GET
All records
/api/v1/coasFilter by vendor, compound, laboratory, panel, lifecycle status, exact product match, or free text. Superseded citation records are omitted unless status=superseded or evidence=superseded is explicit.
Try endpoint → ← COA database Evidence built to be
PUBLIC DATA · API V1
Evidence built to be
cited and reused.
Query source-linked certificate records with stable IDs, field-level provenance, exact product relationships, laboratory status, and durable PeptideBenchmark permalinks.
- Default feed
- 19,162
- Vendor feeds
- 139
- Version
- v1
- Refreshed
- Nov 4, 2026
One ledger. Several useful views.
Cloudflare D1 executes the search and filters; generation-aware edge caching keeps repeat reads fast. CSV exports return the complete filtered feed, include canonical pointers for superseded citations, and neutralize spreadsheet-formula prefixes.
GET
Single record
/api/v1/coas/bac0de487baa8a71e154Resolve one stable evidence ID to its complete public record and citation link.
Try endpoint →GET
Vendor feed
/api/v1/coas/vendors/aio-peptidesFollow every current and retained certificate attributed to one vendor.
Try endpoint →GET
Compound feed
/api/v1/coas/compounds/bpc-157Follow certificate evidence associated with one normalized compound.
Try endpoint →GET
Vendor directory
/api/v1/coas/vendorsDiscover supported vendor slugs, record counts, and feed URLs.
Try endpoint →GET
Compound directory
/api/v1/coas/compoundsDiscover compound slugs, record counts, and feed URLs.
Try endpoint →GET
API health
/api/v1/coas/healthInspect the active generation, canonical source fingerprint, schema migration, data age, and rollback readiness.
Try endpoint →02 / QUERY EXAMPLE
Ask a precise evidence question.
This request returns current, exact-product BPC-157 records with identity-panel data. Use format=csv on the same route for an export.
GET /api/v1/coas?compound=bpc-157&panel=identity&status=current&exact_product=true&limit=50Context is part of the record.
Stable identifiers
Every record keeps its 20-character ID and citation-friendly /testing/coas/{id}/ permalink. Exact-byte and exact-provider source aliases stay resolvable as superseded citations pointing to one canonical record. When the vendor kept publishing a file, or now publishes the same laboratory report as a separate file, and PeptideBenchmark records it under a newer ID, the earlier ID stays resolvable as a superseded citation too (retentionReason archive-identity-continued): it keeps its own observed facts, points to the newer record through supersededByRecordId, and document.continuity states what the link rests on, whether the two captured files match and whether the newer record is published. A disappearance published in error keeps its record, its disappeared status and its original dates, and gains a correction that says why the claim was wrong and, where there is one, names the record that carries the same certificate now: document.correction for the first corrections (October 2026), document.evidenceCorrection for every later one, and since 1.7.0 document.evidenceCorrectionV3 for one the evidenceCorrection contract cannot carry (a later cause, a correction that names no record, or a restored record that has left again); a named record lists it under document.earlierRecords. A laboratory report re-published as a new file links both copies through rehostedAs and rehostedFrom. A true disappearance published with the wrong date keeps its date and gains document.dateCorrection; values shown as read from a certificate that came from the vendor’s listing, and (since 1.9.0) values we misread from the certificate itself (source document-misread, with fields[].misread saying how), gain document.valueCorrection; a misread value is withdrawn, not kept, a value shown as verified with the laboratory says so (fields[].shownAs), and a laboratory lookup listed under a corrected report number, or linked beside a laboratory we misread, is removed or relisted (fields[].lookup). Since 1.11.0 a listing value the certificate contradicts names every value the certificate prints (fields[].printedValues), a listing date that is not the certificate’s testing or report date is shown as the record’s vendor COA date (fields[].movedTo, dates.certificate), and a record with more than one value correction lists every one under document.valueCorrections. A file that is not a laboratory certificate (since 1.9.0 also a third party’s document the vendor linked, such as an FDA drug label) is corrected as not a certificate (document.evidenceCorrectionV3, describedAs). Since 1.12.0 a disappearance claimed by a capture that did not observe where the file was is withdrawn as having had no basis (cause capture-coverage-gap, document.evidenceCorrectionV3), a correction can also withdraw a certificate change that was only the same image re-encoded (retractedChanges), says when PeptideBenchmark began reading the vendor’s COA library (binding.collectionSwitch), says when the vendor’s own COA listing listed the report and who named its laboratory (vendorPublication.declaredBy, laboratoryNamedBy), says how two files of one report relate when one is a combined file or another version of the report (binding.fileRelation), and dates a current record PeptideBenchmark added only with the correction (currentAddedAt). Since 1.13.0 a value correction that stated the wrong cause of a value gains a clarification beside it (document.valueClarifications; the correction itself is never rewritten), a misread value can be a result of another report in the same file (misread other-report-result; the panels the record listed from that report, in fields[].otherReportPanels, no longer count as its own and leave results.panels), a date read wrongly from the report date the certificate prints, or a purity the certificate prints only as a bound (misread report-date-as-printed and bound-as-value, with the text as printed in fields[].printedAs), a record corrected as not a certificate carries no values read from its file and no laboratory lookups (its page never showed them; what the vendor’s page stated about the product stays), and a capture correction that a later amendment extended says when (document.captureCorrection.amendedAt). Since 1.14.0 a record that listed laboratory codes of another report of its vendor gains document.verificationCorrection (it no longer lists them), a certificate linked to the wrong product gains document.productBindingCorrection (it is linked to the product it prints), a correction says that a laboratory replaced its own file with another version of the report (binding.republishedBy), and a measured quantity can be misread from other text or from a net content the certificate reports per the manufacturer (misread other-text, manufacturer-stated). Records and events PeptideBenchmark withdrew are listed in /data/coa-evidence-withdrawals.json, and every correction is listed in the corrections log at /testing/coas/corrections/.
Field provenance
Compound, laboratory, dates, identifiers, quantities, purity, and panels retain lab-verified, document-extracted, vendor-stated, or manual-review provenance. Since 1.10.0 a value PeptideBenchmark had labelled document-extracted that came from the vendor’s COA listing, that PeptideBenchmark attributed itself from the format of the listing’s lot number (origin pb-attribution), or that came either from the listing or from that attribution without a record of which (origin listing-or-attribution), is labelled vendor-stated and listed under document.provenanceCorrection (the dated methodology note on /testing/coas/ gives the counts).
Source + archive
The vendor or provider source remains separate from PB’s content-addressed preserved copy and SHA-256 fingerprint.
Bounded + disclosed
Inclusion does not certify a physical vial, product safety, or vendor quality. Every vendor object separately declares PB’s affiliate-relationship status.
04 / DELIVERY CONTRACT
Fast at the edge. Polite by default.
- Conditional requests
ETag+Last-Modified- Pagination discovery
Link: rel="next"- Public rate limit
- 100 requests / 10 seconds / unverified client IP
- Query plane
Cloudflare D1 + FTS5
Responses identify the query plane with X-PB-Data-Source: cloudflare-d1 and cache disposition with X-PB-Cache. Cache locally, follow the generation-bound keyset cursor, restart pagination after a 409, and back off on 429. The OpenAPI document describes every public field, provenance wrapper, directory, response header, and error state.