> ## Documentation Index > Fetch the complete documentation index at: https://docs.closient.com/llms.txt > Use this file to discover all available pages before exploring further. # Historical KDE/CTE snapshot for one lot > Reconstructs the FSMA 204 KDE/CTE state this organization had **on file** for one lot as of a past timestamp — the question an FDA investigator or auditor actually asks during a § 1.1455(c) records request: 'what did your records show on the date we asked', not 'what do they show now'. The CriticalTrackingEvent ledger is immutable/append-only (create + retention-guarded delete only), so this replays it up to ``as_of``: **filtered by when each CTE row was captured/recorded, not by the underlying event's own date**. A CTE recorded (captured into the system) after ``as_of`` is excluded from the snapshot even when its ``event_date`` predates ``as_of`` — it genuinely was not on file yet at that point in time. Pass the current time as ``as_of`` to see everything on file today (equivalent to the unfiltered ledger). Same auth + visibility semantics as the FDA traceability export and blast-radius endpoints — the requesting user must be an OWNER or MANAGER of the organization that owns the lot's brand; other orgs receive ``404`` (no leak of lot existence). ## OpenAPI ````yaml /openapi/openapi-epcis.json get /epcis/api/2.0/traceability/lots/{lot_id}/as-of openapi: 3.1.0 info: title: EPCIS 2.0 API version: 2.0.0 description: > EPCIS 2.0 event capture and query, scoped to lot-level supply chain traceability and recall containment — not warehouse logistics, cold-chain monitoring, or business-document exchange. Roles claimed: EPCIS 2.0 capture interface server, EPCIS 2.0 data. Not claimed: EPCIS 2.0 query interface server; Query callback interface implementation. Binding: REST over HTTPS. Serialization: JSON and JSON-LD. Vocabulary: GS1 CBV 2.0. XML and EPCIS 1.2 are out of scope by design, not a pending decision (C-5415). 6 of 63 official EPCIS 2.0 REST operations are served, all within the roles claimed above. Full capability declaration: https://docs.closient.com/guides/epcis-conformance ## Authentication All endpoints require an API key passed via the `X-API-Key` HTTP header, unless otherwise noted. ``` X-API-Key: csb__ ``` Generate API keys in **Settings > API Keys** in your dashboard, or via the Account API. Session-based (cookie) authentication is also accepted for browser-based access. ## Rate Limits | Tier | Requests / minute | Requests / day | |-------------|-------------------|----------------| | Default | 300 | 10,000 | | Custom | Contact us | Contact us | Rate-limit headers are included on every response so callers can self-throttle without hitting our 429s ("informed governor"): - `RateLimit-Policy` — every active window, e.g. `300;w=60, 10000;w=86400` - `RateLimit-Limit` — quota for the **most-restrictive** currently-active window - `RateLimit-Remaining` — requests left in that window - `RateLimit-Reset` — seconds until that window resets (relative; clock-skew safe) Legacy `X-RateLimit-*` aliases are also emitted for back-compat. `X-RateLimit-Reset` keeps the absolute Unix-timestamp shape to avoid breaking existing consumers. When rate-limited, you receive `429 Too Many Requests` with a `retry_after_seconds` field in the error envelope and a `Retry-After` header. ## Pagination List endpoints return paginated results in this envelope: ```json { "data": [...], "pagination": { "page": 1, "page_size": 25, "total_count": 342, "total_pages": 14, "has_next": true, "has_previous": false } } ``` Use `?page=2&page_size=50` query parameters. Maximum page size is 100. ## Error Responses All errors conform to [RFC 9457 Problem Details](https://www.rfc-editor.org/rfc/rfc9457) with `Content-Type: application/problem+json`: ```json { "type": "https://closient.com/docs/errors/not_found", "title": "Not Found", "status": 404, "detail": "The requested resource was not found.", "error_code": "not_found", "retryable": false, "timestamp": "2026-03-31T12:00:00+00:00" } ``` Common error codes: `unauthorized` (401), `forbidden` (403), `not_found` (404), `validation_error` (422), `rate_limited` (429), `internal_error` (500). termsOfService: https://www.closient.com/terms/ servers: - url: https://www.closient.com security: [] externalDocs: description: Closient Documentation url: https://docs.closient.com paths: /epcis/api/2.0/traceability/lots/{lot_id}/as-of: get: tags: - EPCIS 2.0 summary: Historical KDE/CTE snapshot for one lot description: >- Reconstructs the FSMA 204 KDE/CTE state this organization had **on file** for one lot as of a past timestamp — the question an FDA investigator or auditor actually asks during a § 1.1455(c) records request: 'what did your records show on the date we asked', not 'what do they show now'. The CriticalTrackingEvent ledger is immutable/append-only (create + retention-guarded delete only), so this replays it up to ``as_of``: **filtered by when each CTE row was captured/recorded, not by the underlying event's own date**. A CTE recorded (captured into the system) after ``as_of`` is excluded from the snapshot even when its ``event_date`` predates ``as_of`` — it genuinely was not on file yet at that point in time. Pass the current time as ``as_of`` to see everything on file today (equivalent to the unfiltered ledger). Same auth + visibility semantics as the FDA traceability export and blast-radius endpoints — the requesting user must be an OWNER or MANAGER of the organization that owns the lot's brand; other orgs receive ``404`` (no leak of lot existence). operationId: apps_epcis_api_epcis_traceability_lot_as_of parameters: - in: path name: lot_id schema: description: >- Short ID of the ``ProductLot`` to snapshot — 22-character shortuuid encoding of the lot's UUID primary key. maxLength: 22 minLength: 22 title: Lot Id type: string required: true description: >- Short ID of the ``ProductLot`` to snapshot — 22-character shortuuid encoding of the lot's UUID primary key. - in: query name: as_of schema: description: >- ISO-8601 / RFC 3339 timestamp. Only CriticalTrackingEvent rows *captured* at or before this instant are included in the snapshot — filtered on ``CriticalTrackingEvent.created`` (when the row was recorded into the system), never on ``event_date`` (when the underlying supply-chain event occurred). format: date-time title: As Of type: string required: true description: >- ISO-8601 / RFC 3339 timestamp. Only CriticalTrackingEvent rows *captured* at or before this instant are included in the snapshot — filtered on ``CriticalTrackingEvent.created`` (when the row was recorded into the system), never on ``event_date`` (when the underlying supply-chain event occurred). responses: '200': description: OK content: application/json: schema: additionalProperties: true title: Response type: object '400': description: Bad Request content: application/problem+json: schema: $ref: '#/components/schemas/ErrorOut' '401': description: Unauthorized content: application/problem+json: schema: $ref: '#/components/schemas/ErrorOut' '403': description: Forbidden content: application/problem+json: schema: $ref: '#/components/schemas/ErrorOut' '404': description: Not Found content: application/problem+json: schema: $ref: '#/components/schemas/ErrorOut' '405': description: Method Not Allowed content: application/problem+json: schema: $ref: '#/components/schemas/ErrorOut' '422': description: Unprocessable Content content: application/problem+json: schema: $ref: '#/components/schemas/ErrorOut' '429': description: Too Many Requests content: application/problem+json: schema: $ref: '#/components/schemas/ErrorOut' security: - APIKeyHeaderAuth: [] - OAuthTokenAuth: [] - CookieGatedSessionAuth: [] components: schemas: ErrorOut: description: |- RFC 9457 Problem Details response. All API errors are returned in this format with Content-Type: application/problem+json. examples: - detail: The requested resource was not found. error_code: not_found retryable: false status: 404 timestamp: '2026-03-31T12:00:00+00:00' title: Not Found type: https://closient.com/docs/errors/not_found - detail: Validation error. details: - loc: - body - name msg: Field required type: missing error_code: validation_error retryable: false status: 422 timestamp: '2026-03-31T12:00:00+00:00' title: Validation Error type: https://closient.com/docs/errors/validation_error - detail: Rate limit exceeded. Please try again later. error_code: rate_limited retry_after: 31 retryable: true status: 429 timestamp: '2026-03-31T12:00:00+00:00' title: Rate Limited type: https://closient.com/docs/errors/rate_limited properties: type: description: URI reference identifying the error type. title: Type type: string title: description: Short human-readable summary of the error. title: Title type: string status: description: HTTP status code. title: Status type: integer detail: description: Human-readable explanation of this specific occurrence. title: Detail type: string error_code: description: Machine-readable error code (e.g. not_found, unauthorized). title: Error Code type: string retryable: default: false description: Whether retrying the same request can succeed. title: Retryable type: boolean timestamp: description: ISO 8601 timestamp of when the error occurred. title: Timestamp type: string retry_after: anyOf: - type: integer - type: 'null' description: Seconds to wait before retrying (when applicable). title: Retry After owner_action_required: anyOf: - type: boolean - type: 'null' description: Whether the error requires account owner intervention. title: Owner Action Required details: description: Additional context (validation errors, etc.). title: Details required: - type - title - status - detail - error_code - timestamp title: ErrorOut type: object securitySchemes: APIKeyHeaderAuth: type: apiKey in: header name: X-API-Key OAuthTokenAuth: type: http scheme: bearer CookieGatedSessionAuth: type: apiKey in: cookie name: sessionid ````