POSTMethod POST/originality/read-sig/verify

You send the serial number of a chip and the NXP Read_Sig originality signature read on it, and the service returns a verdict.

#Authorization

None, public endpoint. This endpoint expects no API key, no session cookie, and no Authorization header.

Call it from your server. A call issued by a browser page goes through two additional checks, the origin of the request and the anti-forgery token, which return 403 when they are not satisfied.

The check touches none of your records. No scan is recorded, no statistic is fed, no notification is triggered.

#Call limit

No limit of its own for this endpoint. It comes under the general counter of the API, counted per calling network address over a 60-second window.

This general counter is common to all the endpoints that have no dedicated limit. Your calls here therefore eat into the same budget as your calls to those other addresses. The /v1 prefix does not create a second budget.

Every response carries three headers.

Read X-RateLimit-Remaining and slow down before reaching zero. The value of X-RateLimit-Limit can change without notice, so do not hard-code any number in your code.

This endpoint consumes no quota of your plan. It requires neither an account nor an API key, and it consults no plan.

#Path and query parameters

None. This endpoint has neither a path parameter nor a query parameter. Everything goes through the request body.

#Request body

Send a JSON object with the Content-Type: application/json header.

No other field is accepted. An unknown field makes the request fail with a 422, and no field is ignored silently.

#What the service cleans up before reading

On the three values, the service removes the leading and trailing spaces, brings uppercase down to lowercase, deletes colons and internal spaces, then removes a 0x prefix if it finds one.

Colons and spaces are therefore the only two separators tolerated. Any other separator, hyphen or period, must be removed by you before sending: a serial number written 04-1a-2b-3c-4d-5e-6f is refused with a 422.

#It is the public key that sets the curve

The service deduces the curve from the length of the checking public key: 57 bytes give P-224, 65 bytes give P-256. You have no curve parameter to send, and the response tells you the curve retained.

The expected signature length follows from it. A signature of 64 bytes checked with a P-224 key is refused with a 422, before any computation.

#Example request

Full address:

POST https://api.sealtrust.io/v1/originality/read-sig/verify

The same endpoint also replies without the /v1 prefix, at https://api.sealtrust.io/originality/read-sig/verify. The two addresses call the same code. Use the /v1 form for a new integration.

curl -i -X POST https://api.sealtrust.io/v1/originality/read-sig/verify \
  -H "Content-Type: application/json" \
  -d '{
    "uid_hex": "04000000000000",
    "signature_hex": "0000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000001",
    "public_key_hex": "04b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34"
  }'

const response = await fetch(
  "https://api.sealtrust.io/v1/originality/read-sig/verify",
  {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      uid_hex: "04000000000000",
      signature_hex:
        "0000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000001",
      public_key_hex:
        "04b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34",
    }),
  },
);

console.log(response.status);
console.log(response.headers.get("X-RateLimit-Remaining"));
console.log(await response.json());

import requests

response = requests.post(
    "https://api.sealtrust.io/v1/originality/read-sig/verify",
    json={
        "uid_hex": "04000000000000",
        "signature_hex": "0000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000001",
        "public_key_hex": "04b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34",
    },
    timeout=30,
)

print(response.status_code)
print(response.headers["X-RateLimit-Remaining"])
print(response.json())

These values are invented. The public key of the example is the generator point of the P-224 curve, a constant published in the standard that describes this curve. It describes a real point on the curve, so the call goes all the way to the cryptographic check. It is the key of no manufacturer.

Copied as they are, these three values give a 200 code with valid at false, shown below. A positive verdict requires a signature actually read on a chip and the public key of the manufacturer that signed it.

#Example response

HTTP code 200. This is the exact response for the values of the example above.

{
  "valid": false,
  "curve": "secp224r1",
  "uid_hex": "04000000000000",
  "signature_hex": "0000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000001",
  "error": "signature invalide",
  "public_key_used": "04b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34"
}

A negative verdict therefore comes out as a 200, like a positive verdict. On a positive verdict, the same response comes back with valid at true and error at null. The four other fields are identical.

The six fields of the response.

A 200 code means that the check could be carried through to the end. It does not mean that the signature is good. Always read valid.

#Errors

Every error response has the same shape: a JSON object with a detail field.

#See also

• Physical identification, QR and NFC, choose the physical carrier and the exact form of the GS1 Digital Link.
• Engrave and encode NFC seals, prepare a batch, engrave each chip and check the result.
• API errors, recognize an error code and decide whether to correct or to replay.