GETMethod GET/p/{serial}

You turn an item's serial number into the address of the page that presents it to a consumer, through a redirect.

#Authorization

None, public endpoint. We expect neither an API key, nor a session cookie, nor an Authorization header. You can call this address from a server.

#Rate limit

This address has no limit of its own. It falls under the general API counter, counted per calling IP address over a 60-second window, and shared with all the other addresses that have no limit of their own.

Plan for the 429 code in your client and honor the Retry-After header it carries. The value of this counter may change without notice, so hard-code no number in your code.

The response carries the headers X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, the last one giving the reset time in seconds since January 1, 1970. Do not make your client depend on their presence: treat a response that does not carry them as a normal response, and base your call rate on the values you receive.

This address consumes no quota from your plan.

#Path and query parameters

This serial number is the unique product identifier within the meaning of the EN 18219 standard, the one the European digital product passport registry expects, and the one encoded by the QR code printed on your items. The European registry accepts no registration today, from anyone. We will submit this identifier as soon as its registration opens.

This endpoint addresses a physical unit. A passport does not have to cover a unit: the ESPR regulation provides for three levels, the model, the batch and the item. Today we serve the model level and the item level. For a model passport, the identifier to use is GET /01/{gtin}, which resolves the reference passport shared by all the units that carry the same product code. So you do not have to number every unit in order to publish a passport.

The serial number is written in a 32-character alphabet: the digits 0 through 9 and the letters A through Z, except I, L, O and U. Those four letters are set aside because they get confused with digits on a label.

Before any lookup, we clean up the value received: we strip edge spaces, we replace I and L with 1, O with 0, and we put the whole thing in uppercase. So someone retyping a number by hand can get I, L and O wrong with no consequence. We understand ilo2345678ab as 1102345678AB, and it is that corrected form that appears in the destination address. The letter U is not corrected: a value that contains one goes out as a 404.

After this cleanup, we refuse with a 404 any value that is not exactly 12 characters, or that contains a character outside the alphabet. The authentication parameters that some NFC chips add to the address at scan time are query parameters: we do not read them here and they change nothing in the response.

#Request body

None. This is a GET request: everything goes through the path and the query parameters.

#Example request

Do not follow the redirect. What you want to read is the Location header.

#Two addresses for the same route

For a server call, call https://api.sealtrust.io/v1/p/{serial}. The same endpoint also answers without the /v1 prefix. For a new server integration, use the /v1 form.

The QR code we generate for your items, for its part, carries the form without a prefix, on the domain name of your consumer pages, for example https://sealtrust.io/p/{serial}. That is the form that gets printed and that serves as the identifier, because an identifier printed on a label can no longer be corrected.

curl -i https://api.sealtrust.io/v1/p/000000000000 \
  -H "Accept-Language: fr"

const response = await fetch("https://api.sealtrust.io/v1/p/000000000000", {
  headers: { "Accept-Language": "fr" },
  redirect: "manual",
});

console.log(response.status);
console.log(response.headers.get("Location"));

import requests

response = requests.get(
    "https://api.sealtrust.io/v1/p/000000000000",
    headers={"Accept-Language": "fr"},
    allow_redirects=False,
    timeout=30,
)

print(response.status_code)
print(response.headers["Location"])

#Example response

HTTP code 302. The body is empty, all the information is in the Location header.

HTTP/1.1 302 Found
Location: https://sealtrust.io/fr/product/000000000000

With Accept-Language: en-GB,en;q=0.9, the same request returns the English version of the page.

HTTP/1.1 302 Found
Location: https://sealtrust.io/en/product/000000000000

With ?linkType=dpp, the destination becomes the item's passport.

HTTP/1.1 302 Found
Location: https://sealtrust.io/fr/passport/0x0000000000000000000000000000000000000000000000000000000000000000

#How we choose the destination

This endpoint returns no authenticity verdict. We find the item that carries this serial number, then we return the address of the page to display. For a verdict, call GET /qr/verify with the signed parameters of the QR code.

The destination's language comes from the Accept-Language header. We take the first declared language that is French or English. With no header, or with a language we do not serve, we answer with a destination in French.

If you serve your consumer pages on your own domain name, we build the destination on that domain name, over https, and the visitor therefore does not leave your domain.

When several records carry the same serial number, because you have re-minted an item, we answer for the record that is still in the catalog. If there is none, we answer for the most recent one.

#Errors

#See also

• GET /01/{gtin}/21/{serial}, resolve a GS1 link that carries a GTIN and a serial number.
• GET /01/{gtin}, resolve a GS1 link that carries only a GTIN.
• GET /qr/verify, verify an item from a verification address of the older form.
• GET /resolve/{identifier}, read in a single call everything a product page displays.
• Physical identification, QR and NFC, choose the physical carrier and the exact form of the GS1 Digital Link.