DEV Community: Ruan Muller

I Built a Resume Analyzer & Job Match Scoring API. Here's How It Works

Ruan Muller — Fri, 17 Apr 2026 15:32:00 +0000

Every job board, HR platform and career coaching app has the same problem, they need to tell candidates whether their resume is any good before a human ever reads it.

Most companies solve this with expensive ATS software. I built an API that does the same thing in one call.

The Problem With Resumes

Most resumes never get seen by a human. They get filtered out by Applicant Tracking Systems, software that scans for keywords, checks formatting and scores the resume before deciding whether to pass it to a recruiter.

The problem is candidates have no idea what these systems are looking for. They submit a resume, hear nothing back, and have no idea why.

This API fixes that. It tells you exactly what an ATS will find, what it will flag as a problem, and what to fix.

What I Built

The Resume Analyzer & Job Match Scoring API, send it resume text and optionally a job description, get back a full analysis.

Input:

{
  "resume_text": "Jane Smith | jane@email.com | linkedin.com/in/janesmith\n\nSUMMARY\nFull Stack Engineer with 5 years experience...\n\nSKILLS\nJavaScript, React, Node.js, Docker, AWS",
  "job_description": "Senior Engineer needed with React, TypeScript, Node.js, Docker, AWS..."
}

Output:

{
  "success": true,
  "data": {
    "overall_score": 79,
    "grade": "B",
    "ats_analysis": {
      "score": 85,
      "checks_passed": 12,
      "total_checks": 14,
      "issues": []
    },
    "job_match": {
      "score": 72,
      "match_level": "Good Match",
      "matched_keywords": ["react", "node.js", "docker", "aws"],
      "missing_keywords": ["typescript", "postgresql"],
      "seniority_level": "senior",
      "required_experience": "5+ years"
    },
    "skills": {
      "technical": ["javascript", "react", "node.js", "docker", "aws"],
      "soft": ["leadership", "communication"],
      "total_count": 7
    },
    "suggestions": [
      {
        "priority": "high",
        "category": "Job Match",
        "message": "Add these missing keywords: typescript, postgresql"
      }
    ]
  }
}

The 5 Endpoints

Method	Endpoint	Description
GET	`/health`	Health check
POST	`/analyze/resume`	ATS score + skills + suggestions
POST	`/analyze/job-match`	Match score vs job description
POST	`/analyze/full`	Everything combined
POST	`/extract/skills`	Skills only — lightweight

The /analyze/full endpoint is the main one for most integrations. It runs ATS analysis and job match scoring in one call and returns everything you need to give a candidate actionable feedback.

How the ATS Score Works

The ATS score runs 14 checks against the resume text:

const checks = {
  hasEmail:            /[\w.-]+@[\w.-]+\.\w{2,}/.test(text),
  hasPhone:            /(\+?\d[\d\s\-().]{7,}\d)/.test(text),
  hasLinkedIn:         /linkedin\.com\/in\//i.test(text),
  hasWorkExperience:   /(experience|employment|position)/i.test(text),
  hasEducation:        /(education|university|degree|bachelor)/i.test(text),
  hasSkillsSection:    /(skills|technologies|competencies)/i.test(text),
  hasSummary:          /(summary|objective|profile)/i.test(text),
  hasBulletPoints:     /[•\-*]\s+\w/.test(text),
  hasQuantifiedResults:/\d+[\s%+]|(increased|improved|reduced)\s+\w+\s+by\s+\d/i.test(text),
  hasActionVerbs:      /(developed|built|led|designed|implemented)/i.test(text),
  hasDates:            /\b(20\d{2}|19\d{2})\b/.test(text),
  lengthOk:            text.length >= 400 && text.length <= 8000,
  // ... more checks
};

Each passed check adds to the score. Each failed check generates a specific issue message telling the candidate exactly what to fix, not just "your resume needs work" but "add quantified achievements like increased sales by 30%".

How Job Matching Works

The job match score compares keywords from the job description against the resume text:

function calculateJobMatch(resumeText, jobDescription) {
  // Extract meaningful words from JD, filter stopwords
  const jobWords = [...new Set(
    jobDescription.toLowerCase()
      .replace(/[^a-z0-9\s]/g, " ")
      .split(/\s+/)
      .filter(w => w.length > 2 && !stopwords.has(w))
  )];

  const matched = jobWords.filter(w => resumeText.toLowerCase().includes(w));
  const missing = jobWords.filter(w => !resumeText.toLowerCase().includes(w));

  return {
    score: Math.round(matched.length / jobWords.length * 100),
    matchedKeywords: matched.slice(0, 20),
    missingKeywords: missing.slice(0, 10),
  };
}

The missing keywords list is the most valuable output, it tells candidates exactly which words to add to their resume to increase their match score before applying.

Skill Extraction

The API checks against a database of 50+ technical skills and 15 soft skills:

const TECH_SKILLS = [
  "javascript", "python", "react", "node.js", "docker",
  "kubernetes", "aws", "postgresql", "mongodb", "typescript",
  // ... 40+ more
];

const SOFT_SKILLS = [
  "leadership", "communication", "teamwork", "project management",
  // ... more
];

This gives HR platforms and job boards a clean structured list of a candidate's skills without any natural language processing overhead.

Who Uses This

Job boards, score every resume automatically when a candidate applies. Filter out resumes below a threshold score before they reach the recruiter.

Resume builders, give users real-time ATS feedback as they write. Show them their score improving as they add sections and keywords.

Career coaching apps, let coaches upload a client's resume and a target job description and instantly see the gap.

HR platforms, pre-screen large volumes of applications and rank candidates by ATS score and job match before human review.

ATS Score Guide

Score	Grade	Meaning
85-100	A	Ready to submit
70-84	B	Minor improvements needed
55-69	C	Several issues to fix
40-54	D	Major revision needed
0-39	F	Complete rewrite recommended

Tech Stack

Runtime: Node.js + Express
Hosting: Railway
Marketplace: RapidAPI
Zero external dependencies for the analysis logic, pure regex and text matching

No AI costs. No third-party APIs. The whole thing runs for less than $5/month.

Why I Built This

I am a developer from South Africa studying for my Bachelor of Accounting. I have been building and listing APIs on RapidAPI as a way to generate passive income while studying.

The accounting background actually helped here, I understood exactly what hiring managers and HR teams care about when screening candidates. That domain knowledge made the ATS checks more accurate than a purely technical approach would have been.

Try It

Live on RapidAPI, search Resume Analyzer Job Match to find it.

Free tier available — 10 requests/month, no credit card required.

If you are building a job board, HR tool or career app and want to integrate resume scoring, this is the fastest way to get it done.

Built in South Africa. Sold globally.

I Built a Phone Number Validator & Formatter API for 50+ Countries — Day 6 of 21

Ruan Muller — Wed, 15 Apr 2026 18:52:25 +0000

Day 6 of my 21-day API challenge is done.

Yesterday I built an Email Validator. Today I built a Phone Number Formatter & Validator API — validate any international phone number, detect the country, classify the number type and format it in E.164, international and national formats.

Previous days:

The Problem

Every CRM, contact form and SMS platform needs phone validation. The challenge is that phone numbers are wildly inconsistent:

+27 82 123 4567 — South African mobile with spaces
(212) 555-1234 — US format with brackets
07911 123456 — UK local format with leading zero
+49 151 234 56789 — German mobile international format

Every developer ends up writing their own messy regex that handles their home country fine but breaks on international numbers. I packaged a proper solution into a clean API.

What I Built

The Phone Number Formatter & Validator API — send it any phone number, get back a full analysis.

Input:

{
  "phone": "+27821234567"
}

Output:

{
  "success": true,
  "data": {
    "is_valid": true,
    "original": "+27821234567",
    "country_code": "ZA",
    "country": "South Africa",
    "dial_code": "+27",
    "number_type": "mobile",
    "local_number": "821234567",
    "formats": {
      "e164": "+27821234567",
      "international": "+27 821 234 567",
      "national": "082 123 4567"
    }
  }
}

The 6 Endpoints

Method	Endpoint	Description
GET	`/health`	Health check
POST	`/validate`	Full phone analysis
POST	`/validate/batch`	Validate up to 50 numbers at once
POST	`/format`	Format in all three formats
POST	`/extract`	Extract phone numbers from text
GET	`/countries`	List all 50+ supported countries

How Country Detection Works

The core of the API is a country database mapping dial codes to country info:

const COUNTRIES = {
  "27":  { code: "ZA", name: "South Africa",   min: 9,  max: 9  },
  "1":   { code: "US", name: "United States",   min: 10, max: 10 },
  "44":  { code: "GB", name: "United Kingdom",  min: 10, max: 10 },
  "49":  { code: "DE", name: "Germany",          min: 10, max: 11 },
  "61":  { code: "AU", name: "Australia",        min: 9,  max: 9  },
  // ... 45+ more countries
};

Detection tries the longest prefix first — 3 digits, then 2, then 1:

function detectCountry(digits) {
  for (const len of [3, 2, 1]) {
    const prefix = digits.slice(0, len);
    if (COUNTRIES[prefix]) {
      return { dialCode: prefix, country: COUNTRIES[prefix] };
    }
  }
  return null;
}

This matters because 1 (US/Canada), 44 (UK) and 353 (Ireland) all start differently and need to be checked longest-first to avoid mismatches.

Number Type Classification

The API classifies numbers as mobile, landline, toll-free or premium:

const mobilePatterns = {
  "27": /^[6-8]/,     // ZA: 06x, 07x, 08x
  "44": /^7/,         // UK: 07x
  "1":  /^\d{10}$/,   // US: all 10-digit
  "49": /^1[5-7]/,    // DE: 015x, 016x, 017x
  "61": /^4/,         // AU: 04x
  "91": /^[6-9]/,     // IN: 6-9
};

function classifyNumberType(digits, dialCode) {
  const local   = digits.slice(dialCode.length);
  const pattern = mobilePatterns[dialCode];
  if (pattern && pattern.test(local)) return "mobile";

  // Toll-free detection
  if (dialCode === "1" && /^(800|888|877|866)/.test(local)) return "toll_free";

  return "landline";
}

Three Output Formats

Every valid number gets returned in three formats:

E.164 — the international standard used by databases and APIs:

+27821234567

International — human-readable with spaces:

+27 821 234 567

National — local format with leading zero:

082 123 4567

The default_country Parameter

If a user types a local number without a country code, you can pass their country:

{
  "phone": "0821234567",
  "default_country": "ZA"
}

The API strips the leading zero and prepends the South African dial code automatically.

Batch Validation

The /validate/batch endpoint validates up to 50 numbers and returns a summary:

{
  "summary": {
    "total": 3,
    "valid": 3,
    "invalid": 0,
    "mobile": 2,
    "landline": 1,
    "countries_found": {
      "ZA": 1,
      "US": 1,
      "GB": 1
    }
  }
}

Useful for importing contact lists, auditing CRM data or validating bulk SMS recipient lists.

Why I Included South Africa

I'm a self-taught developer from South Africa. South African numbers follow the format +27 followed by 9 digits, with mobile numbers starting with 6, 7 or 8.

Most phone APIs either don't support ZA at all or get the mobile detection wrong. I made sure it works correctly.

Tech Stack

Runtime: Node.js + Express
Hosting: Railway (free tier)
Marketplace: RapidAPI
Dependencies: express, cors, helmet, morgan, express-rate-limit

Zero paid APIs. Zero external calls. Pure in-memory validation.

Try It

Live on RapidAPI — search Phone Number Formatter Validator or find me at https://rapidapi.com/user/ruanmul04.

Free tier: 10 requests/month. No credit card required.

What's Next

Day 7 tomorrow — URL Safety & Metadata Checker API.

Send it any URL and get back safety analysis, metadata extraction, redirect detection and domain info. Perfect for link shorteners, security tools and browser extensions.

Follow me here on dev.to to catch every day of the challenge. 🇿🇦

21 APIs in 21 days. Built in South Africa. Sold globally.

I Built an Email Validator & Disposable Email Checker API - Day 5 of 21

Ruan Muller — Tue, 14 Apr 2026 08:42:57 +0000

Day 5 of my 21-day API challenge is done.

Yesterday I built a Text Readability Scorer. Today I built an Email Validator & Disposable Email Checker API — validate any email address and detect fake, throwaway and role-based emails instantly.

Previous days:

The Problem

Every app with a signup form has the same problem — fake emails.

Users sign up with throwaway addresses from Mailinator, Guerrilla Mail or one of hundreds of other disposable email providers. They get access to your free tier, abuse it, then disappear. Your marketing metrics get inflated, your email deliverability drops and you waste money sending campaigns to addresses that don't exist.

The fix is simple — check the email before you accept it.

What I Built

The Email Validator & Disposable Email Checker API — send it an email, get back a full analysis.

Input:

{
  "email": "test@mailinator.com"
}

Output:

{
  "success": true,
  "data": {
    "email": "test@mailinator.com",
    "is_valid": true,
    "format_valid": true,
    "is_disposable": true,
    "is_free_provider": false,
    "is_role_based": false,
    "is_business": false,
    "has_plus_tag": false,
    "risk_score": 80,
    "risk_level": "high",
    "parts": {
      "local": "test",
      "domain": "mailinator.com",
      "tld": "com"
    },
    "suggestions": [
      "This is a disposable email — block it to prevent fake signups"
    ]
  }
}

And for a legitimate business email:

{
  "email": "ruan@mycompany.co.za",
  "is_valid": true,
  "is_disposable": false,
  "is_business": true,
  "risk_score": 0,
  "risk_level": "low"
}

The 6 Endpoints

Method	Endpoint	Description
GET	`/health`	Health check
POST	`/validate`	Full email analysis
POST	`/validate/batch`	Validate up to 50 emails at once
POST	`/check/disposable`	Quick disposable check only
POST	`/check/format`	Format validation only
POST	`/extract`	Extract all emails from a block of text

The /extract endpoint is my favourite — send it any block of text and it finds and validates every email address in it. Useful for processing documents, contact pages or scraped content.

How Format Validation Works

Email format validation is more complex than most developers realise. The RFC 5321 standard has dozens of rules. Here are the key ones I check:

function validateEmailFormat(email) {
  const errors = [];
  const trimmed = email.trim().toLowerCase();

  // Must have exactly one @
  const atCount = (trimmed.match(/@/g) || []).length;
  if (atCount === 0) errors.push("Missing @ symbol");
  if (atCount > 1)   errors.push("Multiple @ symbols found");

  const [local, domain] = trimmed.split("@");

  // Local part rules
  if (local.length > 64)      errors.push("Local part exceeds 64 characters");
  if (local.startsWith("."))  errors.push("Local part cannot start with a dot");
  if (local.endsWith("."))    errors.push("Local part cannot end with a dot");
  if (local.includes(".."))   errors.push("Cannot contain consecutive dots");

  // Domain rules
  if (!domain.includes("."))  errors.push("Domain must contain at least one dot");
  if (domain.startsWith(".")) errors.push("Domain cannot start with a dot");

  // TLD must be letters only, 2-24 chars
  const tld = domain.split(".").pop();
  if (!/^[a-zA-Z]+$/.test(tld)) errors.push("TLD must contain only letters");

  return { valid: errors.length === 0, errors };
}

The API returns specific error messages — not just "invalid email" but exactly what is wrong. That's useful for showing helpful validation messages in your UI.

Disposable Email Detection

The database contains 500+ known disposable email domains. The check is a simple Set lookup — O(1) performance regardless of database size:

const DISPOSABLE_DOMAINS = new Set([
  "mailinator.com",
  "guerrillamail.com",
  "tempmail.com",
  "10minutemail.com",
  "yopmail.com",
  // ... 495 more
]);

const isDisposable = DISPOSABLE_DOMAINS.has(domain);

Using a Set instead of an array means the lookup is instant even with thousands of domains.

Risk Scoring

The API calculates a risk score from 0 to 100:

let riskScore = 0;
if (isDisposable) riskScore += 80;  // Major red flag
if (isRoleBased)  riskScore += 20;  // Minor concern
if (hasPlusTag)   riskScore += 10;  // Worth noting
riskScore = Math.min(100, riskScore);

Score	Level	Action
0-39	Low	Accept
40-79	Medium	Flag for review
80-100	High	Block

Role-Based Email Detection

Role-based emails like admin@, support@, info@ and sales@ belong to teams rather than individuals. They are technically valid but often not what you want for personal user accounts:

const ROLE_PREFIXES = new Set([
  "admin","administrator","webmaster","support","help","info",
  "contact","sales","marketing","billing","noreply","no-reply",
  // ... more
]);

const isRoleBased = ROLE_PREFIXES.has(local.split(/[.+_-]/)[0]);

The Batch Endpoint

The /validate/batch endpoint handles up to 50 emails at once and returns a summary:

{
  "summary": {
    "total": 3,
    "valid": 3,
    "invalid": 0,
    "disposable": 1,
    "role_based": 1,
    "business": 1,
    "free_provider": 1,
    "deliverability_rate": 100
  }
}

The deliverability_rate tells you what percentage of emails in the list are likely to actually receive mail. Useful for auditing existing email lists before a campaign.

Tech Stack

Runtime: Node.js + Express
Hosting: Railway (free tier)
Marketplace: RapidAPI
Dependencies: express, cors, helmet, morgan, express-rate-limit

Zero paid APIs. Zero external calls. Pure in-memory validation — fast and cheap to run.

Try It

Live on RapidAPI — search Email Validator Disposable Checker or find me at https://rapidapi.com/user/ruanmul04.

Free tier: 10 requests/month. No credit card required.

What's Next

Day 6 tomorrow — Phone Number Formatter & Validator API.

Every CRM and contact form needs phone validation. I will build format checking, country detection, number type detection and formatting for international numbers.

Follow me here on dev.to to catch every day of the challenge. 🇿🇦

21 APIs in 21 days. Built in South Africa. Sold globally.

I Built a Text Readability Scorer API with Flesch-Kincaid, Gunning Fog and More — Day 4 of 21

Ruan Muller — Mon, 13 Apr 2026 08:04:46 +0000

Day 4 of my 21-day API challenge is done.

Yesterday I built a VAT Number Validator. Today I built a Text Readability Scorer API — analyze any text and get back Flesch-Kincaid scores, grade level, reading time, vocabulary analysis and improvement suggestions.

Previous days:

The Problem

Every content platform, SEO tool and email marketing app needs to know how readable their text is. The question developers always ask:

Is this blog post too complex for a general audience?
What grade level is this email written at?
How long will it take to read this article?
Is this text full of passive voice and hedge words?

Building these algorithms from scratch takes time and the formulas are fiddly to get right. So I packaged all of it into one clean API.

What I Built

The Text Readability Scorer API — send it any text, get back a full readability report.

Input:

{
  "text": "The quick brown fox jumps over the lazy dog. This is a simple sentence. Reading should be easy and enjoyable for everyone. Short sentences help readers understand content faster."
}

Output:

{
  "success": true,
  "data": {
    "scores": {
      "flesch_reading_ease": 72.6,
      "flesch_kincaid_grade": 5.2,
      "gunning_fog_index": 6.8,
      "smog_index": 5.1,
      "coleman_liau_index": 7.3,
      "average_grade_level": 7
    },
    "interpretation": {
      "reading_ease_label": "Fairly Easy — readable by 7th grade",
      "grade_level_label": "Middle School",
      "reading_time": "10 seconds",
      "target_audience": "General public"
    },
    "style": {
      "passive_voice_count": 0,
      "passive_voice_percent": 0,
      "complex_words": 2,
      "complex_word_percent": 5.6
    },
    "suggestions": []
  }
}

The 6 Endpoints

Method	Endpoint	Description
GET	`/health`	Health check
POST	`/analyze`	Full analysis — all fields
POST	`/analyze/scores`	Readability scores only
POST	`/analyze/stats`	Text statistics only
POST	`/analyze/vocabulary`	Vocabulary analysis only
POST	`/compare`	Compare two texts side by side

The lightweight endpoints are useful for high-volume pipelines. If you only need the reading ease score, call /analyze/scores instead of the full /analyze endpoint.

The Algorithms

1. Flesch Reading Ease (0-100)

The most widely used readability formula. Higher = easier to read.

const readingEase = 206.835
  - (1.015  * avgWordsPerSentence)
  - (84.6   * avgSyllablesPerWord);

Score	Level
90-100	Very Easy
70-80	Fairly Easy
60-70	Standard
30-50	Difficult
0-30	Very Difficult

2. Flesch-Kincaid Grade Level

Converts the reading ease score into a US school grade level.

const gradeLevel = (0.39  * avgWordsPerSentence)
                 + (11.8  * avgSyllablesPerWord)
                 - 15.59;

3. Gunning Fog Index

Estimates the years of formal education needed to understand the text on first reading.

const fog = 0.4 * (avgWordsPerSentence + percentComplexWords);

Complex words are defined as words with 3 or more syllables.

4. Coleman-Liau Index

Unlike the others this formula uses characters instead of syllables — making it more consistent across different texts.

const L   = (charsNoSpaces / words) * 100;
const S   = (sentences / words) * 100;
const cli = (0.0588 * L) - (0.296 * S) - 15.8;

Syllable Counting

The trickiest part of the whole API. English syllable counting is notoriously difficult because of all the exceptions.

My approach:

function countSyllables(word) {
  word = word.toLowerCase().replace(/[^a-z]/g, "");
  if (word.length <= 2) return 1;

  // Remove silent endings
  word = word.replace(/(?:[^laeiouy]es|ed|[^laeiouy]e)$/, "");
  word = word.replace(/^y/, "");

  // Count vowel groups
  const matches = word.match(/[aeiouy]{1,2}/g);
  return matches ? matches.length : 1;
}

It handles the most common cases well — not perfect for every word in English but accurate enough for readability scoring purposes.

Passive Voice Detection

function countPassiveVoice(text) {
  // Look for "to be" verb + past participle pattern
  const passivePattern = /\b(was|were|been|being|is|are|am|be)\s+\w+ed\b/gi;
  const matches = text.match(passivePattern) || [];
  return matches.length;
}

The API flags passive voice because it's one of the most common writing problems. Active voice is clearer and more engaging.

Vocabulary Analysis

The /analyze/vocabulary endpoint returns:

{
  "unique_words": 28,
  "lexical_diversity": 0.78,
  "long_words": 3,
  "short_words": 12,
  "transition_words": 2,
  "hedge_words": 1,
  "top_words": [
    { "word": "the", "count": 4 },
    { "word": "is", "count": 2 }
  ]
}

Lexical diversity is the ratio of unique words to total words. A score close to 1.0 means very varied vocabulary. A score close to 0 means lots of repetition.

The Compare Endpoint

My favourite endpoint. Send two versions of the same text and find out which is more readable:

{
  "text_a": "The utilization of sophisticated vocabulary and convoluted sentence structures creates significant comprehension difficulties.",
  "text_b": "Using big words and long sentences makes text hard to read."
}

Response:

{
  "text_a": { "flesch_reading_ease": 18.2, "grade_level": 16 },
  "text_b": { "flesch_reading_ease": 74.1, "grade_level": 7  },
  "more_readable": "text_b",
  "ease_difference": 55.9
}

Useful for A/B testing email subject lines, landing page copy or article introductions.

Tech Stack

Runtime: Node.js + Express
Hosting: Railway (free tier)
Marketplace: RapidAPI
Dependencies: express, cors, helmet, morgan, express-rate-limit

Zero paid APIs. Zero AI. Pure math — costs almost nothing to run.

Try It

Live on RapidAPI — search Text Readability Scorer or find me at rapidapi.com/user/ruanmul04.

Free tier: 10 requests/month. No credit card required.

What's Next

Day 5 tomorrow — Email Validator & Disposable Email Checker API.

Every signup form needs email validation. I'll build format checking, disposable email detection and domain validation in one clean API.

Follow me here on dev.to to catch every day of the challenge. 🇿🇦

21 APIs in 21 days. Built in South Africa. Sold globally.

I Built a VAT Number Validator API for 35 Countries - Day 3 of 21

Ruan Muller — Sun, 12 Apr 2026 21:49:22 +0000

Day 3 of my 21-day API challenge is done.

Yesterday I built a Password Strength Scorer. Today I built a VAT Number Validator API - validate VAT numbers for 35 countries, get tax rates, currency info and EU membership status in one call.

If you missed the previous days:

The Problem

Every e-commerce platform selling to European businesses needs VAT validation. It sounds simple but it's surprisingly painful to build:

Every country has a different format
Germany is DE + 9 digits
France is FR + 2 alphanumeric + 9 digits
Netherlands is NL + 9 digits + B + 2 digits
And so on for 27 EU countries plus the UK, Norway, Switzerland and more

Most developers end up copying regex patterns from Stack Overflow and maintaining a messy country-by-country switch statement. I packaged all of that into a clean API.

What I Built

The VAT Number Validator API - send it a VAT number, get back full validation info.

Input:

{
  "vat_number": "DE123456789"
}

Output:

{
  "success": true,
  "data": {
    "vat_number": "DE123456789",
    "country_code": "DE",
    "country": "Germany",
    "is_valid": true,
    "format_valid": true,
    "format_expected": "DE#########",
    "eu_member": true,
    "tax_info": {
      "standard_rate": 19,
      "reduced_rates": [7],
      "currency": "EUR"
    },
    "validation_note": "Format is valid"
  }
}

And for an invalid number:

{
  "vat_number": "DE123",
  "is_valid": false,
  "validation_note": "Expected format: DE#########"
}

The 6 Endpoints

Method	Endpoint	Description
GET	`/health`	Health check
POST	`/validate`	Validate a single VAT number
POST	`/validate/batch`	Validate up to 20 at once
GET	`/countries`	List all 35 supported countries
GET	`/countries/:code`	Get info for a specific country
POST	`/format`	Clean and normalize a VAT number

The /validate/batch endpoint is particularly useful for platforms doing bulk customer verification — validate an entire customer list in one API call instead of looping through one by one.

The Countries Database

The core of this API is a rules database with validation patterns for every supported country:

const VAT_RULES = {
  DE: {
    country:       "Germany",
    pattern:       /^DE\d{9}$/,
    format:        "DE#########",
    standard_rate: 19,
    reduced_rates: [7],
    currency:      "EUR",
    eu_member:     true,
  },
  ZA: {
    country:       "South Africa",
    pattern:       /^ZA4\d{9}$/,
    format:        "ZA4#########",
    standard_rate: 15,
    reduced_rates: [0],
    currency:      "ZAR",
    eu_member:     false,
  },
  // ... 33 more countries
};

The validation is then a simple pattern match:

function validateFormat(vat) {
  const normalized = vat.toUpperCase().replace(/[\s\-\.]/g, "");
  const countryCode = normalized.slice(0, 2);
  const rule = VAT_RULES[countryCode];

  if (!rule) return { valid: false, reason: "Unknown country prefix" };

  return {
    valid:  rule.pattern.test(normalized),
    reason: rule.pattern.test(normalized) ? "Format is valid" : `Expected: ${rule.format}`,
  };
}

Supported Countries

All 27 EU Members:
Austria, Belgium, Bulgaria, Cyprus, Czech Republic, Germany, Denmark, Estonia, Greece, Spain, Finland, France, Croatia, Hungary, Ireland, Italy, Lithuania, Luxembourg, Latvia, Malta, Netherlands, Poland, Portugal, Romania, Sweden, Slovenia, Slovakia

Plus 8 Non-EU Countries:
United Kingdom, Norway, Switzerland, South Africa, Australia, New Zealand, India, Singapore, Canada

Why I Included South Africa

I'm a developer from South Africa studying accounting. South African VAT runs at 15% and every local e-commerce business dealing with international customers needs this.

Most VAT APIs focus exclusively on EU countries and completely ignore the rest of the world. That's a gap worth filling.

The Batch Endpoint

The /validate/batch endpoint validates up to 20 VAT numbers at once and returns a summary:

{
  "summary": {
    "total": 4,
    "valid": 3,
    "invalid": 1,
    "eu_numbers": 2,
    "non_eu_numbers": 2
  }
}

Useful for:

Validating customer lists during import
Auditing existing customer databases
B2B onboarding flows where you collect multiple VAT numbers

Tech Stack

Runtime: Node.js + Express
Hosting: Railway (free tier)
Marketplace: RapidAPI
Dependencies: express, cors, helmet, morgan, express-rate-limit

Zero paid APIs. Zero external calls. Pure in-memory validation — which means it's fast and costs almost nothing to run.

Try It

Live on RapidAPI - search VAT Number Validator or find me at Rapid Api.

Free tier: 10 requests/month. No credit card required.

What's Next

Day 4 tomorrow - Text Readability Scorer API.

Every content platform, SEO tool and email marketing app needs to know how readable their text is. Flesch-Kincaid score, grade level, reading time, passive voice percentage - all in one call.

Follow me here on dev.to to catch every day of the challenge. 🇿🇦

21 APIs in 21 days. Built in South Africa. Sold globally.

Day 2 of my 21-day API challenge, built a Password Strength & Security Scorer API

Ruan Muller — Sun, 05 Apr 2026 11:23:59 +0000

Day 2 of my 21-day API challenge is done.

Yesterday I built an Invoice & Receipt Parser API. Today I built a Password Strength & Security Scorer API — a complete password security toolkit that any developer can drop into their signup flow in minutes.

If you missed Day 1, catch up here: https://dev.to/ruanmuller04

The Problem

Every app with a login form needs password validation. Most developers end up writing the same basic checks:

// The lazy version every dev writes at 2am
if (password.length < 8) return "too short";
if (!/[A-Z]/.test(password)) return "needs uppercase";

It works. But it misses so much — common breached passwords, keyboard patterns, crack time estimates, entropy calculations. Building all of that properly takes days.

So I built an API that does it properly in one call.

What I Built

The Password Strength & Security Scorer API — send it a password, get back a full security report.

Input:

{
  "password": "password123"
}

Output:

{
  "success": true,
  "data": {
    "score": 0,
    "grade": "F",
    "strength": "very weak",
    "entropy_bits": 58.5,
    "crack_time": {
      "display": "5 months",
      "online_attack": "58 years",
      "offline_attack": "5 months"
    },
    "patterns": {
      "is_common_password": true,
      "has_sequential_nums": true,
      "ends_with_number": true
    },
    "feedback": [
      "This is one of the most common passwords",
      "Contains sequential numbers (e.g. 123)",
      "Ends with a number — very predictable"
    ],
    "suggestions": [
      "Choose a completely different password",
      "Add uppercase letters (A-Z)",
      "Add symbols (!@#$%^&*)"
    ]
  }
}

And for a strong password:

{
  "password": "K#9mP$vL2@nQ8xR!"
}

{
  "score": 75,
  "grade": "B",
  "strength": "strong",
  "crack_time": { "display": "2 million years" }
}

The 6 Endpoints

Method	Endpoint	Description
GET	`/health`	Health check
POST	`/analyze`	Full password analysis
POST	`/analyze/batch`	Analyze up to 20 passwords at once
POST	`/check/breach`	Check against 500+ breached passwords
POST	`/generate`	Generate strong passwords
POST	`/compare`	Compare two passwords side by side

The /generate endpoint is my favourite — it returns strong passwords with their scores so you can show users exactly how secure the suggested password is.

How the Scoring Works

The score (0-100) is calculated from four components:

1. Length (0-30 points)

6 chars  →  5 pts
8 chars  → 10 pts
12 chars → 20 pts
16 chars → 25 pts
20+ chars → 30 pts

2. Character sets (0-28 points)
Each charset adds 7 points:

Lowercase letters
Uppercase letters
Numbers
Symbols

3. Unique character ratio (0-15 points)
Rewards passwords where characters don't repeat.

4. Entropy (0-15 points)
Calculated as: length × log2(pool_size)

Penalties applied for:

Common passwords: -40 points
Keyboard walks (qwerty, asdfgh): -20 points
Repeated characters (aaa): -10 points
Sequential numbers (123): -10 points
All numbers or all letters: -15 points

Crack Time Estimation

This was the most interesting part to build. The formula:

function estimateCrackTime(password, charsets) {
  let poolSize = 0;
  if (charsets.has_lowercase) poolSize += 26;
  if (charsets.has_uppercase) poolSize += 26;
  if (charsets.has_numbers)   poolSize += 10;
  if (charsets.has_symbols)   poolSize += 32;

  const combinations = Math.pow(poolSize, password.length);

  // Modern GPU: 10 billion guesses/second
  const seconds = combinations / 1e10;

  return formatTime(seconds);
}

The difference between online and offline attacks matters:

Online attack — 10 million/sec (limited by server rate limiting)
Offline attack — 10 billion/sec (attacker has the hash file)

password123 cracks in 5 months offline but 58 years online. That's why rate limiting matters even if your hashing is weak.

Breach Detection

The API checks against the 500 most common breached passwords — the ones that appear in every data breach dump.

const COMMON_PASSWORDS = new Set([
  "password", "123456", "qwerty", "abc123", "monkey",
  "letmein", "trustno1", "dragon", "baseball", "iloveyou",
  // ... 490 more
]);

function checkBreach(password) {
  const is_compromised = COMMON_PASSWORDS.has(password.toLowerCase());
  return {
    is_compromised,
    risk_level: is_compromised ? "critical" : "low",
  };
}

Tech Stack

Runtime: Node.js + Express
Hosting: Railway (free tier)
Marketplace: RapidAPI
Dependencies: express, cors, helmet, morgan, express-rate-limit

Zero paid APIs. Zero AI. The whole thing costs less than $5/month to run.

Score Guide

Score	Grade	Strength
80-100	A	Very Strong
60-79	B	Strong
40-59	C	Moderate
20-39	D	Weak
0-19	F	Very Weak

Recommended minimum for most apps: Grade B (60+)
Recommended for financial apps: Grade A (80+)

Try It

Live on RapidAPI — search Password Strength Security Scorer or find me at rapidapi.com/user/ruanmul04.

Free tier: 10 requests/month. No credit card required.

What's Next

Day 3 tomorrow — VAT Number Validator API.

Every e-commerce platform selling to Europe needs VAT validation. There are almost no good free options on RapidAPI. That's the gap I'm filling tomorrow.

Follow me here on dev.to to catch every day of the challenge. 🇿🇦

21 APIs in 21 days. Built in South Africa. Sold globally.

I Built an Invoice Parser API in One Day

Ruan Muller — Sat, 04 Apr 2026 16:02:23 +0000

I'm a developer from South Africa, currently studying for my Bachelor of Accounting. Today I started a challenge: build and publish a new API every day for 21 days straight.

Day 1 is done. Here's exactly what I built, how it works, and how you can use it.

The Problem:

Every accounting app, expense tracker, and bookkeeping tool has the same pain point, invoices come in as PDFs, images, or plain text, and somebody has to pull the structured data out of them.

Vendor name. Invoice number. Line items. Tax. Total. Due date.

It's repetitive, error-prone work. And every developer building a finance tool ends up writing the same messy regex logic to solve it.

So I built an API that does it for them.

What I Built:

The Invoice & Receipt Parser API — send it raw invoice text, get back clean structured JSON.

Input:

{
  "text": "Acme Corp\nInvoice No: INV-2024-0042\nDate: 15/03/2024\nDue: 15/04/2024\n\nWeb Design Services  2  $1500.00  $3000.00\nSEO Optimization     1   $800.00   $800.00\n\nSubtotal: $3800.00\nVAT 15%:   $570.00\nTotal Due: $4370.00"
}

Output:

{
  "success": true,
  "data": {
    "document_type": "invoice",
    "vendor_name": "Acme Corp",
    "invoice_number": "INV-2024-0042",
    "dates": {
      "invoice_date": "15/03/2024",
      "due_date": "15/04/2024"
    },
    "currency": "USD",
    "totals": {
      "subtotal": 3800,
      "tax_rate": 15,
      "tax_amount": 570,
      "discount": null,
      "shipping": null,
      "total": 4370
    },
    "line_items": [
      {
        "description": "Web Design Services",
        "quantity": 2,
        "unit_price": 1500,
        "amount": 3000
      },
      {
        "description": "SEO Optimization",
        "quantity": 1,
        "unit_price": 800,
        "amount": 800
      }
    ],
    "confidence": {
      "score": 100,
      "level": "high"
    }
  }
}

No AI costs. No third-party dependencies. Pure Node.js, which means near-zero running costs and sub-100ms response times.

The 6 Endpoints

Method	Endpoint	Description
GET	`/health`	Check API is online
POST	`/parse`	Full extraction — all fields
POST	`/parse/totals`	Financial totals only
POST	`/parse/line-items`	Line items only
POST	`/parse/vendor`	Vendor details only
POST	`/validate`	Completeness score + missing fields

The lightweight endpoints are useful for high-volume pipelines where you only need one piece of data and don't want to pay for a full parse every time.

How It Works

The core logic is a chain of regex-based extractors, each one focused on one thing.

function fullParse(text) {
  return {
    document_type:  detectDocType(text),
    vendor_name:    extractVendor(text),
    invoice_number: extractInvoiceNumber(text),
    dates:          extractDates(text),
    currency:       extractCurrency(text),
    totals:         extractTotals(text),
    line_items:     extractLineItems(text),
    payment_info:   extractPaymentInfo(text),
    contact:        extractContact(text),
    confidence:     calculateConfidence(data),
  };
}

Currency detection checks for 25+ currency codes and symbols:

const CURRENCY_CODES = ["USD","EUR","GBP","ZAR","INR",...];

function extractCurrency(text) {
  for (const code of CURRENCY_CODES) {
    if (new RegExp(`\\b${code}\\b`).test(text)) return code;
  }
  if (text.includes("$")) return "USD";
}

One bug I caught during testing, the tax amount extractor was matching 15 from VAT 15% instead of the actual amount 570.00. The fix was requiring a decimal point in the match:

// BROKEN — matches "15" from "VAT 15%"
/(?:vat|tax)[\s:$]*([0-9,. ]+)/i

// FIXED — requires decimal format, skips percentages
/(?:vat|tax)[\s:%\d]*?[\s:$£€]+([0-9,]+\.[0-9]{2})/i

Always test with real messy invoice text before shipping.

Tech Stack

Runtime: Node.js + Express
Hosting: Railway (free tier)
Marketplace: RapidAPI
Dependencies: express, cors, helmet, morgan, express-rate-limit

Zero paid APIs. Zero AI costs. The whole thing costs less than $5/month to run.

Pricing on RapidAPI

Plan	Price	Requests
Free	$0	10/month
Basic	$9.99/mo	500/month
Pro	$29.99/mo	5,000/month

What I Extracted From This Build

My accounting background actually helped here. I knew exactly what fields matter on a real invoice, payment terms, VAT rates, SWIFT codes, IBAN numbers. That domain knowledge made the extractor more accurate than a generic solution would be.

It's a reminder that your background, whatever it is, is an advantage when building in the right niche.

Try It

The API is live on RapidAPI, search for Invoice Receipt Parser or find my profile at [https://rapidapi.com/user/ruanmul04].

Free tier gives you 10 requests/month to test it with your own invoices.

What's Next

Day 2 tomorrow — Password Strength & Security Scorer API.

If you want to follow the 21-day build challenge, follow me here on dev.to. I'll be posting every day with the full breakdown of what I built, why, and how.

Drop a comment if you're building APIs too, always keen to connect with other developers doing the same thing. 🇿🇦

Built in South Africa. Sold globally.