question

The term of the requirement used for the API-only approach is PCI Certification. You can use the Iframe to process the card into an encrypted token, and do the rest with the API. That way you will only need to be compliant and not necessarily certified.

Have a look at this article ( Not affiliated ) describing the difference between certification and compliance.

https://corp.sertifi.com/blog/posts/pci-compliance-vs-pci-certification/#:~:text=PCI%20compliance%20is%20a%20necessity,safe%20from%20hackers%20and%20fraudsters.&text=PCI%20certification%20is%20achieved%20through,proper%20procedures%20to%20protect%20data.