GETMethod GET/passport/{identifier}

You read the published digital passport of a single product. By the end of this page, you will know how to retrieve its data at the access tier you request, read its warranty, know on what basis each section can be believed, and recognize a product withdrawn from the catalog.

Full address:

GET https://api.sealtrust.io/v1/passport/{identifier}

The same endpoint also answers without the /v1 prefix, at https://api.sealtrust.io/passport/{identifier}. Both addresses call the same code. Use the /v1 form for a new integration.

#Authorization

None for the public tier, the default one. This endpoint is public at that tier.

A partner API key opens nothing here. The token received in the Authorization header is decoded as a user account session token, and an API key is not one: the read fails silently and the call proceeds as an anonymous call.

The five other values of the access_tier parameter do, on the other hand, require an account session, presented through the Authorization: Bearer <session token> header or through the session cookie set at sign-in.

A session of an administrator of the product's brand opens the three trade tiers on its own products. A session carrying the market surveillance authority role opens them as well. A client, repairer or recycler account that is still tied to the brand, a former administrator for instance, is not part of it: it receives 403, or the one tier of its accreditation.

#Rate limit

600 calls per 60-second window, counted per calling IP address. The window is fixed. This limit is shared by every read (GET) whose address starts with /passport, and the /passport/… and /v1/passport/… forms feed the same counter.

Every accepted response carries three headers that describe this counter.

Going over returns 429, with the same three headers and a Retry-After in seconds.

#Path and query parameters

#The three accepted identifier forms

The server recognizes the chip hash whatever the case. It recognizes the serial number the same way, and it canonicalizes it the way the QR resolver does: it reads the letters I and L as a 1, and the letter O as a 0. So you can retype by hand the number read off a label, even if you confuse those characters.

The server recognizes the form from the way it is written. It looks for a value that starts with 0x and is exactly 66 characters long as a chip hash. It looks for any other value first as a token identifier, then, if that lookup gives nothing, as a serial number.

#The six values of access_tier

These tiers are different audiences, with no hierarchy between them. A recycler is not above a repairer. Each of the three trade tiers inherits the public tier and the end user tier, then adds what its trade requires.

The fields the console writes at the root of the passport each have their own tier, named one by one: see Passport access rules.

A brand can replace these rules with its own, by product category. The table above describes what applies in the absence of rules specific to the brand.

The server refuses any other value with a 422. It returns the tier actually served in the access_tier field and in the X-DPP-Access-Tier header of the default JSON response. Read one of the two rather than assuming it. With format=jsonld, neither that field nor that header exists, see below.

#Response headers to know about

The server sets X-DPP-Access-Tier only on the default JSON response. Cache-Control carries the same value on both formats.

No header is required in the request.

#Request body

None. This request has no body.

#Example request

Reading the public passport of the product whose printed number is EXEMP1E00001. The three examples make the same call, stop the program on an error response, then display the same three values: passport_version, access_tier and data.product_identity.

curl --fail-with-body -s \
  "https://api.sealtrust.io/v1/passport/EXEMP1E00001?access_tier=public" \
  | jq '{passport_version, access_tier, product_identity: .data.product_identity}'

const identifier = "EXEMP1E00001";

const url = new URL(
  `https://api.sealtrust.io/v1/passport/${encodeURIComponent(identifier)}`,
);
url.searchParams.set("access_tier", "public");

const response = await fetch(url, { method: "GET" });

if (!response.ok) {
  throw new Error(`SealTrust replied ${response.status}`);
}

const passport = await response.json();

console.log({
  passport_version: passport.passport_version,
  access_tier: passport.access_tier,
  product_identity: passport.data.product_identity,
});

import requests
from urllib.parse import quote

identifier = "EXEMP1E00001"

response = requests.get(
    f"https://api.sealtrust.io/v1/passport/{quote(identifier, safe='')}",
    params={"access_tier": "public"},
    timeout=30,
)
response.raise_for_status()

passport = response.json()

print(
    {
        "passport_version": passport["passport_version"],
        "access_tier": passport["access_tier"],
        "product_identity": passport["data"]["product_identity"],
    }
)

In the curl example, --fail-with-body returns a non-zero exit code when the server answers an error, and still displays the body. The jq tool only serves to read the JSON in the terminal, it takes no part in the call.

#Example response

HTTP code 200.

This product is still in the catalog, it has not been claimed by a customer, and the passport is requested at the public tier. Its data describes no material and declares no substance of concern, so the evidence block rates the unit only.

{
  "id": 1,
  "product_id": 1,
  "brand_code": "K7M2QF9XBN",
  "brand_id": 42,
  "schema_version": "1.0",
  "passport_version": 3,
  "data": {
    "product_identity": {
      "gtin": "03701234567891",
      "model": "Cartable Exemple 32",
      "brand": "Exemple SAS",
      "made_in": "FR"
    },
    "compliance": {
      "eu_espr": true,
      "reach": true,
      "ce_marking": false
    },
    "circularity": {
      "recyclability_percentage": 62,
      "recycled_content_percentage": 0
    }
  },
  "data_hash": "0000000000000000000000000000000000000000000000000000000000000000",
  "ipfs_uri": null,
  "ipfs_gateway_url": null,
  "visibility": "public",
  "access_tier": "public",
  "is_owner": false,
  "identity_included": true,
  "published_at": "2026-08-01T09:00:00+00:00",
  "product_name": "Cartable Exemple 32",
  "brand_name": "Exemple SAS",
  "image_url": "https://example-sas.test/images/cartable-32.jpg",
  "gtin": "03701234567891",
  "gs1_digital_link": "https://id.gs1.org/01/03701234567891/21/EXEMP1E00001",
  "passport_service_provider": null,
  "warranty": {
    "status": "active",
    "ends_at": "2028-08-01T09:00:00+00:00",
    "duration_months": 24,
    "transferable": true,
    "remaining_days": 730
  },
  "evidence": {
    "sections": {
      "identity": "verified",
      "integrity": "declared"
    },
    "legend": {
      "declared": "Stated by the brand. Recorded, dated and attributable, but not independently checked.",
      "verified": "Rests on an on-chain reference that anyone can re-check independently. SealTrust records it and does not re-query the chain on each request."
    },
    "derived": true,
    "note": "Statuses are computed by SealTrust from verifiable facts. A brand cannot set them."
  }
}

The domain of the gs1_digital_link field is that of the resolver configured for your integration. https://id.gs1.org is only the fallback value, used when no resolver is configured. Do not hard-code this domain, read the value returned.

#The fields of the response

#The warranty block

#The evidence block

Three values exist, and they are computed by SealTrust. A brand cannot choose them.

Four sections can carry one of these values: identity, integrity, composition and substances_of_concern. Only the sections the passport actually contains receive one.

identity and integrity are always present, because they bear on the unit itself. The identity section goes to verified when the unit carries a token identifier on the chain. The integrity section goes to verified when this version's hash has been anchored and still matches the recorded data.

composition and substances_of_concern appear only when the passport data carries them. A passport that describes no material receives no composition status, and sections then holds two entries. A materials block left empty (rows with no name, no share and no origin) describes no material. The number of entries therefore ranges from two to four depending on the passport served.

The block additionally carries legend, which restates the meaning of the values present, derived at true, and note.

Display a status only for the sections that sections names. An absent section is neither verified nor disproved, it is simply not rated.

#The lifecycle block

It appears only if the unit is destroyed or out of the catalog. Its passport is still served so that the identifier keeps resolving.

{
  "lifecycle": {
    "status": "superseded",
    "is_burned": false,
    "superseded": true,
    "note": "This unit is superseded or withdrawn; its passport is retained so the identifier stays resolvable (EN 18219 §4.2.2 persistence)."
  }
}

Read is_burned before status.

The status field is superseded when the unit has been replaced by another, and archived when it was withdrawn without replacement. The superseded field is true only for the first case.

The block also appears when the unit has been destroyed, that is, when is_burned is true. In that case status carries the product's current state, which may be null or an active value. So never infer destruction from the value of status.

#The integrity block

{
  "integrity": {
    "ipfs_fetched": true,
    "ipfs_hash": "1111111111111111111111111111111111111111111111111111111111111111",
    "expected_hash": "1111111111111111111111111111111111111111111111111111111111111111",
    "match": true
  }
}

expected_hash is the hash of the PUBLIC projection of the passport, the one deposited on IPFS. It differs from data_hash, which covers the complete data, including the fields reserved for the professional tiers. The two values coincide only when the passport carries no non-public field. So never compare expected_hash and data_hash.

The match field is true when the IPFS copy matches, false when it differs, and null when the copy could not be retrieved. In that last case ipfs_fetched is false, an error field replaces the two hashes, and null means that nothing could be concluded.

#The JSON-LD response

With format=jsonld, the response carries the content type application/ld+json. It is a Schema.org and GS1 document whose fields are filtered by the same access tier. It contains neither passport_version, nor data_hash, nor the warranty, evidence, lifecycle and integrity blocks described above: the warranty is expressed there as WarrantyPromise, and the other blocks do not appear in it. The back-up copy provider appears under espr:passportServiceProvider (identifier, name, espr:backedUpAt), on the same terms as passport_service_provider, and is absent until the copy exists.

Two other differences matter for your integration.

The document carries no access_tier field. The server does not return the X-DPP-Access-Tier header either. To know the tier actually served, call without format, or stick to the tier you requested.

The server ignores verify_integrity in this format. It returns the JSON-LD document before computing the integrity block, so this parameter changes nothing in the response and no error signals it to you.

#Errors

The body of an error response carries a detail field.

#Why the IPFS copy is not always given at the public tier

An IPFS copy is readable by anyone who knows its content identifier. Until 14 July 2026 we pinned the full passport there, restricted fields included. Handing the address to a public reader would have bypassed the access tiers, so it was hidden from everyone except the authenticated tiers.

Since that date we pin only the public projection of the passport: the copy no longer holds anything restricted, and its address is given to everyone. Passports published before that date keep a full-data copy, for ever, because a content identifier cannot be withdrawn. Their address therefore stays restricted to the authenticated tiers.

Measured in production on 12 September 2026: of sixteen passports carrying an IPFS copy, five predate that change.

#See also

• GET /passport/01/{gtin}, read a model's published passport, from its GTIN.
• GET /passport/{identifier}/verify, check the integrity of an item's published passport.
• GET /passport/{identifier}/proof, gather the public proofs of an item's passport.
• GET /passport/{identifier}/vc, retrieve the passport's signed credential, in SD-JWT-VC format.
• Publishing a digital product passport, publish, choose who sees which fields, export and have it verified.