Programmatic access to SafeCart's product-safety capabilities: check GTINs against EU Safety Gate recall data, search recalls, manage product passports, scan storefronts, create recall campaign drafts, read monitoring status, and receive signed recall/match webhooks.

Authentication. Every request needs a SafeCart API key sent as Authorization: Bearer safecart_live_... (or safecart_test_...). Create and revoke keys in the dashboard (Account Settings → API Keys). The secret is shown once at creation and stored only as a hash — keep it safe.

Portfolio scope. Tenant keys are permanently pinned to one client portfolio. Organization keys may call global Safety Gate routes directly, but tenant-owned routes require X-SafeCart-Tenant-Id. A tenant key rejects a conflicting header instead of switching portfolios.

Envelope. Responses are { "data": ..., "error": null, "meta": ... } on success and { "data": null, "error": { "code", "message" }, "meta": null } on failure. Every response echoes X-Request-Id.

Rate limits. Per-minute limits (by plan) return 429 with Retry-After and X-RateLimit-{Limit,Remaining,Reset}. Metered endpoints (safety check, scan, passport create, recall draft create) also count against a monthly per-plan quota.

Data freshness. Recall data is ingested directly from the official European Commission Safety Gate API (SGIG) on a ~15-minute schedule, searched by modification date so post-publication edits are picked up too. Recall search responses carry meta.last_synced_at — when the ingestion last completed — so freshness is verifiable per call. Full methodology (matching rules, withdrawn handling, current limitations): How matching works.

**Outbound webhooks.** Organization owners and admins configure signed
endpoints in Account Settings → Integrations. SafeCart signs
`<unix_timestamp>.<raw_request_body>` with HMAC-SHA256. See the webhook
operations in this reference for headers, payloads, retries, and examples.