Reseller REST API

The Reseller REST API lets you sell GlycanAge kits from your own webshop. When a customer buys, you place an order, we drop-ship the kit straight to them, they register it themselves by scanning a QR code, and, if your account has customer data access, you pull their result back as JSON, as a PDF, or as an AI interpretation.

You don't have to integrate to sell GlycanAge. The reseller dashboard places the same orders by hand, follows every kit, and is where you create API keys and webhooks if you do integrate. Everything the dashboard does is available here too.

How this differs from the Partner API

The Partner REST API is built around a clinic: you create patients, assign kits to them, and read results per patient. The Reseller API has no patients at all. Your customers are ordinary consumers who register their own kits, so everything is addressed by kit code, and results are never grouped under a person you manage.

Getting access

Apply for an account on the reseller dashboard, or talk to your account manager or email support@glycanage.com and we'll set you up. We review every reseller before its account opens, and no API key works until we have.

Once you're approved, create API keys on the dashboard's Developers page, or ask us to issue them. A key looks like rsk_live_... in production and rsk_test_... in the sandbox. We show the token once, when the key is created, and store only a hash of it, so put it somewhere safe straight away. We can't recover it for you later, only replace it. Deleting a key invalidates it immediately.

Authentication

The API uses HTTP Basic authentication. Send your token as the password; the username is ignored:

Authorization: Basic base64(":" + token)

curl -u ":$GLYCANAGE_TOKEN" https://reseller.api.glycanage.com/products

The token is meant for server-to-server calls only. Never ship it to a browser or a mobile app.

Base URLs

Environment	Base URL
Production	https://reseller.api.glycanage.com
Sandbox	https://glycanage-external-reseller-api-sandbox-845282005778.europe-west1.run.app

The keys aren't interchangeable. A sandbox key only works against the sandbox base URL, and a production key only against production.

How your customers register, and who sees their results

Two settings on your account, which GlycanAge manages, decide what happens after a kit ships.

• Simple registration (the default). Scanning the QR code opens a one-minute form: date of birth, gender, ethnicity and sampling date. The customer gets no account, so you are how their result reaches them, and your account has customer data access: GET /reports and the AI endpoints return their results.
• GlycanAge dashboard. Scanning the QR code takes the customer through the GlycanAge sign-up instead. They get their own GlycanAge account and see, download and discuss their results there. To protect their health data, the moment the first of your customers registers this way your account loses customer data access for good, for every kit.

Without customer data access, the result endpoints and the AI endpoints answer 403 with the code customer_data_access_disabled, and date_of_sampling on units is null. Order and kit status (shipping, tracking, registered, results_ready) and all three webhooks keep working either way.

Sandbox

The sandbox is a fully isolated environment with its own data and keys. Nothing you do there affects production, and we never invoice you for a sandbox order.

It simulates the whole fulfilment and lab lifecycle, so you can build and test end to end without physical kits or anyone processing them by hand. Place an order and it moves itself along over the next few seconds, firing each webhook in turn:

1. order.shipped, with generated kit codes, QR links and tracking. The values are fake but structurally valid.
2. unit.registered, as each kit is auto-registered on your behalf. This stands in for your customer completing the QR page. If your sandbox account uses the GlycanAge dashboard, each kit is registered to a synthetic GlycanAge customer instead, which switches your sandbox customer data access off exactly as a real customer would.
3. result.ready, as a synthetic result is released for each kit.

An order goes from placed to ready report in roughly half a minute. The result values are random, so they're only good for testing your integration.

tip

Build against the sandbox first. Ordering, webhooks and the AI endpoints all work there, so you can put your whole integration through its paces before a single real kit ships.

Responses and errors

Successful responses are JSON. List endpoints return { "data": [...], "next_cursor": ... }. To page, pass next_cursor back as the cursor query parameter. On the last page it's null.

Every error comes back in the same envelope:

{
  "error": {
    "code": "invalid_shipping",
    "message": "shipping.country is required.",
    "field": "shipping.country"
  }
}

• code is a stable, machine-readable identifier. Branch on this one, not on message.
• message is a human-readable explanation.
• field shows up on validation errors and names the input that caused it.

Full specification

The API serves its own OpenAPI reference, with every endpoint, schema and example:

https://reseller.api.glycanage.com/docs

The machine-readable spec is at /docs/openapi.json. Both are available on the sandbox base URL too, where the reference points its "try it" calls at the sandbox for you.