{"uid":"cap_7e0DsrbQfEnIrht39c_id","slug":"iban-check-signature-verification-275f6436","name":"IBAN Check - Signature Verification","description":"Enterprise microservice and autonomous AI agent hub: ISO 13616 IBAN (#6), Romanian CUI Modulo-11 & EU VIES (#7), UBL 2.1 e-Factura XML (#4), and RFC 9562 UUIDv7 Idempotency (#18).","url":"https://api.ibancheck.co.uk/api/verify-signature?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"sha256":{"type":"string"},"payload":{"type":"object"},"merkleLeaf":{"type":"string"},"timestampMs":{"type":"number"},"hmacSignature":{"type":"string"},"maxAgeSeconds":{"type":"number"}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.003","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.003/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.003","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_BqwPb7f3A036Fzvn6lLUM","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.003","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Re-canonicalizes a payload and compares a recomputed hash or HMAC against provided values to detect tampering or replay attacks","exampleAgentPrompt":"Check whether this payload has been tampered with — the payload is {\"action\":\"transfer\",\"amount\":100}, the SHA-256 hash is 'abc123...', the HMAC signature is 'def456...', the timestamp is 1717000000000, and the max allowed age is 300 seconds.","exampleUseCases":[{"title":"Webhook integrity check for payment events","prompt":"I just received a payment webhook with this payload: {\"event\":\"payment.completed\",\"amount\":500}, and the sender included a SHA-256 hash of 'a1b2c3...' and HMAC signature 'x9y8z7...', timestamped at 1717050000000. Can you verify the signature is valid and the message hasn't been tampered with, allowing up to 60 seconds of age?"},{"title":"AI agent action audit trail verification","prompt":"We logged an AI agent action with payload {\"agentId\":\"agent-7\",\"action\":\"approve_invoice\"} and sealed it with SHA-256 'f3e2d1...' and HMAC 'c4b5a6...' at timestamp 1717100000000. Please verify the seal is intact and the record hasn't been altered, with a max age of 600 seconds."},{"title":"Replay attack detection for signed API requests","prompt":"This API request came in with payload {\"userId\":\"u-99\",\"operation\":\"delete\"}, SHA-256 'deadbeef...', HMAC '1a2b3c...', and a timestamp of 1717200000000. Run a signature check with a max age of 120 seconds to make sure this isn't a replayed request."}],"resultDescription":"Returns a validation result indicating whether the recomputed hash/HMAC matches the provided values, whether the payload has been tampered with, and whether the timestamp falls within the allowed age window, enabling tamper and replay detection.","failureModes":["Hash or HMAC mismatch — payload has been modified or wrong secret used","Timestamp too old — exceeds maxAgeSeconds, indicating a potential replay attack","Missing required fields (payload, sha256 or hmacSignature) — returns validation error","Malformed payload object — cannot be canonicalized, returns processing error","Invalid timestamp format — non-numeric or missing timestampMs causes rejection"],"whenToPreferThis":"Choose this endpoint when you need server-side cryptographic verification of payload integrity and freshness, especially for AI agent audit trails, webhook validation, or replay attack prevention. It is particularly suited when you already have a paired seal endpoint (SHA-256/HMAC generation) on the same platform and want consistent canonicalization logic on both sides.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T12:44:24.789Z","isFirstParty":false,"canonicalSlug":"iban-check-signature-verification-275f6436"}