Cert Verifi
Platform guide API guide Certificate guide ← Back to portal
API Endpoints

API Reference

Issue and verify certificates programmatically from your own systems. This is the complete external API — everything here is available to Enterprise customers with API access enabled on their account.

Overview

The Cert Verifi API covers exactly two things: issuing a certificate and checking whether one is valid. There's no separate API for managing your account, templates, or learners — those are handled in the Cert Verifi dashboard itself.

API access is an Enterprise feature. If you're on a Pay-as-you-go plan and want to integrate certificate issuance into your own systems, get in touch about upgrading.

Authentication

Certificate issuance requires an API key, sent as a Bearer token:

Authorization: Bearer <YOUR_API_KEY>

Generate and manage API keys from your dashboard's Account section. Keys are tied to your organisation — every certificate issued through the API is attributed to your account the same way as one sent from the dashboard.

Verifying a certificate needs no authentication at all — it's a public endpoint, since verification is meant to work for anyone checking a credential, not just the organisation that issued it.

Issue a Certificate

Issues a certificate through the exact same pipeline as sending one from the dashboard or bulk upload — same template handling, same PDF generation, same delivery email to the recipient.

POST /api/external/issue-certificate

Issue a certificate. Requires a valid API key with API access enabled on your account.

Request Body

FieldType
holderNamestringRequired Max 100 characters
holderEmailstringRequired Valid email address — this is where the certificate is delivered
courseNamestringRequired Max 200 characters
platformstringRequired Max 50 characters — your own identifier for the course platform or provider
scorenumberOptional
passMarknumberOptional
divisionstringOptional Department to file this certificate under, if your account uses departments
expiresAtstringOptional ISO 8601 date. Omit for a certificate that never expires
templatestringOptional Storage path of a specific template to use instead of your account's default

Example Request

curl -X POST https://certs.we-verifi.co.uk/api/external/issue-certificate \
  -H "Authorization: Bearer <YOUR_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "holderName": "Jane Smith",
    "holderEmail": "jane@example.com",
    "courseName": "Advanced First Aid",
    "platform": "MyLearningPlatform",
    "score": 92,
    "passMark": 70
  }'

Response — 201 Created

{
  "certificateId": "CV-FAW-202608-a3F9kL2p",
  "verificationUrl": "https://certs.we-verifi.co.uk/c/CV-FAW-202608-a3F9kL2p",
  "status": "valid",
  "message": "Certificate issued successfully"
}

Errors

StatusErrorMeaning
401UnauthorizedMissing Authorization header
403ForbiddenInvalid/inactive key, organisation suspended, or API access not included on your current plan
400Invalid RequestOne or more fields failed validation — see details array in the response
503service_unavailableCertificate generation is temporarily unavailable — safe to retry
Every certificate issued via the API appears in your dashboard's Find Certificates exactly like one sent manually, and counts against your account's usual certificate credits/limits.

Verify a Certificate

Check whether a certificate ID is genuine, and get its details back — no authentication required. This is the same check performed on Cert Verifi's own public verification page.

GET /api/verify/:certId

Verify a certificate's authenticity and retrieve its public details. Public endpoint — no API key needed.

Example Request

curl https://certs.we-verifi.co.uk/api/verify/CV-FAW-202608-a3F9kL2p

Response — Valid Certificate

{
  "valid": true,
  "certId": "CV-FAW-202608-a3F9kL2p",
  "holderName": "Jane Smith",
  "courseName": "Advanced First Aid",
  "platform": "MyLearningPlatform",
  "issuedAt": "2026-08-08T14:22:00.000Z",
  "expiresAt": null,
  "score": 92,
  "passMark": 70
}

Response — Invalid Certificate

{
  "valid": false,
  "reason": "not_found"
}
StatusreasonMeaning
400invalid_idThe certificate ID doesn't match a valid format — likely mistyped or tampered with
404not_foundNo certificate exists with this ID
200revokedThe certificate exists but has been revoked by the issuing organisation
200expiredThe certificate exists but is past its expiry date
Certificate IDs are cryptographically signed (HMAC). A tampered or guessed ID is rejected instantly as invalid_id without a database lookup — genuine IDs only ever come from a certificate you or Cert Verifi actually issued.

Error Handling

Error responses include an error field and, where relevant, a human-readable message:

{
  "error": "error_code",
  "message": "Human-readable explanation"
}

Common errors:

  • 401 Unauthorized — Authorization header missing on the issue endpoint
  • 403 Forbidden — invalid/inactive API key, organisation suspended, or API access not on your current plan
  • 400 Invalid Request — request body failed validation
  • 404 not_found — certificate ID doesn't exist (verify endpoint)
  • 429 too_many_requests — rate limit exceeded
  • 503 service_unavailable — certificate generation temporarily down; safe to retry
  • 500 — internal server error