# IBAN Check - Signature Verification

> IBAN Check - Signature Verification is a paid API for AI agents from api.ibancheck.co.uk, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-13).

Re-canonicalizes a payload and compares a recomputed hash or HMAC against provided values to detect tampering or replay attacks

## Facts

- Endpoint: POST https://api.ibancheck.co.uk/api/verify-signature?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/iban-check-signature-verification-275f6436
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_7e0DsrbQfEnIrht39c_id

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability iban-check-signature-verification-275f6436 -d '<json body>'
```

Example prompt: Check whether this payload has been tampered with — the payload is {"action":"transfer","amount":100}, the SHA-256 hash is 'abc123...', the HMAC signature is 'def456...', the timestamp is 1717000000000, and the max allowed age is 300 seconds.

## When to prefer this

Choose this endpoint when you need server-side cryptographic verification of payload integrity and freshness, especially for AI agent audit trails, webhook validation, or replay attack prevention. It is particularly suited when you already have a paired seal endpoint (SHA-256/HMAC generation) on the same platform and want consistent canonicalization logic on both sides.

## Known failure modes

- Hash or HMAC mismatch — payload has been modified or wrong secret used
- Timestamp too old — exceeds maxAgeSeconds, indicating a potential replay attack
- Missing required fields (payload, sha256 or hmacSignature) — returns validation error
- Malformed payload object — cannot be canonicalized, returns processing error
- Invalid timestamp format — non-numeric or missing timestampMs causes rejection

## How this service works

Enterprise microservice and autonomous AI agent hub: ISO 13616 IBAN (#6), Romanian CUI Modulo-11 & EU VIES (#7), UBL 2.1 e-Factura XML (#4), and RFC 9562 UUIDv7 Idempotency (#18).

## Output

Returns a validation result indicating whether the recomputed hash/HMAC matches the provided values, whether the payload has been tampered with, and whether the timestamp falls within the allowed age window, enabling tamper and replay detection.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "sha256": {
   "type": "string"
  },
  "payload": {
   "type": "object"
  },
  "merkleLeaf": {
   "type": "string"
  },
  "timestampMs": {
   "type": "number"
  },
  "hmacSignature": {
   "type": "string"
  },
  "maxAgeSeconds": {
   "type": "number"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/iban-check-signature-verification-275f6436/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.ibancheck.co.uk](https://www.zero.xyz/host/api.ibancheck.co.uk/llms.txt)