Card Check API
The Card Check endpoint provides programmatic access to WhiteIntel's exposed payment card intelligence. It allows authorized clients to query compromised card records that have been identified across infostealer logs and dark web sources, filtered by issuer identification number (BIN), issuing institution, country, and a range of card attributes.
This endpoint is part of the Payment Fraud Intelligence module and requires a license with payment fraud access enabled.
Endpoint
POST https://api.whiteintel.io/card_check.phpAll requests must use the POST method with a Content-Type of application/json.
Authentication
Authentication is performed using your API key, supplied in the request body. The API key must belong to an account with the Payment Fraud Intelligence module enabled.
{
"apikey": "YOUR_API_KEY",
"bin": "424242"
}Requests that omit the API key, supply an invalid key, or originate from an account without payment fraud access will be rejected with an appropriate error response.
Privacy and Data Handling
This endpoint never returns cardholder names. Card records are returned with partial card identifiers (BIN and last four digits only) alongside non-sensitive metadata such as issuer, country, network, and card classification. Full primary account numbers (PAN), security codes, and cardholder names are not exposed through this API under any circumstance.
Request Parameters
Primary Selector
Exactly one primary selector must be supplied per request. Supplying zero or more than one will result in a validation error.
bin
string
A 6-digit or 8-digit Bank Identification Number. Non-digit characters are stripped automatically. A 6-digit value matches against the card BIN; an 8-digit value matches against the extended BIN.
issuer
string
The name of the issuing institution. Matching is case-insensitive and partial. Must be between 3 and 100 characters.
country
string
The issuing country. A 2-character value is treated as an ISO 3166-1 alpha-2 country code and matched exactly. A longer value is treated as a country name and matched partially.
Optional Refinement Filters
Any combination of the following filters may be applied in addition to the primary selector. Filters are combined using logical AND semantics.
networks
array
Restrict results to the specified card networks, for example ["VISA", "MASTERCARD"]. Case-insensitive. Maximum 10 values.
types
array
Restrict results to the specified card types, for example ["credit", "debit"]. Case-insensitive. Maximum 10 values.
brands
array
Restrict results to the specified card brands or product tiers, for example ["VISA SIGNATURE", "WORLD ELITE"]. Case-insensitive. Maximum 10 values.
countries
array
Restrict results to one or more ISO 3166-1 alpha-2 country codes. Applied in addition to the primary selector. Maximum 20 values.
valid_only
boolean
When true, only cards whose expiration date has not yet passed are returned.
exposed_after
string
Only return cards first exposed on or after this date. Format: YYYY-MM-DD.
exposed_before
string
Only return cards first exposed on or before this date. Format: YYYY-MM-DD.
Sorting
sort_by
string
exposed_date
The field to sort by. Accepted values are exposed_date and expiry.
sort_dir
string
desc
The sort direction. Accepted values are asc and desc.
Pagination
page
integer
1
The page number to retrieve, using 1-based indexing.
Each response returns a maximum of 20 records. This limit is fixed and cannot be increased. The has_more field in the response indicates whether additional pages are available.
Response
A successful request returns an HTTP 200 status with a JSON body.
Response Fields
success
boolean
Indicates whether the request was processed successfully.
remaining_daily_calls
integer
The number of payment fraud API calls remaining for the current day.
query
object
An echo of the interpreted query, including the primary selector, applied filters, and sort configuration.
page
integer
The page number returned.
page_size
integer
The maximum number of records per page. Always 20.
count
integer
The number of records returned in this response.
has_more
boolean
Indicates whether additional pages of results are available.
results
array
The array of matching card records.
Result Object Fields
bin6
string
The 6-digit Bank Identification Number.
bin8
string or null
The 8-digit extended Bank Identification Number, where available.
last_four
string
The last four digits of the card number.
expiry_month
integer or null
The card expiration month, where available.
expiry_year
integer or null
The card expiration year, where available.
is_valid_expiry
boolean
Indicates whether the card's expiration date is still in the future.
card_network
string or null
The card network, such as VISA, MASTERCARD, or AMEX.
issuer_bank
string or null
The name of the issuing institution.
issuer_country
string or null
The ISO 3166-1 alpha-2 country code of the issuing institution.
card_type
string or null
The card type, such as credit or debit.
card_brand
string or null
The card brand or product tier, such as VISA SIGNATURE or WORLD ELITE.
exposed_date
string
The timestamp at which the card record was added to the platform.
Rate Limiting
Access is governed by a daily call quota associated with your API key. Each request to this endpoint consumes one call from your daily allowance, regardless of the number of records returned. The remaining_daily_calls field reports your remaining quota after the current request.
When the daily limit is reached, further requests are rejected until the quota resets. To request a higher limit, contact your account representative.
Pagination Strategy
To retrieve a complete result set, begin with page set to 1 and continue incrementing the page number while the has_more field is true. Because each call consumes one unit of your daily quota, paginate only as deeply as required for your use case. The fixed page size of 20 records is a deliberate control to discourage bulk extraction.
Error Responses
Errors are returned as a JSON object with success set to false and a descriptive message. The HTTP status code reflects the nature of the error where applicable.
400
The request method or content type is invalid, or the JSON payload is malformed.
403
The API key is missing or invalid, or the payment fraud module is not enabled for the key.
200
Validation errors and quota-exceeded conditions are returned with a 200 status and a success value of false. Inspect the message field for detail.
Example Error Responses
Missing primary selector:
Invalid BIN:
Payment fraud module not enabled:
Daily limit exceeded:
Examples
Search by BIN
Retrieve the most recently exposed cards for a specific 6-digit BIN.
Search by Issuer with Network and Validity Filters
Retrieve valid credit cards from a specific issuer, limited to the Visa network.
Search by Country with Date Range
Retrieve cards issued in the United States exposed within a specific date range, sorted by expiration date.
Paginating Through Results
Retrieve the second page of results for a given query.
Last updated