If the resolver is the doorway, the API is the plumbing behind it. Engineers use it to serialise products, read scan events, verify identities, and push the result into their own systems.
REST, done properly
Versioned, rate-limited, documented endpoints cover every platform action — creating product records, batch registration, querying analytics, and triggering verification flows. Standard JSON in and out, predictable errors, and a sandbox for staging work.
Webhooks: let events come to you
Where polling ends, webhooks begin. Register a URL and the platform pushes scan, verification, and lifecycle events in real time — the clean way to drive CRM updates, fraud alerts, or inventory systems without building a scheduler.
POST /events
{
"type": "scan",
"gtin": "0614141000011",
"serial": "CLIQ-4F82K1",
"geo": {"lat": 45.50, "lng": -73.56},
"verified": true
}The verify-once loop
For security use cases, design around the verify-once pattern: a check that consumes a one-time activation state. It is the API-level foundation of tamper-evident protection — and it is exactly why serialised codes defeat replay.
Great integrations fail on authentication hygiene. Keep keys scoped, rotated, and out of client-side code.
