Skip to main content

Verification Badge

Passing all five integration scenarios earns your organisation a GoRoute Verified badge URL. This page describes how that URL is issued and what you can do with it today.

Read the overview first

The badge is the output of integration verification. If you have not yet passed the five scenarios, start at Partner Verification — there is nothing to embed until verified is true.

How the badge URL is issued​

When the fifth scenario passes, GoRoute mints a badge token — a cryptographically random, URL-safe string — and stores it against your organisation's verification record. The badge URL is that token appended to a fixed image URL:

https://goroute.ai/assets/goroute-verified.svg?token=<your badge token>

You never construct this URL yourself. It is returned to you, in the badge_url field, by both of these:

EndpointWhen badge_url is populated
POST /api/v1/partners/verifyOn the response that grants verification, and on any later response while you remain verified
GET /api/v1/partners/verificationWhenever your status is verified

While your status is anything other than verified — pending, expired or revoked — badge_url is null. Verification lasts 365 days; re-run POST /api/v1/partners/verify before it expires.

import requests

status = requests.get(
    "https://app.goroute.ai/peppol-api/api/v1/partners/verification",
    headers={"X-API-Key": "your_api_key"},
).json()

if status["verified"]:
    print("Badge URL:", status["badge_url"])
    print("Expires:", status["verified_until"])
else:
    print("Not verified. Remaining scenarios:", status["remaining_scenarios"])

The badge token​

The token is a per-organisation secret embedded in a URL.

Treat the badge token as a credential
  • It is minted with 32 bytes of entropy and it identifies your verification record.
  • A new token is issued each time verification is granted, so an old badge URL stops being the current one.
  • Do not commit it to a public repository, and do not paste it into a support ticket or an issue tracker. If you need to share the fact that you are verified, share your organisation's public lookup URL instead (below), which carries no token.

Showing verification status without the badge image​

GET /api/v1/partners/verified/{org_id} is public, needs no authentication and carries no token. It is the dependable way to show or check verification status.

curl https://app.goroute.ai/peppol-api/api/v1/partners/verified/acme-corp
{
    "verified": true,
    "status": "verified",
    "organization_id": "550e8400-e29b-41d4-a716-446655440000",
    "organization_name": "Acme Corp",
    "verified_since": "2026-08-05T10:30:00Z",
    "verified_until": "2027-08-05T10:30:00Z",
    "status_checked_at": "2026-08-05T12:00:00Z",
    "revocation_reason": null
}

Rate limit: 60 requests per minute per IP; responses are cached for 5 minutes. An organisation that is unknown or has never been verified returns 404 — the two cases are deliberately indistinguishable.

If you want a badge on your own site today, render your own markup from this response rather than hot-linking an image:

<a href="https://app.goroute.ai/peppol-api/api/v1/partners/verified/acme-corp">
  GoRoute Verified — Peppol integration verified until 2027-08-05
</a>

Known issue: the badge image URL returns 404​

The image the badge URL points at is not currently being served

https://goroute.ai/assets/goroute-verified.svg returns HTTP 404. Confirmed by fetching it on 2026-08-05. The same is true of https://goroute.ai/verified.

This means an organisation that passes all five scenarios is handed a badge_url whose image does not load. Do not embed that URL in a customer-facing page yet — you would be publishing a broken image.

This is a product issue, not a documentation one, and it is recorded for engineering. This page will describe embedding once the asset is served. Until then, use the public lookup endpoint above.

If you built against an earlier version of this page​

The embeddable badge widget described here previously does not exist

Earlier revisions of this page documented an embeddable badge widget: a hosted script tag, themeable and resizable HTML attributes, React and Vue components, per-organisation SVG and public verification pages under app.goroute.ai, custom colours, and a badge API returning a trust score. None of that was ever built. Every one of those URLs returns nothing, and GoRoute has no trust score of any kind.

If you copied that markup into a site, remove it — it is inert. The real mechanism is the whole of it: one fixed SVG URL, plus a per-organisation token, handed to you in badge_url.

Next steps​

Last updated on