GETMethod GET/certificate/{identifier}

You are reading a product's certificate of authenticity. When you leave this page, you will know which identifier to send, how to read the certificate status, and which responses to expect when the product or the certificate does not exist.

Full address:

GET https://api.sealtrust.io/v1/certificate/{identifier}

The same endpoint also answers without the /v1 prefix, at https://api.sealtrust.io/certificate/{identifier}. Both addresses call the same code. Use the /v1 form for a new integration.

#Authorization

None, public endpoint. Send neither an API key nor a session token.

The response carries no internal brand or product identifier. It gives the certificate number, the status, the dates, the product name, the brand name and its styling. It gives no brand number, no product number, no contract address and no owner address.

#Rate limit

600 calls per 60-second window, counted per IP address.

This counter applies to reading the certificate, with or without the /v1 prefix. Downloading its PDF has its own counter, of 60 calls a minute: building the file costs far more than a read.

Every accepted response carries three headers.

A refusal returns 429 with the same three headers, X-RateLimit-Remaining at 0, and Retry-After equal to 60.

#Path and query parameters

This endpoint has no query parameter.

#The four identifier forms

The server first looks for a certificate number. If it finds none, it looks at the shape of the string: 0x followed by 64 hexadecimal characters is treated as a UID hash, any other shape as a token id. As a last resort it looks for a printed serial number.

The server strips leading and trailing spaces before the lookup, whatever the form.

The server ignores the case of the serial number and brings the characters that are confused when read back to their canonical form before the lookup: I and L count as 1, O counts as 0. So you still find a number copied by hand from a label even if the person typed the letter O where the label carries the digit 0.

#Headers

curl, requests and fetch send */* by default and therefore receive the JSON. The redirect exists so that a certificate link shared and opened in a browser displays the public certificate page.

#Request body

None. This request has no body.

#Example request

Reading the certificate whose number is ST-CERT-000000000000.

curl -i -H "Accept: application/json" https://api.sealtrust.io/v1/certificate/ST-CERT-000000000000

const response = await fetch(
  "https://api.sealtrust.io/v1/certificate/ST-CERT-000000000000",
  {
    method: "GET",
    headers: {
      Accept: "application/json",
    },
  },
);

console.log(response.status);
console.log(response.headers.get("X-RateLimit-Remaining"));
console.log(await response.json());

import requests

response = requests.get(
    "https://api.sealtrust.io/v1/certificate/ST-CERT-000000000000",
    headers={
        "Accept": "application/json",
    },
    timeout=30,
)

print(response.status_code)
print(response.headers["X-RateLimit-Remaining"])
print(response.json())

The TypeScript SDK @sealtrust-io/sdk does not cover this endpoint. The example above uses fetch, available with no dependency.

The three other identifier forms are written the same way.

# UID hash
curl -i -H "Accept: application/json" https://api.sealtrust.io/v1/certificate/0x0000000000000000000000000000000000000000000000000000000000000000

# Token id
curl -i -H "Accept: application/json" https://api.sealtrust.io/v1/certificate/10000000000000000000000000000000000000000000000000000000000000000000000000000

# Printed serial number
curl -i -H "Accept: application/json" https://api.sealtrust.io/v1/certificate/00000000ABCD

#Example response

HTTP code 200.

{
  "certificate_number": "ST-CERT-000000000000",
  "status": "active",
  "issued_at": "2026-03-04T10:22:07.415000Z",
  "expires_at": null,
  "issuer_name": "Exemple SAS",
  "product_name": "Tote bag model 1",
  "brand_name": "Exemple SAS",
  "brand_logo_url": "https://example-sas.test/logo.svg",
  "brand_primary_color": "#1F2937",
  "brand_hide_powered_by": false,
  "brand_public_host": null,
  "brand_served_hosts": [],
  "custom_fields": {
    "atelier": "Atelier 3",
    "matiere": "cuir pleine fleur"
  }
}

The response has twelve fields and nothing else.

#How to read status

The server computes the status at read time. The value stored in the database is not copied as is.

status is either active or revoked.

• A revoked certificate is returned as revoked forever. Revocation is a deliberate act and it prevails over every other rule. No endpoint returns a revoked certificate in the active status.
• Every other certificate is returned as active.

The vocabulary of the API contains a third value, expired. The server computes it at read time from expires_at. Since no certificate carries an end date today, the API does not return it. Accept it in your code to stay robust if it appears one day, and build no business rule on its presence.

#Redirect to the readable page

If your request announces text/html in the Accept header, the response is a 307 whose Location header points to the public certificate page. The server returns no JSON body in that case.

The destination follows the brand: the domain the brand has declared and had verified when it has one, sealtrust.io otherwise. A certificate that cannot be found also redirects, to sealtrust.io, where the page says plainly that it found nothing. A browser therefore never receives a JSON 404 from this endpoint.

#Errors

The body of an error response carries a detail field.

#See also

• GET /certificate/{identifier}/download, download the certificate of authenticity as a PDF.
• GET /p/{serial}, translate the printed serial number into a consumer page address.
• GET /resolve/{identifier}, read in one call everything a product page displays.
• Core concepts, tell a model, a batch and an item apart before ordering a single label.