 (3×30, typical ID card) and reports each field check. A mismatched check digit is HTTP 200 with valid:false — the string is still an MRZ, just inconsistent. This is a format check, not identity proof: it does not confirm the document was issued or that the holder is who they claim.

Builds a person-to-person TR Karekod (FAST) payment payload from IBAN, name and optional TRY amount. Text only — no PNG. Turkish instant payments (FAST) can start from a TR Karekod that encodes the payee IBAN and name in EMV-style TLV. This builds the person-to-person organisation (payload format indicator 750210): application template with IBAN, payee name, optional 12-digit kuruş amount, optional free-text explanation, and a CRC-16/CCITT-FALSE trailer. The Turkish IBAN is normalised and checked with ISO 7064 mod-97; non-TR IBANs and non-TRY currencies are rejected. This does not send money and does not render a QR image.

Builds an EPC069-12 v3.1 V2 (002) SCT payload. Does not send money; returns text only, no PNG. European payments often start from a QR that encodes an EPC069-12 credit-transfer payload. This endpoint builds that text in version 002 (V2): BCD, UTF-8, SCT, optional BIC, name, electronic IBAN, EUR amount. Purpose and structured remittance are left empty; unstructured remittance is copied if given. Lines are LF, not CRLF. IBAN spaces are stripped and letters uppercased; mod-97 is not required here. TRY, USD and any non-EUR currency are rejected. This does not send money and does not render a QR image.

Validates and normalises a phone number to E.164, classifies the line type, and resolves the province for Turkish landlines. For signup and checkout flows that need to store one canonical form and reject typos early. Turkish numbers are handled in depth: landline area codes resolve to a province, mobile and special ranges (toll-free 0800, fixed-rate 0850, premium 0900) are classified, and every accepted input comes back in both E.164 and national notation. One thing this endpoint deliberately does not claim: the current mobile operator. Turkey has had number portability since 2008, so a 0532 number may well be on another network today. Competing APIs report the prefix owner as "the operator" and customers pick SMS routes on that basis. We return it as `originallyAllocatedTo` with the caveat attached, because a confident wrong answer costs more than an honest gap.

Validates a 5-digit Turkish postal code and resolves the province from the first two digits (plate map). PTT postal codes are five digits; the leading pair matches the province plate code for the 81 provinces. This endpoint checks the shape, maps 01–81 to the province name, and returns null with confidence none when the prefix is outside that range — it does not invent a district. District-level resolution needs the full PTT directory and is out of scope here.

Screens a name against six official sanctions lists — US OFAC, UN, EU, UK OFSI, Switzerland SECO and Canada — with transliteration-aware fuzzy matching. Six official lists are reduced to one schema, so a name is checked everywhere at once instead of six integrations. Cyrillic and Arabic names are transliterated, titles and corporate suffixes are stripped, and known spelling families are unified — "Abd al-Rahman", "Abdul Rahman" and "Abdulrahman" reach the same record. Every hit explains itself: which name matched, whether it was an alias the source flags as weak, and how the birth year and country compared. Supply `birthYear` whenever you have it; it removes most false positives. `asOf` screens against the lists as they stood on a past date, which is the question auditors actually ask — note that this is bounded by when our archive begins, reported in `coverage`.

Returns the accumulated history of public data series with change statistics and a source receipt for every point. Currently ingesting the Turkish Central Bank daily FX bulletin (`tcmb.usd`, `tcmb.eur`, …), normalised to one unit so JPY-style 100-unit quotes stop biting. Leave `seriesId` empty to list the catalogue. `fillGaps` carries the last value across weekends and holidays; `includeEvidence` attaches the source URL and content hash for every point, so a value can still be defended years later.

Identifies which carrier a tracking number belongs to, validates it where a checksum exists, and returns the canonical tracking link. Built for order systems that receive numbers from many carriers and have to route the customer to the right tracking page. Turkish carriers mostly use plain numeric ranges that overlap, so a single confident answer is often impossible — this returns a ranked candidate list instead of inventing certainty, because sending a customer to the wrong carrier's page makes them think the parcel is lost. Universal Postal Union (S10) numbers are fully verified: the mod-11 check digit is computed, the service type and origin country are decoded. For formats whose checksum we have not verified against the standard, the result says `not-verified` rather than guessing — a wrong rejection is worse than an honest unknown. Delivery status is deliberately out of scope: Turkish carriers require merchant credentials for that, and scraping their sites would be fragile and against their terms.

Computes the deemed-received date and the HMK deadline (with holiday shifting) for a Turkish notification, from the date the underlying event actually happened. Turkish notification law (7201) ties the deadline clock to an event that is not "the date on the letter" — for electronic notification the UETS platform reports send, read AND reached dates, and only the reached date starts the clock (art. 7/a: deemed received 5 calendar days after reaching the address, whether or not it was opened). HMK adds two more rules on top: the day of notification itself does not count (art. 92 — the period starts the next day) and if the computed last day lands on a weekend or a full public/religious holiday, it moves to the next business day (art. 93); a half-day eve (arife) does not shift it. What this will not tell you: whether the notification was itself valid, or what a specific `periodType` (itiraz, temyiz, cevap…) is in days for your case — that number differs by statute and we do not guess it; supply `periodDays` yourself. Only the "hmk" law family is covered so far.

Validates a tax identifier for 25+ countries: checksum where the algorithm is public, format-only where it is not. Country is required. Onboarding forms collect a tax number from whatever country the customer is in and then store garbage because they only checked the length. This applies the published checksum (SIREN/SIRET Luhn, ABN mod-89, CPF/CNPJ, NIP, BSN 11-proef, NIF/NIE, OIB, IČO, AFM, TCKN/VKN, …) and refuses to guess the country: the same 9 digits are a well-formed identifier in more than one place. Where the checksum is not published (US EIN, UK UTR, DE Steuernummer, IN PAN) the answer is format + `checksum: not-verified`, not a fake pass. This does not ask any tax authority whether the number is issued.

Validates UUID structure and reports version (1–5, 7) and RFC 4122 variant bits. Deterministic. Accepts dashed or 32-hex compact form. Reports the version nibble, variant (NCS / RFC 4122 / Microsoft / future), and whether the layout matches a known UUID version used in practice (v1–v5 and Unix-epoch v7). A valid structure is not proof the UUID was issued by a particular system.

Validates Turkish national ID, tax number, IBAN, licence plate, IMEI, barcodes, KEP, MERSİS, postal code and ISBN from one endpoint, with type auto-detection. Goes past a yes/no: resolves the bank behind an IBAN, the province behind a licence plate and the GS1 country prefix behind a barcode. Pure local computation — no upstream service is called, so latency is microseconds and the answer never changes for the same input.

Validates a 17-character VIN: forbidden letters, ISO 3779 check digit, WMI region/manufacturer, model year and plant. Typos in a VIN are usually a forbidden letter (I, O, Q — they look like 1 and 0) or a shifted character. This rejects those, splits WMI/VDS/VIS, and names the manufacturer when the WMI is in a conservative built-in table. The 9th-character check digit is computed and compared, but a mismatch does not fail the VIN: it is mandatory under FMVSS 115 in North America and routinely ignored in Europe. `checkDigitMatch` tells you; `valid` stays true if the 17-character form is legal. This does not decode the full vehicle (engine, body, options) and does not prove the VIN was issued.