DEVELOPER GUIDE

Your first ApiVect request.

ApiVect is in private preview. The workspace owner can create server-side API keys in the dashboard after enrolling an authenticator. Public account creation and paid subscriptions are not available yet.

1. Keep your key on your server

Set APIVECT_API_KEY through your environment or secret manager. Never embed it in browser JavaScript, source control or a public example. Each product requires the corresponding key scope and an active product entitlement.

2. Validate an invoice

Download the official positive Peppol example as valid-invoice.xml. It contains synthetic example data and retains its upstream licence notice.

curl --request POST https://api.apivect.com/v1/invoices/validate \
  --header "Authorization: Bearer $APIVECT_API_KEY" \
  --header "Content-Type: application/xml" \
  --header "Idempotency-Key: first-invoice-example-001" \
  --data-binary @valid-invoice.xml

A successful operation returns HTTP 200 with valid, the detected profile, rule-set version, validation stages and findings. An invalid invoice can also return HTTP 200: inspect valid. Invalid business content consumes one validation unit when the validation operation completes.

3. Retry safely

Send the exact same body, profile and idempotency key again within 24 hours. The response includes Idempotent-Replayed: true and consumes no additional unit. A key used with different input returns 409. An expired key or failed operation returns a specific retry instruction; do not blindly repeat a request with a new key after an uncertain network result.

4. Check VAT

curl --request POST https://api.apivect.com/v1/vat/validate \
  --header "Authorization: Bearer $APIVECT_API_KEY" \
  --header "Content-Type: application/json" \
  --header "Idempotency-Key: first-vat-example-0001" \
  --data '{"countryCode":"DK","vatNumber":"12345678"}'

This number is illustrative. Results distinguish valid, invalid and unknown. Unknown provider results consume zero units. Cached conclusive results count as a new check when sent with a new idempotency key. Check the provider date and cached flag.

5. Inspect a domain

curl --request POST https://api.apivect.com/v1/domains/audit \
  --header "Authorization: Bearer $APIVECT_API_KEY" \
  --header "Content-Type: application/json" \
  --header "Idempotency-Key: first-domain-example-001" \
  --data '{"domain":"apivect.com","dkimSelectors":[]}'

Supply known DKIM selectors when available. Each check returns pass, warning, fail, unknown or not_tested and states its coverage. This preview inspects direct-domain configuration; it does not evaluate an actual email message or provide scheduled monitoring. SPF sender evaluation, DMARC organizational-domain discovery, BIMI logos/certificates and SMTP delivery are outside current coverage.

Handle limits and failures

• 401/403: check your key and scopes.
• 402: the product entitlement is inactive.
• 409: follow the idempotency error code.
• 429: read the error code; a quota or spending cap needs a plan/limit change, while a rate limit may include Retry-After.
• 503: the service or a dependency could not complete the operation. There is no charge for a failed operation; first retry the same idempotency key to resolve uncertainty.

Trial access is limited and has no automatic charge or overage. Open the interactive API reference for request/response schemas and the planned price catalogue for product allowances.