Temsor API — Turkey & EU business data

Single-balance access to upstream LLMs; billed per token, no subscription.

Checks a SWIFT/BIC against ISO 9362 structure (8 or 11 characters), splits bank/country/location/branch, and names well-known institutions. Payment files reject a BIC that is the wrong length or uses a forbidden character in the location code long before they care which bank it is. This checks the ISO 9362 pattern, flags test BICs (a 0 in the location code), and treats XXX as the primary office. A handful of well-known 8-character bank codes resolve to a name; anything else returns bankName null rather than a guess. This is not a lookup in the SWIFT directory. A structurally valid BIC can still be unissued, deactivated or mistyped by one letter that still fits the pattern.

Validates an ISO 6346 freight-container number: owner code, category letter, serial and check digit. Bills of lading and terminal scans mistype container numbers constantly; the check digit (ISO 6346) catches almost all of those before a customs filing. The fourth letter is the category (U freight, J equipment, Z chassis, R reefer). Owner codes are not resolved to a company — BIC's owner-code register is a separate paid product. A valid number is arithmetically self-consistent, not proof the box exists.

Validates or generates an ISO 11649 RF creditor reference (mod-97 check digits). SEPA credit transfers carry an RF creditor reference so remittance data survives the payment chain. The check digits are the same ISO 7064 mod-97 used for IBAN: RF and the two digits move to the end, letters become 10–35, remainder must be 1. If the input already starts with RF and two digits it is validated; otherwise a 1–21 character alphanumeric payload is encoded. A bad checksum is rejected with 400 — a self-inconsistent reference must not enter a payment file.

Validates GTIN-8, UPC-A (12), EAN-13 and GTIN-14 check digits for retail barcodes. Retail GTINs share one GS1 check-digit algorithm with length-dependent packing (8 / 12 / 13 / 14). This endpoint stays on that retail identity: it does not guess shipping carriers. For 13-digit codes the leading three digits are returned as a GS1 company-prefix hint; 868/869 mark Türkiye. A matching check digit is arithmetic consistency, not proof the SKU is listed in a brand catalogue.

Checks an e-mail address: syntax, whether the domain can actually receive mail, disposable and role-account detection, and typo correction. No SMTP probing. Most competitors connect to the target server and try RCPT TO, which sounds thorough but produces a confident-looking number you cannot trust: most servers are catch-all, the big providers refuse to answer, and doing it in bulk gets the probing IP blacklisted. We report only what is provable — whether the domain has a mail exchanger, whether it is a known disposable service, whether the mailbox belongs to a role rather than a person, and whether the domain looks like a typo of a common one (gmial.com → gmail.com). Addresses are also normalised, so Gmail dots and +tags stop creating duplicate signups.

Dated EU-27 VAT rates (standard, reduced, super-reduced, parking) plus the Union OSS threshold. Not a goods classification. Invoice software that hard-codes “Germany is 19%” breaks the day a member state moves a rate, and it never knew the reduced list. This is a point-in-time schedule of published rates for the EU VAT area, keyed by country and asOf. It is a schedule of rates, not which goods fall in which reduced band — there is no HS or NACE mapping. Great Britain, Northern Ireland, Switzerland, Norway and Türkiye are recognised and returned with null rates. If the table has no row for that date the rates are null; the last known line is not reused.

Validates an EU VAT number against the official VIES register, with per-country format checks and honest handling of upstream outages. VIES is free but unreliable: member-state services drop out individually and a failed lookup can easily be mistaken for a rejection. Treating an outage as "invalid" means charging VAT to a customer who should have been exempt — an error with a price tag. So this endpoint never returns `invalid` when the service could not answer; it returns `unknown` and names the reason, and reports whether that country's service is currently up. Format is checked locally first, so an obvious typo never becomes an upstream call. Results are cached for 24 hours. Note that most member states do not publish the company name; when they do, it is returned.

Validates an IBAN from any of 70+ countries: checksum, country length and in-country account structure, and resolves the bank and branch codes. Most free libraries stop at the mod-97 checksum. That only says the digits are self-consistent — not that the number could exist in that country. This checks the country's BBAN structure too, so a wrong-length or wrong-shaped account is rejected before your payment file reaches the bank. When only the two check digits are wrong, the correct ones are computed and returned as a suggestion, because that is what people actually mistype. Turkish, Dutch and Belgian IBANs additionally resolve to a bank name when the national code is in our table; otherwise bankName is null. This is not a SWIFT directory.

Parses ICAO 9303 TD1/TD3 MRZ and verifies check digits — format check, not identity proof. Machine-readable zones on passports and ID cards carry ICAO 9303 check digits (weights 7,3,1). This parses TD3 (2×44, typical passport) and TD1 (3×30, typical ID card) and reports each field check. A mismatched check digit is HTTP 200 with valid:false — the string is still an MRZ, just inconsistent. This is a format check, not identity proof: it does not confirm the document was issued or that the holder is who they claim.

Validates ISBN-10 and ISBN-13 check digits and converts between them when the 978 prefix allows it. Catalogue and retail systems still mix ISBN-10 and ISBN-13. This checks the ISBN-10 weighted mod-11 digit (X allowed) and the ISBN-13 / EAN-13 alternating 1–3 check digit. When an ISBN-10 is valid it returns the ISBN-13 form (978 + body + new check). ISBN-13 values starting with 978 convert back to ISBN-10; 979 prefixes have no ISBN-10 equivalent and isbn10 stays null. Hyphens and spaces are stripped. A valid checksum is not proof the title exists in a national bibliography.

Validates an ISIN (ISO 6166): country code, national identifier and the letter-aware check digit. Portfolio imports and corporate-action files fail on a single mistyped ISIN. The check digit is a Luhn variant that first expands letters to two digits (A=10…Z=35), so a swapped letter is caught, not just a swapped digit. XS (international), EU and other reserved prefixes are accepted as country codes even though they are not ISO 3166 territories. A valid ISIN is self-consistent. It is not proof the security exists, is listed, or is the one you meant.

Looks up a Legal Entity Identifier in the GLEIF register: legal name, registration status, country, and BIC. Checksum-valid is not the same as currently registered — a LAPSED or MERGED LEI still passes ISO 7064. This endpoint checks the digits locally first (a typo never becomes an upstream call) then GET the GLEIF lei-records API. Results are cached for 24 hours. GLEIF allows 60 requests per minute; above that, or on timeout/5xx, we return `unknown` rather than invent a registration. HTTP 404 means the service answered and the LEI is not in the index (`invalid`). This is not a replacement for GLEIF’s own API for bulk. `status` is registration.status (ISSUED/LAPSED/MERGED/…), not entity.status (ACTIVE).

Validates a 20-character Legal Entity Identifier (ISO 17442) with the ISO 7064 mod-97 check digits. KYC and MiFID reporting reject an LEI that fails the check digits before anyone looks the entity up. The algorithm is the same family as IBAN (ISO 7064 mod 97-10) over all 20 characters; the remainder must be 1. The first 4 characters are the issuing LOU prefix, the next 14 the entity, the last 2 the check digits. This does not call GLEIF. A checksum-valid LEI can be lapsed, merged, or never issued. Use GLEIF's free API if you need "this legal entity is currently registered".

Searchable, dated archive of what every public MCP server actually exposes — tool definitions, daily change feed, and rug-pull detection. The official MCP registry publishes a server’s name and address but not its tool surface; the only way to learn what a server exposes is to connect and call `tools/list`. This endpoint does that daily across every public remote server and keeps the result. Three things become answerable that the source cannot answer: tool-level search (the registry has none), uptime, and — the one that matters for security — what a tool’s description said yesterday. In MCP a tool description is part of the context handed to the model, so it is prompt text; if it changes after the user approved the server, the server has silently injected new instructions. Each indexed tool also carries a review score with the matched evidence, so the claim can be checked rather than trusted. Measurement boundary: only `initialize` and `tools/list` are ever called — never `tools/call`.

Dated archive of LLM prices, context windows, announced retirement dates and quiet delistings across 400+ models and 50+ providers. Providers overwrite their pricing pages and drop models from their catalogs without publishing what changed. This endpoint keeps a daily record, so three otherwise unanswerable questions become answerable: what a model cost on a given date (a contract and budget question), which models were quietly removed (a dependency-audit question), and when a retirement date was first announced and whether it later moved (a migration-planning question). Price points land in the shared time series, so a full range query is available through `series/history` under `model.price.<provider>/<model>.<input|output|cache_read>`. The archive can only accumulate forward — it cannot be reconstructed after the fact.

Independent daily record of what changed behind a provider endpoint: which alias resolved to which model, and when behaviour shifted. Providers update models behind stable endpoint names. This endpoint publishes an independent measurement: a fixed probe suite is sent daily at temperature 0, three repeats per probe, and the identity a provider declares in its own response (`modelVersion`, `system_fingerprint`, region) is recorded alongside. A change is only reported as drift when the repeats agree with each other and disagree with the previous run — same-day disagreement is noise, not drift. `aliases` answers "what was actually behind `gemini-flash-latest` on that day"; a question that cannot be answered retroactively.

Builds an EPC069-12 v3.1 V2 (002) SCT payload. Does not send money; returns text only, no PNG. European payments often start from a QR that encodes an EPC069-12 credit-transfer payload. This endpoint builds that text in version 002 (V2): BCD, UTF-8, SCT, optional BIC, name, electronic IBAN, EUR amount. Purpose and structured remittance are left empty; unstructured remittance is copied if given. Lines are LF, not CRLF. IBAN spaces are stripped and letters uppercased; mod-97 is not required here. TRY, USD and any non-EUR currency are rejected. This does not send money and does not render a QR image.

Notify an optional audio chunk / customer URI for a live or archived call (idle $0). Prefer customer storage URI. Temsor keeps a pointer; STT only while a call is active.

Multi-agent handoff bridge intent + shared open-promise memory. Idle $0. No live PSTN. POST /v1/pbx/bridge/multi-agent {call_id, agents:[{role,label}]}. Records a virtual multi-agent handoff bridge intent in the PBX index for co-agent orchestration. Returns shared_memory linking open promises on the call. Idle $0. No Telnyx/DID/LLM/live PSTN. Advanced: intent only — no live Asterisk/ExternalMedia.

List recent calls with transfer path crumbs — site + customer archive browser. GET /v1/pbx/calls?limit=20. Scoped by x-temsor-pbx-key when set. Idle $0. No DID sales.

Get one call by id with transfer graph — customer detail drawer. GET /v1/pbx/calls/get?call_id=…. Scoped by x-temsor-pbx-key. found=false if missing. Idle $0.

Handoff graph + transfer edges — who→whom→where the promise stuck (moat). Idle $0. GET /v1/pbx/calls/graph?call_id=…&stuck_at=310. Returns path, path_tr (plain Turkish), edges, and raw transfers. Compounding asset for search/orchestration: handoff edges, not a bot transcript. Idle $0. No DID sales / no live PSTN.

Managed SaaS domain dictionary (E4) — example packs thicken per pilot (tenant-scoped aliases). Boosts search + Fact extract. No invented premiums. GET /v1/pbx/dictionary?domain=otel|santral_firmasi|sigorta|finans|enerji|otomotiv|msp|all (msp = legacy alias for santral_firmasi). Idle $0, no LLM. Synonyms feed archive search (match crumbs) and transcript Fact extraction. Write path: POST /v1/pbx/dictionary/add.

Add a synonym/alias (tenant-scoped or global demo) — E4 compounding thickens search boost + Fact extract. ≤60/hour/key → 429. Idle $0. No invented premiums. POST /v1/pbx/dictionary/add {term, alias, domain:otel|santral_firmasi|sigorta|finans|enerji|otomotiv, scope?:pbx|global}. Managed SaaS compounding (E4): tenant-scoped aliases thicken search + fact extract. No invented premiums/prices. Idle $0, no LLM. Legacy msp → santral_firmasi.

Ingest call-ops events → open promises + transfer crumbs for search/orchestration. Optional HMAC. Idle $0 when no calls. Demo stores events in memory/file. Auth: omit, x-temsor-pbx-key, or x-temsor-signature = hex(HMAC-SHA256(api_key, body)); bad signature rejected when header present. BridgeEnter → transfer/handoff crumbs. Utterance/text → open Promise docs via heuristic (no LLM). Idle $0. Body ≤256 KiB → 429. Advanced: ARI/Stasis batch shape when customer runs own PBX — not Asterisk-first product copy.

List extracted facts (IMEI, room, tariff…) from the durable index — filter by call_id, kind, domain, q. GET /v1/pbx/facts?call_id=&kind=&domain=otel|santral_firmasi|all&q=&limit=50. Facts come from transcript extract + domain dictionary; persist in pbx-index. Scoped by x-temsor-pbx-key. Idle $0. No DID sales. KVKK forget ready. Advanced: own PBX/Asterisk stays on customer.

Get one extracted fact by id — detail drawer for site + customer. GET /v1/pbx/facts/get?id=…. Scoped by x-temsor-pbx-key. found=false if missing. Idle $0. No DID sales.

Upsert mid-call partial index (utterances → fact/promise hints). Path to ≤400ms whisper; ≤600/hour/key → 429; idle $0. POST /v1/pbx/index/partial {call_id, text?, speaker?, t_ms?, is_final?, live?, end_call?, promote?}. Streams partial STT queue into accumulating Fact/Promise hints while the call is live. No Temsor STT/LLM — customer posts text. Managed SaaS in-call index; no DID sales. Own PBX optional footnote. Idle $0.

GET mid-call partial index — accumulating facts/promises/snippets while live. GET /v1/pbx/index/partial/get?call_id=…. Returns live partial state for whisper ≤400ms path. Idle $0 when no live call. Managed SaaS in-call index; no DID sales. Own PBX optional footnote.

Heuristic TR promise extractor from transcript text — creates open Promise docs (idle $0, no LLM). Detects promise-like sentences (söz, vaat, edeceğiz, iade, iptal, yarın…). Optional persist_promises=false for extract without writing. Also wired via utterance text on POST /v1/pbx/events.

GET last gece-ikizi report persisted on forge volume (null if never run). Idle $0. GET /v1/pbx/night-twin/last — last report from POST /v1/pbx/night-twin/run. No LLM/Telnyx.

Night scan: open promises older than N hours → unresolved candidates (iptal/iade/söz). ≤20/hour/key → 429. Idle $0, no LLM. POST /v1/pbx/night-twin/run {pbx_id?, older_than_hours?}. Heuristic night twin — still-open promises older than N hours whose text matches iptal/iade/söz. Persists last report on forge volume. No Telnyx/LLM.

Agent orchestration: search/promise hits → whisper / hold / transfer / PCI handoff intent. Idle $0. No live PSTN. Own PBX = advanced footnote. POST /v1/pbx/orchestra/act {call_id, action, params?, stasis_webhook_url?}. Turns search/promise/suggest hits into managed orchestra intents (handoff-ready) on Temsor runtime. No live RTP required for stub. Idle $0. Not a receptionist bot. Prefer POST /v1/pbx/promises/act for promise→graph closed loop (E1). Advanced: optional own-PBX Stasis/ARI webhook forward — not Asterisk-first glue.

List recent orchestration/handoff intents (whisper/hold/transfer/PCI). Number→flow SaaS · idle $0 · no DID. Own PBX = advanced footnote. GET /v1/pbx/orchestra/acts?limit=20&call_id=. Tenant-scoped recent orchestra intents (E.5) for agent audit. Pairs with POST /v1/pbx/orchestra/act and POST /v1/pbx/promises/act (E1 closed loop). Managed SaaS runtime — idle $0 · not live PSTN. Advanced: not Asterisk-first glue; own PBX optional footnote.

Light CRM from call graph / facts — caller phones+names and extension identities seen on transfers. GET /v1/pbx/persons?call_id=&kind=caller|extension|all&q=&limit=50. Durable Person rows from pbx-index plus derived extension identities (ext_NNN) from Transfer edges / promise.ext. Scoped by x-temsor-pbx-key. Idle $0. No DID sales. KVKK forget ready. Advanced: own PBX/Asterisk stays on customer.

Get one light-CRM identity by id — caller Person or derived extension. GET /v1/pbx/persons/get?id=per_001|ext_101. Scoped by x-temsor-pbx-key. found=false if missing. Idle $0. No DID sales.

List open/broken call promises for agent handoff tracking — hotel / MSP sales demo. Idle $0. GET /v1/pbx/promises?status=open returns open/unclosed promises with transfer/handoff path for orchestration. Scoped by x-temsor-pbx-key when set. Idle $0. No live PSTN.

E1 moat: who→whom→promise → orchestra handoff intent (whisper/transfer/hold). Idle $0. No live PSTN. Own PBX = advanced footnote. POST /v1/pbx/promises/act {promise_id, action?}. Loads the promise + call graph, suggests whisper/transfer/hold, records orchestra intent with source_type=promise for agent handoff. Managed SaaS runtime. ≤120/hour/key (shares orchestra bucket). Idle $0. carrier/pstn always false. No cross-tenant graph merge. Advanced: not Asterisk-first glue; own PBX optional footnote.

Mark an open promise kept or broken with an optional KVKK-safe note — makes the sales demo writable, not read-only. ≤60/hour/key → 429. POST /v1/pbx/promises/close {promise_id, status:kept|broken, note?}. Phones/emails in note are scrubbed. Scoped by x-temsor-pbx-key when set. Idle $0 — no LLM/PSTN.

Export open/broken promises as CSV or JSON — hotel / PBX-provider unclosed-promise sales list. GET /v1/pbx/promises/export?status=open|closed&format=csv|json. CSV/JSON include closed_at, close_note, path crumbs. Scoped by x-temsor-pbx-key when set. Idle $0.

Undo a kept/broken close — restore an open promise so the sales demo can reverse a mis-click. ≤60/hour/key → 429. POST /v1/pbx/promises/reopen {promise_id}. Only kept|broken → open; clears closed_at/close_note. Scoped by x-temsor-pbx-key when set. Idle $0.

KVKK-first forget (default-on SaaS): clear derived index by id/phone; durable audit who/what/when + tenant scope. ≤30/hour/key → 429. Managed pointer only — not a legal deletion SLA. E.3 KVKK-first redaction for managed SaaS. mode=anonymize|delete. Lookup by target_id or phone. Clears Person/Promise/Fact/partial index + Temsor audio pointers in your tenant only (no cross-tenant). Durable audit. Raw media stays on your side. Not a legal deletion SLA. List: GET /v1/pbx/redact/audit.

List recent KVKK forget actions — who/what/when + tenant scope. Managed SaaS derived-index audit; not a legal deletion SLA. GET /v1/pbx/redact/audit?limit=20. Durable audit from POST /v1/pbx/redact (E.3). Tenant-scoped. Derived index cleared; raw media not deleted by Temsor. Number→flow managed SaaS; own PBX optional. No DID sales.

Register a pilot PBX; returns pbx_id + API key once (hashed at rest). ≤5/hour/IP → 429. Idle $0. Control-plane register. API key shown once; stored hashed at rest. Send x-temsor-pbx-key to scope GET /v1/pbx/promises to this pbx_id. No speech recognition while idle.

Agent archive search over call promises and facts — voice-Google for call-ops, not a receptionist bot. Idle $0. Demo index + domain dictionary v0. Filters: status, date, ext, competitor, stuck_after (transfer/handoff hop). Returns call-graph path + transfer edges for orchestration. Idle $0. No live PSTN.

Control-plane status — promise/orchestra/search counts + idle $0. No DID sales. GET /v1/pbx/status. Scoped by x-temsor-pbx-key when set. Derived index on Temsor for agent search/orchestration. Idle $0. Advanced: own PBX/Asterisk stays on customer.

Load demo: sample call utterances → promise extractor → stats (calls, promises_open). ≤10/hour/key → 429. Idle $0, no LLM/PSTN. POST /v1/pbx/synthetic/run {scenario:ivr_menu|promise_heavy, count:10..500}. Generates deterministic fake utterances, runs heuristic ingest/transcript extract, returns calls + promises_open. No Telnyx/DID/LLM.

Register or list outbound webhooks — customer URL receives promise/fact/orchestra/redact events (HMAC if secret). POST write ≤30/hour/key → 429. POST /v1/pbx/webhooks {url, secret?, events?, ping?} registers. GET lists. ping:true sends a test delivery. Events: promise.opened, promise.closed, fact.extracted, orchestra.act, redact. Signed with x-temsor-signature when secret set. Idle $0. No DID sales. KVKK. Advanced: own PBX/Asterisk stays on customer.

List last N outbound webhook deliveries (stub or live) — promise/fact/orchestra/redact/ping. GET /v1/pbx/webhooks/deliveries?limit=20&webhook_id=. Durable log of Temsor→customer POSTs. HMAC when secret set. Idle $0. No DID sales. KVKK. Advanced: own PBX/Asterisk stays on customer.