> ## Documentation Index
> Fetch the complete documentation index at: https://docs.closient.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure EPCIS Capture

> Manage an organization's EPCIS capture keys, serial-number pools and the kinds of EPCIS event its public product pages show, the programmatic equivalent of the dashboard's Compliance capture-keys, serialization-pools and public-visibility pages.

Programmatic equivalent of three dashboard pages under Compliance ▸
Traceability: **EPCIS capture keys**, **Serialization pools** and **Public
visibility**. Each page and its API route write through the same audited
service and the same validation, so a change made on one shows on the
other, and a value one refuses the other refuses too.

* A **capture key** lets a device or system post EPCIS events for the
  organization. It can only post events.
* A **serialization pool** hands out serial numbers for one product.
* The **public visibility** setting chooses which kinds of EPCIS event the
  public product pages show.

## When to use

* A scanner, warehouse system or integration needs a credential to capture events.
* A key leaked or a device was retired and its key must stop working.
* A product needs serial numbers, or an exhausted pool must be re-enabled.
* The organization wants a kind of event shown on, or hidden from, its public pages.

## Auth

`X-API-Key` header or OAuth token. Reading needs any member of the
organization (or any API key of it). Writing needs an OWNER, MANAGER or
EDITOR (or an API key with the EDITOR role or above): a read-only key gets
`403`. An organization the caller does not belong to is `404`, and so is a
key or pool id that belongs to another organization.

## Flow

```
GET   /compliance/api/v1/organizations/{organization_id}/capture-keys
POST  /compliance/api/v1/organizations/{organization_id}/capture-keys
POST  /compliance/api/v1/organizations/{organization_id}/capture-keys/{key_id}/revoke
GET   /compliance/api/v1/organizations/{organization_id}/serial-pools
POST  /compliance/api/v1/organizations/{organization_id}/serial-pools
POST  /compliance/api/v1/organizations/{organization_id}/serial-pools/{pool_id}/activate
GET   /compliance/api/v1/organizations/{organization_id}/visibility-config
PATCH /compliance/api/v1/organizations/{organization_id}/visibility-config
```

* **`POST .../capture-keys`** — send `name` (1 to 255 characters) and,
  optionally, `expires_at`. The response carries the `secret`, an
  `epk_`-prefixed key. It is shown only in this response: Closient stores a
  hash, so a lost secret cannot be recovered and the key must be replaced.
  Hand it to your human at once; do not store or log it.
* **`POST .../capture-keys/{key_id}/revoke`** — the key stops working at
  once and stays listed as inactive. Revoking it again changes nothing.
* **`POST .../serial-pools`** — send the `gtin` of one of the
  organization's products and an `encoding_type` of `numeric`,
  `alphanumeric` or `uuid`. A product can have one pool; a GTIN that is not
  the organization's, or whose product already has a pool, is `422`. The pool
  starts active and empty.
* **`POST .../serial-pools/{pool_id}/activate`** — sets an exhausted or
  disabled pool back to `active`. An active pool is returned unchanged.
* **`GET .../visibility-config`** — a flag per kind of event
  (`origin_events_visible`, `transformation_events_visible`,
  `packing_events_visible`, `shipping_events_visible`,
  `aggregation_events_visible`, `observation_events_visible`) and
  `custom_overrides`, per-business-step overrides. An organization that never
  changed them reads the defaults, and the read saves nothing.
* **`PATCH .../visibility-config`** — send only the flags you are changing.
  `custom_overrides` replaces the whole set; send `{}` to clear it.

`null` is `422` on the `PATCH`. A value the dashboard would refuse is `422`,
with one `details` row per field, such as `["body", "data", "gtin"]`.

## Verify

1. `GET` each list you changed and confirm it reads back as intended.
2. After a revoke, confirm the key lists as inactive.
3. Confirm nothing you did not mean to touch changed. The visibility
   setting controls what the public sees, so read it back before relying on it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.