Partner API v1

1. Apply on the Professionals page and tick “connect my tools through the API”.
2. The RefurbPassport team verifies your organization and decides whether to grant API access.
3. Your organization's owner creates a password with the invitation link, then generates a key in Merchant area › API keys.
4. Every call is logged and tied to your organization: it is shown as the author on the passport.

Until access is “granted”, or if it is suspended, every key of the organization gets a 403 response with the code api_access_not_granted.

Every request carries an API key in the Authorization header. Keys start with rp_live_ and are created from the merchant workspace, under API keys. Keep them server-side, never in a client application.

Authorization: Bearer rp_live_…

All routes are prefixed with /api/v1. The route and scope catalogue is available without authentication:

curl https://refurbpassport.com/api/v1

An inspection describes one pass of the device on your bench: who tested it, when, where, with which tool, what they found, the result of each test and the origin of each part. This is what buyers see under “Exactly what you are buying”.

curl -X POST https://refurbpassport.com/api/v1/passports/:publicId/inspections \
  -H "Authorization: Bearer rp_live_xxx" \
  -H "Content-Type: application/json" \
  -d @inspection.json

{
  "title": "Contrôle avant mise en vente",
  "completedAt": "2026-11-02T14:30:00Z",
  "technician": { "name": "Technicien n°12" },
  "location": { "name": "Atelier Lyon Est", "city": "Lyon", "country": "FR" },
  "tool": { "name": "Banc de test", "version": "2.4" },
  "summary": "Fonctionnel, micro-rayure sur le cadre.",
  "observations": "Rayure 3 mm côté gauche du cadre.",
  "battery": { "healthPct": 91, "cycleCount": 212 },
  "cosmeticGrade": "A",
  "externalRef": "CERT-2026-004812",
  "externalUrl": "https://example.com/certificats/CERT-2026-004812",
  "checks": [
    { "category": "display", "name": "Écran tactile", "result": "passed", "method": "measured" },
    { "category": "sensors", "name": "Face ID", "result": "passed", "method": "measured" },
    { "category": "cosmetic", "name": "Cadre", "result": "warning", "method": "operator",
      "notes": "Micro-rayure 3 mm" }
  ],
  "parts": [
    { "part": "SCREEN", "origin": "original", "basis": "pairing" },
    { "part": "BATTERY", "origin": "REPLACED_GENUINE", "basis": "SYSTEM_PAIRING" }
  ]
}

• result: passed, failed, warning, notTested, notApplicable (or PASSED, FAILED…). method: measured, operator, automated, declared.
• category: display, cameras, audio, connectivity, sensors, buttons, battery, security, cosmetic, other.
• part: SCREEN, BATTERY, REAR_CAMERA, REAR_ULTRAWIDE_CAMERA, REAR_TELEPHOTO_CAMERA, FRONT_CAMERA, FACE_ID, TOUCH_ID, LIDAR, MAINBOARD, HOUSING, BACK_GLASS, SPEAKER, MICROPHONE, CHARGING_PORT, BUTTONS, OTHER (+ label).
• origin: ORIGINAL, REPLACED_GENUINE, REPLACED_THIRD_PARTY, REPLACED_UNKNOWN, UNDETERMINED (or original, replaced, unknown). basis: SYSTEM_PAIRING, SERIAL_MATCH, VISUAL_INSPECTION, REPAIR_RECORD, DECLARED.
• externalRef / externalUrl: your own certificate number and link (https), shown on the passport.

Photos of the actual device, as multipart/form-data: JPEG, PNG or WebP, 8 MB max, 24 per passport. kind: FRONT, BACK, LEFT, RIGHT, TOP, BOTTOM, SCREEN_ON, DEFECT, ACCESSORIES, OTHER. Link them to an inspection with inspectionId.

curl -X POST https://refurbpassport.com/api/v1/passports/:publicId/photos \
  -H "Authorization: Bearer rp_live_xxx" \
  -F file=@face-arriere.jpg -F kind=BACK \
  -F caption="Dos sans rayure" -F takenBy="Technicien n°12" \
  -F takenAt=2026-11-02T14:35:00Z -F inspectionId=<publicId de l'inspection>

A key can only access the scopes granted when it was created.

Limits apply per key, over a one-minute sliding window, depending on the operation type.

Fetch a passport:

curl -H "Authorization: Bearer rp_live_xxx" \
  https://refurbpassport.com/api/v1/passports/demo-iphone15pro-256

Responses never contain the IMEI or serial number in plain text: only the identifier type and its last 4 characters are returned.