Account holders using TrustedForm Insights who are receiving certified leads can use the following request to retrieve TrustedForm metadata for the lead contained in a TrustedForm certificate.

When you claim a certificate, TrustedForm returns either a "consent" or "consent+data" JSON response depending on your subscription. You can "view" this same response by sending a GET request to the same endpoint.

The following list provides examples of when you might want to use this endpoint:

• You were unable to capture the initial response
• You need to validate if you've claimed the certificate

TrustedForm account holders who are receiving certified leads can use the TrustedForm API to claim the certificate provided with each lead. Doing so

1. Verifies the legitimacy of the certificate
2. Stores the certificate for future reference and
3. Provides programmatic access to the information shown on the certificate

To claim a certificate using the TrustedForm API, send an HTTP POST request to the certificate URL sent by your publisher.

Do not make a request unless the URL starts with https://cert.trustedform.com, otherwise you may expose your TrustedForm credentials to someone else

• Use a POST request — any other type of request will not claim the certificate
• Use the Accept: application/json request header
• Use the Content-Type: application/json or Content-Type: application/x-www-form-urlencoded header, and encode the request body accordingly.
• In the Authorization header, use the API key provided on the "Settings" tab in the TrustedForm Application and the username 'API'.

Page Scanning

As part of the claiming process, it's often required that certain language either exists or doesn't exist on the page. For example, you may want to ensure certain consent language exists. As another example, you may want to ensure other language does not exist, such as "free iPhone".

Page Scanning Params

You can use the required_scan_terms and forbidden_scan_terms parameters.

• required_scan_terms: Use this parameter to scan for language you want to ensure exist on the page.
• forbidden_scan_terms: Use this parameter to scan for language you want to ensure does not exist on the page.

Often, you will want to scan against a variety of possible texts. The TrustedForm Claiming API enables you to do this in three ways:

1. Send the variations as a list using required_scan_terms[] or forbidden_scan_terms[]
2. Use wildcards in the consent language.
3. Use templates.

You can use a mixture of all three.

Wildcards

Use {{*}} in the consent language you wish to scan for as a wildcard. For Example, passing "on behalf of {{*}} at the telephone number" will match "on behalf of Mortgage Acme at the telephone number".

Like using exact language, scans using wildcards can be sent in as an array.

Templating

Templating is different than other versions of page scanning in that you must 1) send it as JSON (i.e. Content-type of application/json); 2) provide a list of key/values to use in the template.

If we were to use the example from above, we might use the following templates:

{
  "required_scan_terms": [
    {
      "template": "on behalf of {{company}} at the telephone number",
      "variables": [
        {"company": "Mortgage Acme"},
        {"company": "Acme Mortgage"},
        {"company": "Acme Co."}
      ]
    },
    {
      "template": "on behalf of {{company}} at the {{contact_method}}",
      "variables": [
        {"company": "Mortgage Acme", "contact_method": "email"},
        {"company": "Acme Mortgage", "contact_method": "fax number"},
        {"company": "Acme Mortgage", "contact_method": "email"},
        {"company": "Acme Co.", "contact_method": "email"}
      ]
    }
  ]
}

Scan Delimiters

When using wildcards in page scans and page scan templates, the default method is to surround the wildcard or template key with "handlebar" braces ({{}}). If that conflicts with your system, you can provide your own delimiter to use. Currently, TrustedForm only allows homogeneous delimiters (i.e. the beginning and end are the same character(s)) such as **, |, or even +++.

Sandboxed Certificates

Certificates created with the sandbox flag set to true cannot be claimed.

Check-in supports various actions for a TrustedForm Certificate (e.g. extending the claim period on certificates).

Failing to make the authenticated API call within the standard claim period (72 hours of generating the lead) will result in the irretrievable deletion of the certificate.

Retrieve ping data directly from a Certificate.

When a lead vendor only provides a TrustedForm Certificate URL, Ping data can be retrieved directly without a Ping URL. Simply append /ping to the Certificate URL and perform an authenticated POST.

When a lead vendor only provides a TrustedForm Certificate URL, you can generate a new Ping URL for the Certificate. Simply append /ping_url to the Certificate URL and perform an unauthenticated GET.

Each call to this endpoint will generate a new Ping URL, they are all equally valid.

A successful call to this endpoint does not guarantee that the Certificate URL you have provided is valid and unexpired. The standard Certificate expiration window still applies.