GETMethod GET/passport/01/{gtin}

You read the digital passport published for a product model, from its GTIN. The GTIN, Global Trade Item Number, is the trade item number printed under the barcode. By the end of this page, you will know how to retrieve the passport's contents, its version number, its hash and its IPFS copy, and you will know how to request an access tier wider than the public one.

Full address:

GET https://api.sealtrust.io/v1/passport/01/{gtin}

The same endpoint also answers without the /v1 prefix, at https://api.sealtrust.io/passport/01/{gtin}. Both addresses call the same code. Use the /v1 form for a new integration.

#Authorization

None for the public tier, which is the default tier. This endpoint answers without an API key.

The public and end_user tiers answer without an account. The repairer, recycler, upstream and authority tiers require an account. You request a tier through the access_tier parameter described below. You authenticate with a session token presented in Authorization: Bearer <token>, or with the session cookie set at login.

A partner API key gives access to none of these tiers. It is not a session token, it is ignored here, and the response is the one an anonymous caller gets.

#Rate limit

60 calls per 60 second window, counted per calling IP address.

This counter is shared by every address that starts with /passport. The calls you make on the passport of an item and on the proof summaries therefore eat into the same budget.

Every response carries three headers that describe this counter.

This counter is independent of the daily quota of an API key. This call eats into neither that daily quota, nor the monthly product quota of your plan.

#Path and query parameters

#Writing the GTIN

The GTIN you send is reduced to its canonical 14 digit form before the lookup. Every character that is not a digit is removed, then the result is padded with zeros on the left up to 14 digits.

These three spellings therefore designate the same model: 3701234567890, 03701234567890 and 3-701234-567890. They all give the same canonical form, 03701234567890. A value that contains no digit, or that contains more than fourteen, returns 404.

The last digit of a GTIN is a check digit, computed from those that precede it. We check it, and a GTIN whose last digit does not match returns 400. Copy the code printed on the product, digit for digit.

The lookup finds the model even if the brand registered its GTIN in a shorter form, as GTIN-8, GTIN-12 or GTIN-13.

#Choosing the access tier

access_tier selects the sections of the passport you receive. These tiers form six distinct audiences. A repairer and a recycler receive different sections, decided by the trade of each.

The repairer, recycler and upstream tiers each give the sections of their trade, and nothing more. They are distinct audiences, and none of them contains the others: a recycler accreditation does not open what the repairer sees, and does not open manufacturing or the upstream supplier's supply chain either.

A brand can redefine these rules for its own products. The table above gives the default behavior, applied as long as a brand has redefined nothing.

#Request headers

No header is required for the public tier.

#Request body

None. This request has no body.

#Example request

Reading the reference passport published for the GTIN 03701234567890, at the public tier.

curl -i "https://api.sealtrust.io/v1/passport/01/03701234567890?access_tier=public"

const gtin = "03701234567890";

const url = new URL(
  `https://api.sealtrust.io/v1/passport/01/${encodeURIComponent(gtin)}`,
);
url.searchParams.set("access_tier", "public");

const response = await fetch(url, { method: "GET" });
const passeport = await response.json();

console.log(response.status);
console.log(JSON.stringify(passeport, null, 2));

import requests

gtin = "03701234567890"

response = requests.get(
    f"https://api.sealtrust.io/v1/passport/01/{gtin}",
    params={"access_tier": "public"},
    timeout=30,
)

print(response.status_code)
print(response.json())

For a tier that requires an account, add the authorization header and change the value of the parameter.

curl -i \
  -H "Authorization: Bearer votre-jeton-de-session" \
  "https://api.sealtrust.io/v1/passport/01/03701234567890?access_tier=recycler"

const gtin = "03701234567890";

const url = new URL(
  `https://api.sealtrust.io/v1/passport/01/${encodeURIComponent(gtin)}`,
);
url.searchParams.set("access_tier", "recycler");

const response = await fetch(url, {
  method: "GET",
  headers: { Authorization: "Bearer votre-jeton-de-session" },
});
const passeport = await response.json();

console.log(response.status);
console.log(JSON.stringify(passeport, null, 2));

import requests

gtin = "03701234567890"

response = requests.get(
    f"https://api.sealtrust.io/v1/passport/01/{gtin}",
    params={"access_tier": "recycler"},
    headers={"Authorization": "Bearer votre-jeton-de-session"},
    timeout=30,
)

print(response.status_code)
print(response.json())

#Example response

HTTP code 200.

{
  "id": 4821,
  "product_id": null,
  "product_model_id": 317,
  "gtin": "03701234567890",
  "level": "model",
  "brand_id": 12,
  "schema_version": "1.0",
  "passport_version": 3,
  "data": {
    "product_identity": {
      "gtin": "03701234567890",
      "model": "Sac Modèle Exemple",
      "brand": "Exemple SAS",
      "made_in": "FR",
      "production_facility": "Atelier Exemple, Nantes"
    },
    "compliance": {
      "eu_espr": true,
      "reach": true,
      "ce_marking": true
    },
    "circularity": {
      "recyclability_percentage": 62,
      "recycled_content_percentage": 0
    }
  },
  "data_hash": "4444444444444444444444444444444444444444444444444444444444444444",
  "ipfs_uri": null,
  "visibility": "public",
  "published_at": "2026-05-14T09:12:44.201000+00:00",
  "product_name": "Sac Modèle Exemple",
  "brand_name": "Exemple SAS"
}

When several published and public versions coexist for this model, the one carrying the highest version number is the one returned to you.

The response counts fifteen fields and nothing else.

#Response headers

A 200 response carries X-DPP-Access-Tier, in addition to Cache-Control, X-Request-Id and the X-RateLimit-* family that every response carries.

Only X-DPP-Access-Tier is specific to the 200 response. An error response does not carry it. Cache-Control, X-Request-Id and the X-RateLimit-* family come with error responses too.

#Reading the data field

data carries the passport's contents, in the form of named sections. The sections present depend on the tier requested, on the rules defined by the brand, and on what the brand has actually filled in. A section absent from the passport does not appear, and a section your tier does not cover does not appear either.

The filtering goes down inside the sections. In the example above, the compliance section is present at the public tier, but it shows only the compliance statements open at that tier. Never conclude that a field does not exist because it is absent from your response.

#Errors

The body of an error response carries a detail field.

#Order of the checks

The authority tier check happens before the passport lookup. A call with access_tier=authority and no authentication therefore returns 401, even if the GTIN is unknown.

The professional tier checks happen after the lookup. A call with access_tier=recycler on an unknown GTIN therefore returns 404, and never 401.

#See also

• GET /passport/01/{gtin}/proof, gather the public proofs of the passport announced by a GTIN.
• GET /passport/{identifier}, read the published passport of an item.
• GET /01/{gtin}, resolve a GS1 link that carries only a GTIN.
• Core concepts, tell model, batch and item apart before ordering a single label.