GETMethod GET/01/{gtin}/10/{lot}

You send the GTIN of a model and the number of one of its production batches, and you receive a redirect to the public page of that batch's passport. It is the address of a batch, the one that batch QR codes already printed carry. When you leave this page, you will know how to write that link, how to read the redirect, and what the server does when the batch has no passport yet.

Full address:

GET https://api.sealtrust.io/01/{gtin}/10/{lot}

#Authorization

None, public endpoint. This endpoint answers without an API key, without an account and without a session cookie.

#Rate limit

This endpoint shares the limit of the /01/ family: 60 calls per 60 seconds, counted per calling IP address, all /01/ paths together. Every response carries the X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers. Beyond that, the response is a 429 with Retry-After.

#Path and query parameters

The lot number is compared exactly, case included: LOT-26A and lot-26a are two different batches, as GS1 provides. It is at most twenty characters, taken from the GS1 character set: ASCII letters, digits and ! " & ' ( ) * + , - . : ; < = > ? _. Encode in the address the characters that need it, for example %3F for ?. The slash and the % sign, allowed by GS1, are not accepted here: a path cannot carry the first, and the second can no longer be told apart from an encoded character once the page has read the address. The console refuses to create the passport of such a batch.

This endpoint reads no query parameter.

The language of the landing page is chosen as for /01/{gtin}: your Accept-Language header first, then the brand's language on its own domain, otherwise en. The response carries Vary: Accept-Language.

#Request body

None. This request has no body.

#Example request

Resolution of batch LOT-26A of GTIN 03701234567891. The redirect is not followed, so that the Location header can be read.

curl -i -H "Accept-Language: fr" "https://api.sealtrust.io/01/03701234567891/10/LOT-26A"

const gtin = "03701234567891";
const lot = "LOT-26A";

const response = await fetch(
  `https://api.sealtrust.io/01/${gtin}/10/${encodeURIComponent(lot)}`,
  { method: "GET", redirect: "manual", headers: { "Accept-Language": "fr" } },
);

console.log(response.status);
console.log(response.headers.get("location"));

from urllib.parse import quote

import requests

gtin = "03701234567891"
lot = "LOT-26A"

response = requests.get(
    f"https://api.sealtrust.io/01/{gtin}/10/{quote(lot, safe='')}",
    headers={"Accept-Language": "fr"},
    allow_redirects=False,
    timeout=30,
)

print(response.status_code)
print(response.headers["Location"])

#Example response

HTTP code 302, when the batch has a published passport. The response has no body.

HTTP/1.1 302 Found
Location: https://sealtrust.io/fr/passport/01/03701234567891/10/LOT-26A
Vary: Accept-Language
Content-Length: 0

When the batch has no published passport, the same request resolves to the model's passport.

HTTP/1.1 302 Found
Location: https://sealtrust.io/fr/passport/01/03701234567891
Vary: Accept-Language
Content-Length: 0

Read the Location header and follow it. This endpoint emits a single hop, the language being already resolved.

#Where the brand comes from

The server finds the batch from the data alone: the models that carry this GTIN, then, among their batches, the one that carries this number. It never uses the request's host to choose a brand. On a brand's verified domain name, the redirect stays on that domain, and a batch belonging to another brand answers 404.

If the same GTIN and the same lot number publish a passport in several brands, the server does not choose: it resolves to the model level, which applies the same rule. The console refuses to publish a batch passport that would create that situation.

A GTIN belongs to one brand. If the batch belongs to a brand other than the one that publishes the model passport of this GTIN, it does not answer under that code: the redirect leads to the model passport, the one of the brand that publishes the GTIN. The console also refuses to publish such a batch passport.

#The scan is counted, keeping nothing of the reader

Every GET call made by a browser that leads to a passport adds one to that passport's number of scans for the current month. Not counted: robots and link previews, HEAD requests, and a link that leads nowhere. No address, no country and no time are kept: only the number of scans per passport and per month exists. The brand reads it by model and by lot. The current month is completed every ten minutes.

#When the brand shows its passports at a partner's

A brand, or its reseller, can show its passports in a partner's page, see Show the passport in your page. When it has switched this on in the console, this address answers 302 to the partner's page instead of ours, with the parameters level (which is lot), gtin and lot and lang. A request that carries ?linkType=dpp still gets our passport.

#Errors

A browser, which asks for text/html in its Accept header, receives a short page in its language instead of JSON: same status, and the same text for every error, so it reveals nothing more than the JSON does. A program that asks for JSON, or sends no Accept header, receives the bodies described below.

The body of an error response contains a single field, detail.

#See also

• GET /passport/01/{gtin}/10/{lot}, read the published passport of a batch.
• GET /01/{gtin}, resolve the link of a model.
• Physical identification, QR and NFC, choose the physical carrier and the exact form of the link.