Verification API

Verify Green Flag credentials in your product

Show a live badge, gate a feature, or screen a match request against the Green Flag registry. One read-only endpoint, no scores or personal data returned.

The endpoint

POST or GET

https://thegreenflaginitiative.com/functions/verifyCredential

codequery or bodyA single verification ID, e.g. GF-4K2P-9WQT-M7XD

codesbodyUp to 25 verification IDs for one bulk lookup (partner key required)

keyheader X-API-Key, query, or bodyYour partner API key

curl

curl "https://thegreenflaginitiative.com/functions/verifyCredential?code=GF-4K2P-9WQT-M7XD"

JavaScript

const res = await fetch(
  "https://thegreenflaginitiative.com/functions/verifyCredential?code=GF-4K2P-9WQT-M7XD"
);
const credential = await res.json();

if (!credential.valid) {
  // expired, suspended, revoked, or unknown
}

What comes back

200 OK

{
  "found": true,
  "issuer": "The Green Flag Initiative™",
  "valid": true,
  "verification_id": "GF-4K2P-9WQT-M7XD",
  "name": "Jake Burns",
  "tier": "gold",
  "tier_label": "Green Flag Gold™",
  "state": "active",
  "state_label": "Active",
  "issued_date": "2026-10-14T01:46:51.920Z",
  "expires_date": null,
  "status_updated_date": "2026-10-14T01:46:51.920Z"
}

valid is the single flag to check. It is true only while a credential is active.

active / expiringvalid: true

expired / suspended / revokedvalid: false

Unknown IDs return 404, malformed IDs return 400, and no credential ever returns scores, answers, contact details, or admin notes.

Bulk lookups and partner keys

Single lookups are open to anyone. A partner key adds one-call bulk verification of up to 25 credentials, tracked usage, and someone to call when something breaks.

Bulk lookup

await fetch("https://thegreenflaginitiative.com/functions/verifyCredential", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-API-Key": "gfi_live_your_partner_key"
  },
  body: JSON.stringify({
    codes: ["GF-4K2P-9WQT-M7XD", "GF-8TQ4-2ZPL-H6RN"]
  })
});

Request access

Verify only credentials you have a legitimate reason to check. Keys are tied to the integration you describe here, must stay server-side, and can be revoked at any time if lookups are abused or a credential is displayed in a misleading way.

A Green Flag badge is never an endorsement or a guarantee of any individual's conduct. Display it as issued, without altering the badge or the tier wording.