API Documentation

Check a Bangladeshi customer's delivery track record across five couriers with a single request.

Authentication

Every request must include your API key in the X-API-Key header. Generate a key from your dashboard after signing up — it is shown once at creation time and stored hashed afterward, so keep it somewhere safe.

X-API-Key: fcbc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Endpoint

POST https://fraudchecker.worker99.com/api/v1/check

Request Body (JSON)

Field	Type	Required	Description
`phone`	string	Yes	Bangladeshi mobile number, local format: `01[3-9]XXXXXXXX` (11 digits, no `+88`).

Example Request

curl -X POST https://fraudchecker.worker99.com/api/v1/check \
  -H "X-API-Key: fcbc_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Origin: https://yourshop.com" \
  -H "Content-Type: application/json" \
  -d '{"phone": "01712345678"}'

Set the Origin header explicitly. Most server-side HTTP clients (Guzzle, cURL, Node's fetch, etc.) do not send an Origin header by default. If your API key has a whitelisted domain configured, you must set this header yourself on outgoing requests or they will be rejected with 403. If you'd rather skip this, leave the domain field blank when creating the key (server-to-server keys don't require it).

Example Response — Success

{
  "success": true,
  "data": {
    "steadfast": { "success": 3, "cancel": 1, "total": 4, "success_ratio": 75.0 },
    "pathao":    { "success": 5, "cancel": 2, "total": 7, "success_ratio": 71.43 },
    "redx":      { "success": 20, "cancel": 5, "total": 25, "success_ratio": 80.0 },
    "paperfly":  { "success": 0, "cancel": 0, "total": 1, "success_ratio": 0.0 },
    "carrybee":  { "success": 10, "cancel": 0, "total": 10, "success_ratio": 100.0 },
    "aggregate": {
      "total_success": 38,
      "total_cancel": 8,
      "total_deliveries": 46,
      "success_ratio": 82.61,
      "cancel_ratio": 17.39
    }
  }
}

A courier that isn't configured on the server, or that fails to respond, appears as { "error": "..." } in its slot instead of stopping the whole request — the aggregate block only reflects couriers that returned data.

Errors

Status	Meaning	Example Body
401	Missing, invalid, or deactivated API key.	`{"success":false,"error":"Invalid or inactive API key."}`
403	Request's `Origin` (or `Referer`) doesn't match the key's whitelisted domain, or is missing entirely when a domain is set.	`{"success":false,"error":"Request origin is not whitelisted for this API key."}`
422	Phone number missing or not a valid Bangladeshi mobile number.	`{"success":false,"error":"The provided phone number is invalid..."}`
429	Daily lookup limit exceeded for this key. Resets at midnight (server time).	`{"success":false,"error":"Daily request limit exceeded for this API key."}`

Domain Whitelisting

When creating a key, you may whitelist a website domain in any format — they all normalize to the same value:

example.com
http://example.com
https://example.com
https://www.example.com/

All four of the above are treated identically as example.com.

This is a defense-in-depth check, not a security boundary — an API key used in client-side JavaScript is visible in the browser's network tab regardless of domain whitelisting. This API is designed to be called from your backend, which then relays the result to your frontend however you like.

Rate Limits

Each key has a daily lookup limit set by the admin when the key is created. Usage resets automatically at midnight — no action needed on your end. Contact your administrator to raise a key's limit.