The platform layer of the castomo ecosystem

One account.700+ endpoints.

Verify, convert, generate, scrape, search and integrate through one key, and pay tokens only for calls that succeed.

706 operations48 groups30 integrations20 platform services1000 free tokens a month

POST/v1/verify/aba-routing2001 token
POST/v1/convert/base642001 token
POST/v1/scrape2001 token
POST/v1/serp/cannibalization200from 60 tokens
POST/v1/ai/ux-audit20040 tokens
POST/v1/images/search2002 tokens
POST/v1/parse/email2002 tokens
POST/v1/utilities/dns2001 token
POST/v1/email/read2002 tokens
POST/v1/verify/aba-routing2001 token
POST/v1/convert/base642001 token
POST/v1/scrape2001 token
POST/v1/serp/cannibalization200from 60 tokens
POST/v1/ai/ux-audit20040 tokens
POST/v1/images/search2002 tokens
POST/v1/parse/email2002 tokens
POST/v1/utilities/dns2001 token
POST/v1/email/read2002 tokens

What does castomAPI already have for you?

Type a platform or a job. Every number here comes from the same catalogue this page was built from, so it cannot drift from what the API actually does.

Search platforms and groups

What would a month cost?

Pick what you would call and how often. Where a group's operations are not all one price, the figure is a range rather than a number that would be wrong for most of them.

Add a group

— tokens a month

How it works

Get one key

Sign in with the castomo account you already have. One key covers every metered endpoint — there is nothing to enable per endpoint.

Call anything

Send x-api-key and a JSON body. Every response comes in the same envelope, with the tokens it cost written into it.

Pay for what worked

Tokens are debited after the response, and only on success. A failed call, a 404, a refused upstream — all free. 1000 tokens arrive every month on their own.

Sixteen reasons

Why one account and one wallet is the present you were waiting for

Every reason below is a real request and its real response shape. Nothing here is a promise; it is what the platform answers today.

One key opens every door

706 operations in 48 groups, and every one of them takes the same header. Verify an IBAN, then convert a colour, then read a Shopify order — no second sign-up, no second key, no second invoice.

See all 48 groups →

POST/v1/verify/ibanfree, no key

{ "iban": "PL61109010140000071219812874" }

{
  "status": "success",
  "tokensDeducted": 0,
  "isValid": true,
  "validationResult": { "isChecksumValid": true, "isFormatValid": true, "isLengthValid": true },
  "ibanDetails": { "countryCode": "PL", "countryName": "Poland", "formattedPrint": "PL61 1090 1014 0000 0712 1981 2874" }
}

One wallet, and it only moves on success

The debit happens after the response ships, and only when the status is under 400. A failed upstream, a validation error, a miss — none of them cost a token. The ledger says what every token bought.

How the wallet works →

GET/wallet/balancefree

{
  "status": "success",
  "balance": 984,
  "currency": "tokens",
  "freeGrant": { "tokens": 1000 }
}

A thousand free tokens, every month, for everyone

Every account is topped back up to 1000 tokens a month — not on the first of the month, but the next time the account is used once a month has passed. Not stockpiled, not expiring paid balance — topped up, so a small product or a weekend script never needs a card. And 69 routes need no key and no wallet at all.

Pricing →

GET/wallet/ledgerfree

{
  "status": "success",
  "entries": [
    { "at": "2026-09-13T08:17:44Z", "action": "CREDIT_SUBSCRIPTION", "tokens": 1000, "note": "monthly free grant" },
    { "at": "2026-09-08T09:41:03Z", "action": "DEBIT", "tokens": -1, "endpoint": "/v1/verify/iban" }
  ]
}

Verify anything a form can ask for

Thirty-six checks: IBAN, SWIFT, VAT, NIP, REGON, PESEL, EORI, LEI, VIN, phone with HLR, e-mail with DNS, addresses, sanctions lists, cards, MRZ, JWTs, webhook signatures. One group, one shape.

The Verify group →

POST/v1/verify/vat1 token

{ "vat": "PL8993033031" }

{
  "status": "success",
  "valid": true,
  "countryCode": "PL",
  "name": "CASTOMO PROSTA SPÓŁKA AKCYJNA",
  "address": "UL. POWSTAŃCÓW ŚLĄSKICH 5/212, 53-332 WROCŁAW",
  "checkedAt": "2026-09-08T09:42:10Z",
  "tokensDeducted": 1
}

Convert, generate and parse without a library

Currencies, colours with WCAG contrast, coordinates, time zones, encodings, data formats; hashes, keypairs, QR codes, screenshots, PDF and DOCX from HTML; receipts, invoices, e-mails and webhooks into structure.

Convert → · Generate → · Parse →

POST/v1/convert/colorfree, no key

{ "color": "#7C4DFF", "comparisonColor": "#FFFFFF" }

{
  "status": "success",
  "tokensDeducted": 0,
  "colorSpaces": { "hex": "#7C4DFF", "rgb": { "r": 124, "g": 77, "b": 255 }, "hsl": { "h": 256, "s": 100, "l": 65 } },
  "luminance": 0.1681,
  "accessibility": { "againstCustom": { "comparisonHex": "#FFFFFF", "contrastRatio": 4.81, "wcag21": { "aaSmallText": true, "aaaSmallText": false } } }
}

The web as an API

One page or a whole site, its images, its favicon, its Google reviews, its tech stack. Search results, keyword research, rivals, cannibalisation, mobile tests. Trends by region and over time. All behind the same key.

Scrape → · SERP → · Trends →

POST/v1/serp/searchfrom 60 tokens

{ "query": "royalty free media api", "country": "pl", "respSize": 10 }

{
  "status": "success",
  "results": [
    { "position": 1, "title": "castomAPI Media", "url": "https://media.castomapi.com/" },
    { "position": 2, "title": "…", "url": "…" }
  ],
  "tokensDeducted": 60
}

30 integrations, each through the customer's own account

Shopify, Google Workspace, Microsoft 365, Instagram, Slack, Discord, Notion, Asana, Trello, Calendly, Typeform, HubSpot, Salesforce, Netlify, Cloudflare and more. Every one connects through OAuth to the end user's own account, so the rate limit is theirs and no tenant ever sees another's data. A few are still limited — TikTok is sandbox only, Pinterest is read-only, Facebook is open to our tester accounts while Meta reviews the app — and every integration page says so.

All integrations →

GET/v1/shopify/auth/statusfree

{
  "status": "success",
  "connected": true,
  "shop": "your-store.myshopify.com",
  "scopes": ["read_products", "write_products", "read_orders"],
  "connectedAt": "2026-08-30T14:02:11Z"
}

Your own endpoints, sandboxed and billed like the rest

Upload a script that defines main(req); it gets a URL at /c/your-slug. It runs in an isolated V8 per request — 2 seconds of CPU, 128 MB, a fetch that refuses private addresses — and costs tokens from the same wallet.

Custom endpoints →

POST/custom/endpointsmetered

{
  "slug": "vat-and-iban",
  "script": "async function main(req) { const v = await $safeFetch('https://app.castomapi.com/v1/verify/vat', {method:'POST', body: JSON.stringify({vat: req.body.vat})}); return { ok: v.ok }; }"
}

{ "status": "success", "url": "https://app.castomapi.com/c/vat-and-iban", "tokensDeducted": 1 }

Export to n8n and Make; Zapier and MCP built in

One call generates native community node packages for n8n and Make from any set of endpoints. Zapier hooks, batches and async jobs are a group of their own. An MCP server exposes the whole catalogue to any agent as tools.

Ecosystem export → · Zapier → · MCP →

POST/v1/ecosystem/export5 tokens

{ "target": "n8n", "endpoints": ["/v1/verify/iban", "/v1/convert/currency"] }

{
  "status": "success",
  "package": "n8n-nodes-castomapi-1.0.0.tgz",
  "nodes": 2,
  "downloadUrl": "https://assets.castomapi.com/exports/…",
  "tokensDeducted": 5
}

Accounts, billing, payments and bookings are services, not chores

Auth signs your users in. Billing turns a Stripe subscription into an entitlement your product reads. Pay charges a customer on a seller's behalf. Book holds a slot and sends the reminder. A product built here charges money on day one.

The platform services →

POSTbilling.castomapi.com/v1/checkoutfree

{ "product": "my-product", "plan": "pro" }

{
  "status": "success",
  "checkoutUrl": "https://checkout.stripe.com/c/pay/cs_live_…",
  "expiresAt": "2026-09-08T10:42:00Z"
}

Reference data and events, free, no key

Countries, currencies, languages, time zones, ports, airports, HS codes, units — tens of millions of records at data.castomapi.com, GET only, CORS open. Public events by place and date at events.castomapi.com. The tables nobody wants to maintain, maintained.

Data → · Events →

GETdata.castomapi.com/v1/countries/en/PLfree

{
  "status": "success",
  "lang": "en",
  "data": { "code": "PL", "name": "Poland", "capital": "Warsaw", "region": "Europe", "subregion": "Eastern Europe",
             "isoAlpha3": "POL", "isoNumeric": "616", "currency": "PLN", "phoneCode": "+48" }
}

Built for the products you already use

dash-b's live widgets read from here. castomFlow makes every endpoint a step. castomUI, FABLS and clickSomo generate, publish and send through it. castoMIND assembles whole products from it. If you use any of them, your castomAPI account already exists — and your wallet is the same one.

The ecosystem →

castomo dash-b castomUI castomFlow clickSomo FABLS castoMIND iKonekt 3Dbuilder Aperture Observer

Security that is written down and measured

Custom code runs in isolated V8 with a network policy that refuses private ranges and re-validates every redirect hop. A miss answers 404 with zero cost and is byte-identical for a resource that is not yours. OAuth tokens are stored encrypted, refreshed on demand, and consent is scoped per project.

Security →

GET/c/{someone-elses-slug}free

{
  "status": "error",
  "code": "NOT_FOUND",
  "message": "The requested endpoint does not exist.",
  "statusCode": 404
}

Limits you can read before you hit them

60 requests a minute on the free tier, 300 on Pro, 1200 on Enterprise — per account, across every endpoint. Over the line you get a 429 and a header saying when to try again, not a silent drop.

Rate limits in the docs →

POST/v1/…not billed

HTTP/1.1 429 Too Many Requests
retry-after: 12
x-ratelimit-limit: 60
x-ratelimit-remaining: 0

An EU company, and a site that proves what it says

Castomo P.S.A., Wrocław, KRS 0001188843. The services run on EU boxes. This website loads scripts only from this site and two services run by Castomo (our own Observer analytics and the chat button), sets no cookie and serves its own fonts. Observer counts visits and stores nothing on your device; the content security policy on every page makes the script rule a fact the browser enforces, not a sentence in a policy.

Privacy → · About →

Content-Security-Policy

default-src 'self';
script-src 'self' 'sha256-…' https://observer.castomo.com https://chat.castomapi.com;
connect-src 'self' https://observer.castomo.com https://chat.castomapi.com;
frame-src https://chat.castomapi.com;
font-src 'self';
object-src 'none'

It is live, and you can check

Every service answers a health route, and the status page records what each one answered when this site was built — with the date, because a snapshot that pretends to be live is worse than none.

Status → · In numbers →

GET/healthfree

{ "status": "ok", "service": "castomapi", "uptime": 1180234 }

The catalogue

48 groups, in nine clusters

Utilities take an input and answer. Integrations reach a platform through the customer's own connection. Every group has a page, and every operation in it has a page with a tester.

Two kinds of developer, one account

Building your own, or using ours?

For developers building a product

One key, one wallet, one bill. Auth, billing and payments as services. Custom endpoints when the catalogue is not enough. Export to n8n, Make and Zapier when your customers want it there.

For people using dash-b, castomo and the family

Your account is already a castomAPI account. Every live widget, every workflow step, every generated page draws from the same wallet — and you can call the API yourself with the same key.

Get your key.
The first thousand tokens are on us, every month.

One sign-in, one wallet, 706 endpoints. The dashboard mints the key; the docs run every call live.

Get your key Open the live docs