A free API. No account to enrol or to resolve.

Validates format and check, normalises, and says whether it exists and its status. For label readers, forms and agents: cheap, and it does not count as a resolution.

curl https://parcid.com/api/v1/verify/pid-1-7qc3-z79d-g6rz-8e

const r = await fetch('https://parcid.com/api/v1/verify/' + encodeURIComponent(input));
const v = await r.json();
// { canonical, format, check, registered, status, resolution_url }

Public resolution: what anyone can see (SPEC §3.4), including the unit profile and the enrolment’s anchoring.

curl -H 'Accept: application/json' https://parcid.com/api/v1/parcels/PID-1-7QC3-Z79D-G6RZ-8E

const r = await fetch('https://parcid.com/api/v1/parcels/PID-1-7QC3-Z79D-G6RZ-8E');
if (r.status === 404) console.log('valid format, not registered');
const unit = await r.json();
// status, unit_profile, assurance_level, lineage, enrolment.anchor…

Enrolment: creates the PID and returns the owner key only once, with the sealed record. JSON if you only send fingerprints; multipart if you upload files. An SSCC comes in as a link.

curl -X POST https://parcid.com/api/v1/parcels \
  -H 'Content-Type: application/json' \
  -d '{
    "capture_class": "api",
    "unit_profile": "parcel",
    "captured_at": "2026-11-18T09:40:58Z",
    "dimensions_mm": { "l": 412, "w": 306, "h": 218, "tolerance_mm": 3 },
    "weight_g": { "value": 3840, "tolerance_g": 5, "scale_class": "consumer" },
    "evidence": [ { "role": "top", "sha256": "sha256:0c7e…", "mime": "image/jpeg", "bytes": 2418833 } ],
    "links": [ { "kind": "sscc", "value": "003412345678901238", "visibility": "public" } ],
    "consent": { "no_personal_data": true, "terms_version": "2026-10" }
  }'

const r = await fetch('https://parcid.com/api/v1/parcels', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    capture_class: 'api',
    unit_profile: 'pallet_load', // parcel | pallet_load | container_load | tote | bag | crate
    captured_at: new Date().toISOString(),
    consent: { no_personal_data: true, terms_version: '2026-10' },
  }),
});
const { pid, owner_key, enrolment_record } = await r.json();
// 201 · store owner_key and enrolment_record now: the key is shown only once

GS1 Digital Link: a publicly linked SSCC resolves to its PIDs. Each carries a claim: “operator” (linked by an identified operator) or “self_declared” (unverified: anyone can link a public SSCC). The PID is not a GS1 key.

curl -H 'Accept: application/json' https://parcid.com/00/003412345678901238

const r = await fetch('https://parcid.com/00/' + sscc, { headers: { Accept: 'application/json' } });
const { parcels } = await r.json(); // [{ pid, status, claim: 'operator' | 'self_declared' }]

Full resolution for the owner: enrolment record, physical signature, evidence with short-lived signed URLs, private links, detailed sightings.

curl -H "Authorization: Bearer $PIDK" https://parcid.com/api/v1/parcels/PID-1-7QC3-Z79D-G6RZ-8E

const r = await fetch('https://parcid.com/api/v1/parcels/PID-1-7QC3-Z79D-G6RZ-8E', {
  headers: { Authorization: 'Bearer ' + ownerKey }, // never in the URL
});
const full = await r.json(); // record, physical signature, evidence, private links

Adds external references (tracking, SSCC, order, BIC container, seal, GRAI, bag tag) with private or public visibility.

curl -X POST https://parcid.com/api/v1/parcels/PID-1-7QC3-Z79D-G6RZ-8E/links \
  -H "Authorization: Bearer $PIDK" -H 'Content-Type: application/json' \
  -d '{ "links": [ { "kind": "sscc", "value": "003412345678901238", "visibility": "public" } ] }'
# kinds: tracking, sscc, order, bic, seal, grai, bag_tag…

await fetch('https://parcid.com/api/v1/parcels/PID-1-7QC3-Z79D-G6RZ-8E/links', {
  method: 'POST',
  headers: { Authorization: 'Bearer ' + ownerKey, 'Content-Type': 'application/json' },
  body: JSON.stringify({ links: [{ kind: 'bic', value: 'CSQU3054383', visibility: 'private' }] }),
});

Declares opening, consolidation, split or repack and creates the child.

curl -X POST https://parcid.com/api/v1/parcels/PID-1-7QC3-Z79D-G6RZ-8E/lineage \
  -H "Authorization: Bearer $PIDK" -H 'Content-Type: application/json' \
  -d '{ "operation": "repack", "consent": { "no_personal_data": true, "terms_version": "2026-10" } }'
# consolidate: "parents": [ { "pid": "PID-…", "owner_key": "pidk_…" } ]

const r = await fetch('https://parcid.com/api/v1/parcels/PID-1-7QC3-Z79D-G6RZ-8E/lineage', {
  method: 'POST',
  headers: { Authorization: 'Bearer ' + parentKey, 'Content-Type': 'application/json' },
  body: JSON.stringify({ operation: 'repack', consent: { no_personal_data: true, terms_version: '2026-10' } }),
});
const { children } = await r.json(); // each child is born with its own key

Changes the status to retired (delivered and closed) or lost.

curl -X POST https://parcid.com/api/v1/parcels/PID-1-7QC3-Z79D-G6RZ-8E/status \
  -H "Authorization: Bearer $PIDK" -H 'Content-Type: application/json' \
  -d '{ "status": "retired", "reason_code": "delivered" }'

await fetch('https://parcid.com/api/v1/parcels/PID-1-7QC3-Z79D-G6RZ-8E/status', {
  method: 'POST',
  headers: { Authorization: 'Bearer ' + ownerKey, 'Content-Type': 'application/json' },
  body: JSON.stringify({ status: 'lost' }), // 'retired' | 'lost'
});

Issues a new key and revokes the previous one.

curl -X POST -H "Authorization: Bearer $PIDK" https://parcid.com/api/v1/parcels/PID-1-7QC3-Z79D-G6RZ-8E/rotate-key

const r = await fetch('https://parcid.com/api/v1/parcels/PID-1-7QC3-Z79D-G6RZ-8E/rotate-key', {
  method: 'POST', headers: { Authorization: 'Bearer ' + ownerKey },
});
const { owner_key } = await r.json(); // the previous key is revoked

Sighting with 1:1 comparison (SPEC §8). Made by an operator: its pidd_ key with the contracted service goes in Authorization and the unit’s owner key in X-Parcid-Owner-Key.

curl -X POST https://parcid.com/api/v1/parcels/PID-1-7QC3-Z79D-G6RZ-8E/sightings \
  -H "Authorization: Bearer $PIDD" -H "X-Parcid-Owner-Key: $PIDK" -F capture_class=station \
  -F 'evidence[top]=@top.jpg' -F 'evidence[perspective]=@perspective.jpg'
# $PIDD: operator key with the contracted service · without it: 402 {"error":"paid_service"}

const form = new FormData();
form.append('capture_class', 'mobile_sdk');
form.append('evidence[top]', file);
const r = await fetch('https://parcid.com/api/v1/parcels/PID-1-7QC3-Z79D-G6RZ-8E/sightings', {
  method: 'POST',
  headers: { Authorization: 'Bearer ' + operatorKey, 'X-Parcid-Owner-Key': ownerKey },
  body: form,
});
// match.decision: 'match' | 'review' | 'no_match', with an explanation

Reserves blocks of PIDs for offline stations, signed by the device. They expire after 90 days and are never reissued.

curl -X POST https://parcid.com/api/v1/reservations -H 'Content-Type: application/json' -d '{
  "device": { "public_key": "ed25519:…" },
  "count": 500, "requested_at": "2026-11-18T09:40:00Z", "nonce": "r4nd0m-n0nce",
  "device_signature": "…"
}'
# device_signature: Ed25519 over sha256(JCS({schema:"parcid.reservation-request/1", public_key, count, requested_at, nonce}))

const r = await fetch('https://parcid.com/api/v1/reservations', {
  method: 'POST', headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(signedRequest),
});
const { pids, expires_at, reservation_record } = await r.json();
// offline stations enrol later with POST /parcels { "pid": …, … } signed by the same device

Inclusion proof of every record of the unit: RFC 6962 Merkle path, signed daily statement and OpenTimestamps proof.

curl https://parcid.com/api/v1/parcels/PID-1-7QC3-Z79D-G6RZ-8E/proof
# verify it without us: node cli.mjs proof PID-1-7QC3-Z79D-G6RZ-8E

import { verifyProof } from 'https://parcid.com/verify/parcid-verify.js';
const [proof, keys] = await Promise.all([
  fetch('https://parcid.com/api/v1/parcels/PID-1-7QC3-Z79D-G6RZ-8E/proof').then((r) => r.json()),
  fetch('https://parcid.com/.well-known/parcid').then((r) => r.json()),
]);
const res = await verifyProof(proof, keys); // { ok, fully_anchored, records: [...] }

Chain of daily statements: Merkle root, Ed25519 signature, chaining and Bitcoin status.

curl "https://parcid.com/api/v1/anchors?from=2026-11-01&limit=30"

const { anchors, next_from } = await (await fetch('https://parcid.com/api/v1/anchors?from=2026-11-01')).json();
// each: day, statement (merkle_root, prev_statement_hash…), statement_hash, signature, bitcoin.status

One day’s statement and its OpenTimestamps proof; with .ots, the binary file for ots verify.

curl https://parcid.com/api/v1/anchors/2026-11-18
curl -o 2026-11-18.ots https://parcid.com/api/v1/anchors/2026-11-18.ots
# ots verify 2026-11-18.ots, or: node cli.mjs ots 2026-11-18.ots --bitcoin

const a = await (await fetch('https://parcid.com/api/v1/anchors/2026-11-18')).json();
// a.statement, a.statement_hash, a.signature, a.bitcoin, a.opentimestamps[].ots_base64

Index of daily exports: day, URL, size, fingerprint, units and signed manifest. CC0.

curl https://parcid.com/api/v1/export
# { license: "CC0-1.0", exports: [ { day, url, bytes, sha256, units, manifest, signature } ] }

const { exports } = await (await fetch('https://parcid.com/api/v1/export')).json();
const latest = exports.at(-1); // daily, CC0, units identified by a per-unit salted tag (pid_tag + pid_salt)

The day’s full export as JSON Lines + gzip: units (by a per-unit salted tag, pid_tag + pid_salt; never the PID in clear), ledger records, anchors and a signed manifest.

curl -O https://parcid.com/api/v1/export/parcid-export-20261118.jsonl.gz
node cli.mjs export parcid-export-20261118.jsonl.gz --pid PID-1-7QC3-Z79D-G6RZ-8E

const gz = await fetch(latest.url);
const text = await new Response(gz.body.pipeThrough(new DecompressionStream('gzip'))).text();
const res = await verifyExport(text.split('\n')); // from parcid-verify.js

Registry metadata: version, public keys (kid), ID format, transparency, export and limits.

curl https://parcid.com/.well-known/parcid

const meta = await (await fetch('https://parcid.com/.well-known/parcid')).json();
// spec, keys[] (kid, public_key), id_format, transparency, export, limits

Aggregate figures: units by profile, level and status, records by type, latest anchor and export, 24 h requests.

curl https://parcid.com/api/v1/stats

const s = await (await fetch('https://parcid.com/api/v1/stats')).json();
// units.by_profile, units.by_assurance_level, records.by_type, anchors.latest, export, api_24h

Service health: ok, degraded or down (503), with checks and daily jobs.

curl https://parcid.com/api/v1/health

const h = await (await fetch('https://parcid.com/api/v1/health')).json();
// status: 'ok' | 'degraded' | 'down' (503)

This site’s visit counter: path, referrer and language. No cookies or identifiers; the IP is not stored. Returns 204.

curl -X POST https://parcid.com/api/v1/beacon -H 'Content-Type: application/json' \
  -d '{ "p": "/como-funciona/", "r": "", "l": "es" }'
# 204 · no cookies, no identifiers, IP never stored

navigator.sendBeacon('/api/v1/beacon', new Blob([JSON.stringify({
  p: location.pathname, r: document.referrer, l: 'es',
})], { type: 'application/json' })); // only the path, referrer host and language are counted