API reference

The audit, QR, and resolver endpoints are public. Account and product endpoints need an account API key, and accounts are not open yet. Base URL https://stampwright.com.

Authentication

Send your API key as a bearer token. Find it under Settings.

curl https://stampwright.com/api/products \
  -H "Authorization: Bearer YOUR_API_KEY"

The audit and QR endpoints are public. Product and account endpoints require an API key.

Readiness audit

POST /api/audit

Score a catalog. Public, rate limited to 10 requests per hour per IP.

curl -X POST https://stampwright.com/api/audit \
  -H "Content-Type: application/json" \
  -d '{
    "email": "you@yourbrand.com",
    "company": "Your Brand Co.",
    "csv": "gtin,name,url\n036000291452,Hot Sauce,\n"
  }'

Returns a readiness score (0–100), a letter grade, a summary, a prioritized checklist, and per-row findings. Header row must include a gtin or upc column; name and url are optional.

GET /api/audit/{id}

Retrieve a stored report. Anyone with the report link can read it, and no API key is required.

QR codes

GET /api/qr/{gtin}.svg

Returns an SVG with physical dimensions in millimeters and a 4-module quiet zone. Have a qualified verifier scan the printed result before production.

QR code query parameters
Parameter	Default	Notes
`module`	0.5	Module size in mm. Minimum 0.396 for retail POS.
`ecc`	M	L, M, Q, H. M is the packaging default. Higher settings add modules and increase the physical size.
`lot`	None	AI (10) batch/lot
`serial`	None	AI (21) serial number
`cpv`	None	AI (22) consumer product variant

curl "https://stampwright.com/api/qr/036000291452.svg?module=0.5&lot=LOT2027A" -o code.svg

GET /api/qr/{gtin}.json

Returns the same symbol with its width, module count, quiet zone, and any warning about the retail POS minimum size.

Products and resolver routes

PUT /api/products/{gtin}

Create or update a product and its resolver destinations.

curl -X PUT https://stampwright.com/api/products/036000291452 \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Hot Sauce 12oz",
    "attributes": { "17": "270630" },
    "links": [
      { "linkType": "gs1:pip", "href": "https://yourbrand.com/hot-sauce", "title": "Hot Sauce product information", "default": true }
    ],
    "approved": true
  }'

approved must be true for links to go live. Requests without approval are held as staged changes. A published route may already be used by printed packaging.

GET /api/products

Download the account's products and resolver routes as JSON, one page per request. Pass limit (default 1,000, maximum 5,000) and follow page.products.nextCursor and page.routes.nextCursor with cursor until both are null.

Resolver

The resolver is public. Browsers, apps, and trading-partner systems can request these routes. A POS system may instead extract the GTIN locally without opening the URL.

Resolver requests and responses
Request	Returns
`/01/{gtin14}`	307 to the default destination
`/01/{gtin14}?linkType=gs1:pip`	307 to that specific link type
`/01/{gtin14}?linkType=linkset`	Full linkset as JSON
`Accept: application/linkset+json`	Same linkset, content-negotiated
`/01/{gtin14}/10/{lot}`	307 to the GTIN's default destination. Lot-specific destinations are planned; no endpoint sets them yet.

Current scope: uncompressed GTIN Digital Links with optional AI (22), (10), and (21) path qualifiers. Stampwright does not claim full GS1-Conformant Resolver 1.2.0 status while EPC-binary decompression and the wider profile remain incomplete.

Errors and limits

API error codes and meanings
Code	Meaning
400	Invalid input. The body identifies the GTIN or AI value that failed.
401	Missing or invalid API key
402	Plan GTIN limit reached
413	Catalog too large for the free audit
429	Rate limited. See `X-RateLimit-Reset`.

For a bad check digit, the response includes the expected digit.