APIBox API documentation

APIBox is a set of independent REST endpoints. They all share the same base URL, authentication, quota and error format.

Base URL

https://apibox.io.vn/v1/<endpoint>

GET /v1 lists every endpoint (no key needed).

Authentication

Create a free account in the dashboard to get an API key (it starts with abx_). Send it with every request, preferably in a header:

Authorization: Bearer abx_your_key
# or
X-API-Key: abx_your_key

For URLs used directly in HTML (QR codes, barcodes, placeholders) you can pass ?api_key=abx_your_key. Keys used in public web pages can be seen by visitors: use a separate key and revoke it if it leaks.

Sending parameters

• GET: query string, e.g. /v1/uuid?type=v7&count=5.
• POST JSON: Content-Type: application/json with an object body. Query parameters are merged with the body.
• POST form / multipart: fields and files (file) for the image and PDF endpoints.
• Raw body: some endpoints accept the content itself, e.g. text/html for HTML to Markdown, text/csv for CSV to JSON, or the bytes of an image/PDF.

Default maximum body size: 1 MB (5–6 MB for text conversions). File endpoints: 5 MB on Free, 20 MB on Starter, 50 MB on Pro. Add ?pretty=true to get indented JSON.

Quota and rate limits

Every successful response carries your monthly quota:

X-Quota-Limit: 50000
X-Quota-Remaining: 48211
X-Quota-Reset: 1798761600   (unix time, 1st day of next month UTC)
X-Request-Id: 7Hq2...

The quota resets on the 1st of every month (UTC). Each call counts as one request, whatever the endpoint.

Errors

Errors use HTTP status codes and a JSON body:

{ "error": { "code": "missing_parameter", "message": "Parameter \"url\" is required" } }

Fetching URLs

Endpoints that take a url fetch it with the user agent APIBoxBot, follow up to 8 redirects, time out after 10–20 seconds and refuse private or local addresses.

Reference data and sensitive input

Endpoints built on reference data tell you which version they use. Vietnam provinces & wards returns version, decree (the latest resolution included) and updated in every response; the data follows the official list after the 1 July 2025 reorganisation and is rebuilt when new resolutions are published. WHOIS results are cached for one hour, and lunar dates are computed for Vietnam’s timezone (UTC+7).

Identity and tax numbers sent to CCCD & tax code validator are checked in memory only, never stored or logged. Send them with POST so they do not appear in URLs.

Rules that change by law are stored with their effective dates. Gross ↔ net salary and holidays & working days take the period as a parameter and return the legal reference they used; holiday schedules are marked official once announced and estimated (computed from the Labour Code) before that. Exchange rates come from Vietcombank (today’s table cached 15 minutes, past days 7 days) and from daily mid-market rates for other pairs; they are for reference.

Fake data never contains real people: emails use example domains and generated CCCD / tax codes only have a valid structure. SEO check and SPF / DKIM / DMARC check read public pages and DNS records live (cached 10 and 5 minutes), like security headers, sitemap check and RSS to JSON (10 minutes).

Address parser converts pre-2025 addresses with the same data as the provinces API. TOTP secrets and the texts sent to the profanity filter are processed in memory only and never cached; keep your TOTP secrets encrypted on your side. Passwords sent to the password check and numbers sent to the card validator are never stored, logged or cached; only a 5-character hash prefix leaves our servers for the breach check.

Datasets that come from other sources (provinces and wards, VSIC codes, SWIFT / BIC codes, GS1 barcode prefixes, disposable e-mail domains, the Vietnamese word list) are re-read every week by an automatic job that checks them before replacing the data. Weather forecasts come from MET Norway (CC BY 4.0, keep the attribution) and are cached per location until the source updates.

Secrets sent to the webhook verifier and files sent to the QR reader or the CSV cleaner are processed in memory only. PDFs from the quote & receipt generator are commercial documents, not e-invoices under Decree 123/2020/NĐ-CP. Images sent to the image APIs may have up to 25 megapixels; the broken link checker checks one page per call, a limited number of links depending on your plan. Summaries and language detection run without AI models.

HS codes & tariffs come from the customs tariff workbook published by the VCCI WTO Centre (rebuilt weekly when it changes, later decrees added by hand); they are a lookup aid, check the decrees before declaring goods. Good days apply traditional almanac rules for cultural reference. Spell check and accent restoration use a dictionary, not AI. Office files sent to Excel, Word and PDF tools are processed in memory and never stored. Sitemap generator crawls one site per call, respects robots.txt and stops at the page limit of your plan. Uptime monitors belong to your account: we check the URLs every 5–15 minutes, keep 90 days of incidents and send alerts only to your confirmed e-mail address or your webhook.

The Vietnamese legal calculators (electricity, household tax, registration fee, tax calendar, minimum wage, insurance benefits, retirement) run on hand-entered tables of the decrees in force, return the legal reference and review date with every answer, store nothing you send, and give estimates, not legal or tax advice. The Vietnamese document parsers (e-invoice XML, CCCD QR, BHYT codes) work on the data you send only: nothing is looked up on government portals, stored or logged, signatures are listed but not verified, and the legal tables (TT 91/2026/TT-BTC invoice symbols, BHXH Official Letter 1804/BHXH-QLT of 04/08/2025) are reviewed every six months; name gender guesses use the MIT-licensed duyet/vietnamese-namedb list refreshed weekly. Vietnamese reference APIs (chart of accounts, traffic fines, postcodes, form catalogs, admission scores, marketplace fees) use tables transcribed by hand from the official texts and the platforms' public fee pages, each answer carrying the legal reference and review date; they are a reference, not legal or tax advice, and no request data is stored. The XML, file-type, JSON-to-types and math tools run entirely in memory and store nothing (file-type reads at most the first 64 KB of a URL); holiday rules come from the open date-holidays project (CC BY-SA 4.0, attribution included in every response) and country data from countries-list, i18n-iso-countries and the IANA time zone database, both refreshed weekly. vn-geo uses simplified ward boundaries from the open ThangLeQuoc dataset (MIT, from sapnhap.bando.com.vn), approximate near borders; pdf-sign-verify checks integrity, signer and chain against the CA certificates published by NEAC and the Government CA, without revocation checks; uploaded PDFs and images (barcode-read, pdf-sign-verify) are processed in memory and never stored. Hand-entered legal and fee tables carry the date they were last reviewed and are re-checked on a fixed schedule.

Vietnamese tax and payroll calculators (VAT 8%/10%, PIT finalisation, CIT, foreign contractor tax, late interest, depreciation, budget codes, overtime, annual leave) run on hand-entered legal tables that cite each decree and its effective date; inputs are processed in memory and never stored, and results are estimates, not tax advice. Fee, coordinate, school-grade and major-code endpoints compute from legal tables embedded in the service (each response cites its circular and review date); nothing you send is stored, and results are estimates, not legal or survey advice. The Vietnamese commerce and language tools (bank notifications, statements, orders, PII redaction, teencode, ad wording, sorting, tracking numbers) run in memory and never store the texts or files you send; vn-hanviet uses Unicode Unihan, Wiktionary and CC-CEDICT data (attribution included in every answer), and vn-ad-check / vn-pii-redact are risk-detection aids, not legal advice. The JSON, OpenAPI, fuzzy matching, CIDR, domain and geo tools are pure calculations run in memory and never store your data; MAC vendors (IEEE listings), cloud / Tor / crawler IP ranges (the providers' own published files, refreshed daily) and UN/LOCODE (UNECE, CC BY 4.0) come from official public sources, and ip-intel cannot detect commercial VPNs or residential proxies. The image tools (SVG optimise / sanitise / render, colour palette and BlurHash / ThumbHash, favicon sets, LaTeX math and code images) run entirely in our Worker with a JavaScript renderer and embedded OFL fonts; files are processed in memory and never stored, and rendered images are limited to 5 megapixels. ssl-check and x509 work in memory (certificates and keys are never stored); sites behind Cloudflare are checked from Certificate Transparency logs plus a live HTTPS request, and the response says so. Form submissions and JSON documents are stored in our database for your account, within your plan's limits, until you delete them (form submissions: newest 100 / 2,000 / 10,000 per form; JSON documents: until deleted or their TTL). tech-detect reads one public page without running JavaScript, and vn-streets uses OpenStreetMap data (© OpenStreetMap contributors, ODbL), rebuilt monthly. Exam and document tools process uploads in memory and never store them (quiz parser, exam mixer, Word templates, PDF forms, e-mail parser, timesheet); the ICD-10 list is the Vietnamese text of Thông tư 06/2026/TT-BYT, rebuilt weekly, and random draws are verifiable with a published seed hash.

CORS

All /v1 endpoints send Access-Control-Allow-Origin: *, so they can be called from a browser. Never expose a key with a large quota in public front-end code.

All APIs