Everything the web app does is available over a plain REST API with bearer keys. Trace Files is designed to sit behind an ERP, a warehouse scanner or a shop floor system.
Base URL https://trace.fulcrum360.com. Send Authorization: Bearer t4l_live_…. The full reference lives in docs/API.md in the repository.
| Method | Path | Scope | What it does |
|---|---|---|---|
| GET | /api/v1/parts/lookup?pn=&sn=&q= | public | Search trace files by part number, serial or free text |
| POST | /api/v1/parts | parts:write | Create a trace file (birth, inventory or written-off origin); multipart with documents |
| GET | /api/v1/trace/{code} | public | Full trace file: identity, holder, events with documents, verification summary |
| POST | /api/v1/trace/{code}/events | events:write | Append an event; multipart with documents |
| POST | /api/v1/trace/{code}/receive | events:write | Scan-to-receive: countersign the transfer addressed to you and record a receipt |
| POST | /api/v1/events/{id}/countersign | events:write | Countersign a transfer addressed to your organization |
| GET | /api/v1/trace/{code}/archive | public | ZIP of every document plus a manifest with hashes |
| GET | /api/v1/trace/{code}/qr.png | public | QR image for the tag (?size=240); qr.svg for print |
| GET | /api/v1/documents/{id} | public | Download one document by id |
| GET | /api/v1/verify/{code} | public | Re-verification report: genesis, fingerprints, chain, signatures, anchor |
| GET | /api/v1/anchors | public | Daily anchors, newest first; /anchors/{date} for one batch with its proofs |
| POST | /api/v1/anchors/run | anchors:run | Publish today's anchor batch (or an owner/admin session); idempotent per date |
| GET | /api/v1/orgs/{code} | public | An organization's public profile and Ed25519 public key |
| POST | /api/v1/intake/batches | intake:write | Bulk intake: upload a folder of documents for matching |
| GET | /api/v1/intake/batches/{id} | any key | An intake batch with its items; your own organization's batches only |
| GET | /api/v1/me | any key | The organization and scopes behind the key |
The QR on the part encodes the trace URL. Strip the code, call receive, and the part is yours: the seller's transfer is countersigned with your key and a receipt event is appended.
curl -X POST https://trace.fulcrum360.com/api/v1/trace/W750-T1AD-XSQZ/receive \
-H "Authorization: Bearer $T4L_API_KEY" \
-H "Content-Type: application/json" \
-d '{"reference": "GRN-0091", "condition": "NE"}'parts:readRead trace files and documentsparts:writeCreate trace filesevents:writeAppend, receive and countersign eventsdocs:writeAttach documentsintake:writeUpload intake batchesverify:readVerification reportsanchors:runPublish the daily anchor batchEvent hashes are SHA-256 over canonical JSON (keys sorted, no whitespace) of the fields listed in the verification report. Signatures are Ed25519 over the hex hash. Anyone holding the documents and the public keys can recompute every step offline.
Keys are issued as live or test. Test keys write to the same locker but are meant for integration work; revoke them from the API page when you are done.