Public API reference

Everything below is unauthenticated and safe to call from a browser, a backend, or a mobile app — it only ever returns data from published passports. Base URL: https://backend.trikagency.com/api.

GET /public/lookup

Resolve your own SKU or GTIN to its passport. This is what embed.js calls.

GET /public/lookup?org={organisationId}&sku={sku}
GET /public/lookup?org={organisationId}&gtin={gtin}

200 OK
{
  "success": true,
  "data": {
    "passport_id": "01J...",
    "public_url": "https://circularid.trikagency.com/passport/01J...",
    "product": { "name": "...", "brand": "...", "cover_image": "..." }
  }
}

GET /public/passport/{passportId}

Full public passport payload — materials, supply chain, certifications, care, end-of-life, environmental impact (public-visibility fields only).

GET /public/passport/{passportId}

200 OK  { "success": true, "data": { ...full passport... } }
404     passport not published or doesn't exist

GET /public/passport/gs1/{gtin}/{batch}

Resolves a GS1 Digital Link (the canonical /01/{gtin}/21/{batch} form encoded in some QR codes) to the same payload as above.

POST /public/passport/{passportId}/view

Records a scan/view for analytics. Optional body: { "ref": "qr" | "nfc" | "link" }.

Authenticated endpoints

Everything else (creating products, editing passports, distribution status, integrations) requires a Bearer token and an X-Organisation-Id header, same as the dashboard uses. Generate a Developer API Key from Settings → Integrations → Developer — never share your own login session token for this.

Authorization: Bearer {your-developer-api-key}
X-Organisation-Id: {your-organisation-id}