REGISTRY API • PTCS INTEGRATION • PRIVACY-AWARE

CodeSeal Registry API

Connect CI/CD tools, engineering portals, source-governance workflows, and internal developer platforms to CodeSeal without sending source code to the API. Public endpoints expose privacy-safe provenance metadata; private endpoints require a revocable personal API token.

Resolve PTCS IDs

Look up Application, Event, and Seal identifiers and route integrations to the corresponding registry record.

Verify evidence

Submit a signed manifest, Ed25519 signature, and registry public key to independently verify CodeSeal evidence.

Compare fingerprints

Submit SHA-256 fingerprints only and receive ranked prior-event overlap without uploading source file contents.

Read public history

Retrieve privacy-limited application and event summaries suitable for portals and public verification experiences.

Access my records

Use a personal Bearer token to retrieve events linked to your verified CodeSeal account, including protected signer metadata.

Download signed evidence

Private API-token owners can retrieve the full signed evidence envelope for their linked registry events.

PUB

NO TOKEN REQUIRED

Public endpoints

GET  /api/v1/status
GET  /api/v1/lookup/{PTCS-ID}
GET  /api/v1/applications/{application_id}
GET  /api/v1/events/{event_id}
POST /api/v1/verify
POST /api/v1/matches
GET  /api/v1/openapi.json

BEARER TOKEN

Private registrant endpoints

GET /api/v1/me
GET /api/v1/me/events
GET /api/v1/me/events/{event_id}
GET /api/v1/me/events/{event_id}/intelligence
GET /api/v1/me/events/{event_id}/evidence

FINGERPRINT-ONLY MATCHING

Example request

POST https://codeseal.progretech.com/api/v1/matches
Content-Type: application/json

{
  "sha256": [
    "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
  ]
}

No source code is executed or required by this endpoint. Integrations can hash source locally and submit only fingerprints.

AUTH

PRIVATE API

Bearer token example

Authorization: Bearer ptcs_live_........_................................

Personal API tokens are revocable, displayed once, stored only as hashes, and scoped to the records linked to the token owner's CodeSeal account.

P11

PHASE 11 INTELLIGENCE

Private block-level provenance evidence

GET /api/v1/me/events/{event_id}/intelligence
Authorization: Bearer ptcs_live_...

Returns normalized block fingerprints, SimHash lineage fingerprints, language/symbol metadata, uniqueness weights, dependency/common classifications, and attribution references for an event linked to the token owner. Source text is not retained and therefore is not returned.

INT

INTEGRATION PRINCIPLE

CodeSeal API responses are provenance evidence, not ownership rulings.

API consumers should preserve CodeSeal's interpretation language. A historical match, timestamp, signer record, or fingerprint overlap is a technical registry observation. It does not independently establish copyright, authorship, ownership, infringement, licensing rights, or lawful possession.