Institutional API Terms
The terms for refineries, national oil companies, banks, inspection authorities and Eurabelt portals that access the Registry through its institutional API, including endpoints, scopes, limits and security duties.
1. Access
API access is granted only by written agreement with Eurabelt Fuels Ltd. Each key is issued to a named organisation, for stated purposes and with specific scopes. Keys are shown once and are stored by the Registry only as a keyed hash.
2. Endpoints and scopes
| Endpoint | Scope | Purpose |
|---|---|---|
GET /api/v1/health | none | Service status |
POST /api/v1/verify | verify | Verify three code seals together with an ATV reference addressed to your organisation |
POST /api/v1/seal/verify | seal | Confirm that a document fingerprint (SHA-256) matches a locked Seal ID |
POST /api/v1/code/status | status | Confirm that a code is recognised and active, without disclosing the profile. Available only to Eurabelt's own platforms. |
Requests and responses use JSON over HTTPS. Keys are sent as Authorization: Bearer <key>.
3. Conditions of use
- API verifications are subject to the Counterparty Verification Terms. Each successful
verifycall consumes one use of the ATV and notifies the holder. - You must not use the API to enumerate, guess or test codes, seals or ATV references, or to build a copy of Registry data.
- You must respect the rate limits (currently 120 verifications, 300 seal checks and 600 status checks per hour per key) and back off when you receive HTTP 429.
- Profile data received through the API is confidential and may be kept only in your due-diligence records.
4. Security duties
- Store keys in a secrets manager or protected configuration, never in source code or client-side applications.
- Restrict each key to the systems that need it.
- Report suspected key compromise to security@eurabeltfuels.com immediately; the key will be revoked and replaced.
- Call the API only from server-side systems over TLS with certificate validation enabled.
5. Changes and versioning
The v1 interface will remain stable. Breaking changes will be released under a new version, and v1 will remain available for at least 12 months after its successor is published. Non-breaking additions (new response fields, for example) may be made at any time, so clients must ignore fields they do not recognise.
6. Suspension
The Registry may suspend a key without notice in cases of misuse, a security risk or non-payment of agreed fees, or where the law requires it.
7. Liability
The API is provided on the terms of the Disclaimer & Liability policy, as varied by any written agreement with Eurabelt Fuels Ltd.