Skip to main content
Programmatic equivalent of three dashboard pages under Compliance ▸ Traceability: EPCIS capture keys, Serialization pools and Public visibility. Each page and its API route write through the same audited service and the same validation, so a change made on one shows on the other, and a value one refuses the other refuses too.
  • A capture key lets a device or system post EPCIS events for the organization. It can only post events.
  • A serialization pool hands out serial numbers for one product.
  • The public visibility setting chooses which kinds of EPCIS event the public product pages show.

​
When to use

  • A scanner, warehouse system or integration needs a credential to capture events.
  • A key leaked or a device was retired and its key must stop working.
  • A product needs serial numbers, or an exhausted pool must be re-enabled.
  • The organization wants a kind of event shown on, or hidden from, its public pages.

​
Auth

X-API-Key header or OAuth token. Reading needs any member of the organization (or any API key of it). Writing needs an OWNER, MANAGER or EDITOR (or an API key with the EDITOR role or above): a read-only key gets 403. An organization the caller does not belong to is 404, and so is a key or pool id that belongs to another organization.

​
Flow

  • POST .../capture-keys — send name (1 to 255 characters) and, optionally, expires_at. The response carries the secret, an epk_-prefixed key. It is shown only in this response: Closient stores a hash, so a lost secret cannot be recovered and the key must be replaced. Hand it to your human at once; do not store or log it.
  • POST .../capture-keys/{key_id}/revoke — the key stops working at once and stays listed as inactive. Revoking it again changes nothing.
  • POST .../serial-pools — send the gtin of one of the organization’s products and an encoding_type of numeric, alphanumeric or uuid. A product can have one pool; a GTIN that is not the organization’s, or whose product already has a pool, is 422. The pool starts active and empty.
  • POST .../serial-pools/{pool_id}/activate — sets an exhausted or disabled pool back to active. An active pool is returned unchanged.
  • GET .../visibility-config — a flag per kind of event (origin_events_visible, transformation_events_visible, packing_events_visible, shipping_events_visible, aggregation_events_visible, observation_events_visible) and custom_overrides, per-business-step overrides. An organization that never changed them reads the defaults, and the read saves nothing.
  • PATCH .../visibility-config — send only the flags you are changing. custom_overrides replaces the whole set; send {} to clear it.
null is 422 on the PATCH. A value the dashboard would refuse is 422, with one details row per field, such as ["body", "data", "gtin"].

​
Verify

  1. GET each list you changed and confirm it reads back as intended.
  2. After a revoke, confirm the key lists as inactive.
  3. Confirm nothing you did not mean to touch changed. The visibility setting controls what the public sees, so read it back before relying on it.