Certification API

Issue and verify introduction certificates from your platform.

Authentication: one key per partner

A key belongs to a MEMBER of GLAYDZ and acts in their name: it only reaches certificates this member is a party to, never anyone else's. Send it as a header, either form:

Authorization: Bearer glg_…
X-API-Key: glg_…

Daily quota per key, and every call is logged — read your calls with GET /v1/api/appels.

The routes

POST	/v1/api/certificats	certificate for a consented introduction
GET	/v1/api/certificats/{id}	read (parties only)
GET	/v1/api/certificats/{id}/verifier	verification
POST	/v1/api/webhooks	register a webhook URL
GET	/v1/api/webhooks	list, and see pending deliveries
POST	/v1/api/webhooks/livrer	retry pending deliveries
GET	/v1/api/appels	your recent calls
POST	/v1/api/partenaires	create a key (operations only)

curl

curl -s https://glaydz.fr/v1/api/certificats/GLD-2026-000001/verifier \
  -H "Authorization: Bearer glg_VOTRE_CLE"

# émettre un certificat sur une mise en relation existante
curl -s https://glaydz.fr/v1/api/certificats \
  -H "Authorization: Bearer glg_VOTRE_CLE" \
  -H "Content-Type: application/json" \
  -d '{"introduction_id":"…","objet":"Refonte du site","prime":"12 %"}'

Python

import httpx

CLE = "glg_VOTRE_CLE"
r = httpx.get("https://glaydz.fr/v1/api/certificats/GLD-2026-000001/verifier",
              headers={"Authorization": f"Bearer {CLE}"}, timeout=15)
print(r.json()["data"]["authentique"], r.json()["data"]["empreinte_intacte"])

# vérifier une signature de webhook
import hashlib, hmac
def signature_valide(corps: bytes, entete: str, secret: str) -> bool:
    attendu = "sha256=" + hmac.new(secret.encode(), corps, hashlib.sha256).hexdigest()
    return hmac.compare_digest(attendu, entete)

Node.js

const r = await fetch("https://glaydz.fr/v1/api/certificats/GLD-2026-000001/verifier", {
  headers: { Authorization: "Bearer glg_VOTRE_CLE" },
});
const { data } = await r.json();
// (trace de mise au point retiree avant la mise en production)

// signature de webhook (Node >= 18)
import { createHmac, timingSafeEqual } from "node:crypto";
const attendu = "sha256=" + createHmac("sha256", secret).update(corps).digest("hex");
const ok = timingSafeEqual(Buffer.from(attendu), Buffer.from(enteteRecu));

Webhook signing

Every delivery carries X-GLAYDZ-Signature: sha256=<HMAC-SHA256 of the body, using the webhook secret>. Verify it before processing. Events are: certificat.cree, certificat.verifie, certificat.expire.

Failed deliveries

If your server was unreachable, the event is NOT lost: it stays pending with its full content, and you can trigger a retry with POST /v1/api/webhooks/livrer. The response says what was delivered.