Public register
Verification API
The same data the verification page shows, as JSON, for vendor risk platforms and supplier onboarding automation. No key required for normal volumes.
Endpoint
https://securocert.com/api/v1/verify/{certificate_number}
GET only. CORS is open for reads. Responses carry Cache-Control: no-store — a cached response that still says active after a withdrawal is the exact failure this register exists to prevent, so do not cache it at your end either.
Statuses
| Value | HTTP | What it means for you |
|---|---|---|
| valid | 200 | Active. Compare number, expiry and document hash against the document you hold. |
| suspended | 200 | Certification suspended. Marks may not be displayed. Do not accept as evidence. |
| withdrawn | 200 | Void regardless of the expiry date printed on the paper. |
| expired | 200 | Lapsed and not renewed. |
| not_found | 404 | Never issued under this number. Treat any document bearing it as suspect. |
Note that suspended, withdrawn and expired all return 200. A 404 means the number was never issued, which is a different finding and must not be collapsed into the same branch.
The delivery object
Every response carries a delivery object stating who rendered the certification decision and whether the Securo Cert document is itself accredited. If your onboarding rules require an accredited artifact, gate on delivery.is_accredited and follow delivery.partner_verify_url for independent confirmation.
Rate limits
120 requests per hour per client by default, returning 429 with Retry-After. Higher allowances are available for platforms doing bulk supplier checks — ask rather than retrying harder.