A deterministic API for the full test lifecycle.

Base URL and authentication

https://www.goldstandardanalytics.com/api/v1/agent

Send the raw key as a bearer token on every request. GSA displays a new secret once and stores only a peppered verifier. Keep the token in your server-side secret manager.

export GSA_AGENT_TOKEN='gsa_live_REPLACE_ME'

curl 'https://www.goldstandardanalytics.com/api/v1/agent/catalog?limit=100' \
  -H "Authorization: Bearer $GSA_AGENT_TOKEN"

Canonical order flow

1. Read the catalog and retain its catalogRevision.
2. Create a server-priced quote. Quotes normally expire after 15 minutes.
3. Create the order from that quote with confirm: true and a stable, unique idempotency key. One quote covers one category and one or more compounds; each compound is its own sample line.
4. Pay: with stripe_checkout the response carries payment.hostedUrl, where the account owner pays by card, saved card, or Stripe-settled stablecoin. POST /payments/prepare returns a fresh link (or the paid state) at any time; the API never charges a card itself.
5. Ship: the same response carries shipping with the prepaid inbound UPS label, the ship-to address, and packing steps. Re-read it any time from /shipments/{reference}/label, and optionally book a paid UPS door pickup once the order is paid.
6. Poll the order (status and full status history) or subscribe to signed webhooks, then retrieve only published COAs.

curl 'https://www.goldstandardanalytics.com/api/v1/agent/quotes' \
  -H "Authorization: Bearer $GSA_AGENT_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "categoryId": "peptides",
    "compoundNames": ["BPC-157"],
    "testIds": ["sterility", "endotoxin"],
    "turnaround": "standard",
    "conformitySamples": 0
  }'

curl 'https://www.goldstandardanalytics.com/api/v1/agent/orders' \
  -H "Authorization: Bearer $GSA_AGENT_TOKEN" \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: your-system-order-000001' \
  -d '{
    "quoteId": "REPLACE_WITH_QUOTE_UUID",
    "paymentMethod": "stripe_checkout",
    "clientReference": "your-system-order-000001",
    "sampleMetadata": [{
      "compoundName": "BPC-157",
      "lotNumber": "LOT-2026-0042",
      "matrixNotes": "Lyophilized powder"
    }],
    "publishRawData": true,
    "confirm": true
  }'

Endpoint reference

Scopes

Shipping your samples

Card and invoice orders are ship-first: the prepaid inbound UPS label is bought the moment the order is placed, and payment then gates only the COA release. Ethereum USDC orders get their label once the payment settles. The order response's shipping block and GET /shipments/{reference}/label return the signed label PDF, the tracking number and URL, packing steps with the exact containers per sample line, and the ship-to address (already printed on the label):

Gold Standard Analytics
5151 Mitchelldale St A10
Houston, TX 77092

Hand the box to any UPS driver or drop it at a UPS location. Once the order is paid, GET /orders/{reference}/pickup lists door-pickup dates, windows, the price, and a quoteToken; POST the chosen date and window with that token and confirm: true (needs orders:write). The pickup is booked with UPS after the account owner pays for it at the returned payUrl.

Pulling all of your laboratory data

Everything the laboratory produces for your account is reachable with a key you create yourself. /orders/{reference}/samples shows the physical units logged against each submitted item, /orders/{reference}/instrument-data and /results/{reference}/instrument-data return the QA-signed instrument measurements, run metadata, checksums, and integrity checks behind each published COA, and /export/coas and /export/instrument-results pull the whole history as JSON or CSV. Exports are capped at 5,000 rows per call; when truncated is true, repeat the call with since set to the last publishedAt. Attachment downloads inside instrument data are signed only when the order was placed with publishRawData enabled; the structured measurements are always yours.

curl 'https://www.goldstandardanalytics.com/api/v1/agent/export/instrument-results?format=csv&since=2026-01-01T00:00:00Z' \
  -H "Authorization: Bearer $GSA_AGENT_TOKEN" -o instrument-results.csv

Idempotency and money

Where an endpoint requires an idempotency key, it must be 8–255 characters and binds the exact request to its first result. Reusing a key with different input fails as a conflict. All commercial totals use integer USD cents. Ethereum USDC instructions separately return an integer atomic amount and an exact six-decimal display amount; neither may be rounded. The service never accepts a private key or broadcasts a transaction.

Signed webhooks

Endpoint registration performs public-HTTPS and SSRF validation. Deliveries are at least once, so deduplicate with X-GSA-Event-Id. Verify the timestamp tolerance and HMAC over the exact raw body before parsing JSON. Creating a subscription requires webhooks:write plus the matching read scope for every selected event: for example, results:read for COA events and orders:read for order or sample-status events.

X-GSA-Signature: t=<unix-seconds>,v1=<hex-hmac-sha256>
signed bytes: <unix-seconds>.<exact raw HTTP body>

An endpoint subscribes to coa.published unless you pass events. Card payments settle as invoice.updated with data.status of paid; Mercury and USDC payments also emit payment.confirmed.