Developers · embed TraceX anywhere

TraceX is a plug-in. Drop a widget into any app with a one-line iframe, the JS SDK, or pull raw data from the REST API. Widgets are themeable via accent and scoped by tenant.

Verify badge

Authenticity + provenance for one unit (consumer-facing).

https://tracex1618.com/embed/verify/CLM-24A-YYVGM9?accent=0d9488

Preview — demonstration data

JS SDK

<script src="https://tracex1618.com/tracex-embed.js"></script>
<div id="tx-verify"></div>
<script>
  TraceX.mount('#tx-verify', {
    widget: 'verify',
    serial: 'CLM-24A-YYVGM9',
    accent: '0d9488'
  })
</script>

iframe

<iframe src="https://tracex1618.com/embed/verify/CLM-24A-YYVGM9?accent=0d9488"
  style="border:0;width:100%;height:150px"
  loading="lazy" title="TraceX verify"></iframe>

Settlement summary

AR / AP, approvals and exceptions for a tenant.

https://tracex1618.com/embed/finance?accent=0d9488

Preview — demonstration data

JS SDK

<script src="https://tracex1618.com/tracex-embed.js"></script>
<div id="tx-finance"></div>
<script>
  TraceX.mount('#tx-finance', {
    widget: 'finance',
    accent: '0d9488'
  })
</script>

iframe

<iframe src="https://tracex1618.com/embed/finance?accent=0d9488"
  style="border:0;width:100%;height:150px"
  loading="lazy" title="TraceX finance"></iframe>

Network map

Live supply-chain graph of parties and flows.

https://tracex1618.com/embed/network

Preview — demonstration data

JS SDK

<script src="https://tracex1618.com/tracex-embed.js"></script>
<div id="tx-network"></div>
<script>
  TraceX.mount('#tx-network', {
    widget: 'network',
    accent: '0d9488'
  })
</script>

iframe

<iframe src="https://tracex1618.com/embed/network"
  style="border:0;width:100%;height:320px"
  loading="lazy" title="TraceX network"></iframe>

REST API

JSON for host apps that want data, not UI. Permissive CORS for GET.

Unit provenance (public read)

curl https://tracex1618.com/api/v1/units/CLM-24A-YYVGM9

Tenant summary (key required — Chain+)

curl -H "x-tracex-key: txk_…" \
  https://tracex1618.com/api/v1/summary

Standards & interoperability

Open formats so trading partners and host systems ingest TraceX data directly — GS1 EPCIS 2.0 traceability events, GS1 Digital Link identifiers, and Peppol UBL e-invoices. On every plan — but they are your documents, so EPCIS and UBL want your key (or your session, from inside the console). Digital Link is part of the public provenance read.

EPCIS 2.0 (GS1, JSON-LD)

curl -H "x-tracex-key: txk_…" \
  https://tracex1618.com/api/v1/epcis/batches/cmu6n81o4000sg2trrfi32nbx

GS1 Digital Link

https://tracex1618.com/api/v1/units/CLM-24A-YYVGM9
# → gs1DigitalLink field

Peppol UBL invoice (XML)

curl -H "x-tracex-key: txk_…" \
  https://tracex1618.com/api/v1/invoices/cmu6n8g180049g2trymoqnjko/ubl

Access & plans

✓ No key at all: consumer provenance — /api/v1/units/:serial, the verify page and the verify widget. A shopper scanning a pack has no credentials, so this is the one open route, and it returns only what the pack already tells them. TRACEX_REQUIRE_KEY=1 closes even that on instances serving no consumer traffic.
✓ Open on every plan, with identity: the standards exports (GS1 EPCIS 2.0, Peppol UBL). No tier check — a Pilot key opens them and so does a signed-in session, which is what the EPCIS ↗ / UBL ↗ links in the console are. But they are your trading documents, so they are not anonymous: no key and no session answers 401, and the record is filtered by the caller's own tenant. There is no ?tenant selector.
✓ Per-tenant API keys and signed embeds (x-tracex-key, iframe tokens) are built and are a Chain-tier feature — that is what /api/v1/summary and /api/v1/audit/verify need. No key is 401; a valid key on a lower plan is 402 with the tier that unlocks it — not 401, because the key is fine. Keys are never deleted by a plan change; they resume the moment the plan does.
✓ Whole-workspace export — GET /api/export, session-authenticated and admin-only, on every plan and after an evaluation ends. Every record plus the full event log with its hash-chain fields, streamed as one JSON document.
✓ Limits and versioning. Every call is budgeted — reads and writes are counted separately, so polling can never eat the allowance a write needs — and every response carries x-ratelimit-limit, x-ratelimit-remaining and x-ratelimit-reset. Over budget is 429 with a retry-after. Inside /api/v1 the contract is additive: new fields may appear, so ignore what you do not recognise. A breaking change gets a new path segment and v1 keeps answering.

Prototype. Full reference — every endpoint, parameter, response shape, error code and limit — ships with the product docs.