Specification · v1 · Q2 2026

COA Format Specification (v1)

This page describes the certificate format we are adopting for new LabOS certificates. Older certificates may use a different reference format. This page is the authoritative spec — versioned, stable, and meant to be programmatically parseable by retailers, marketplace brand-registry teams, and aggregators that need to verify a GSA COA without a human-in-the-loop step.

Identifier scheme

GSA accession numbers are being adopted for all new LabOS certificates. A certificate issued with one carries a unique accession number in the format:

GSA-YYYY-NNNNNN

where YYYY is the calendar year of submission and NNNNNN is a zero-padded six-digit sequence number. Example: GSA-2026-018901. Accession numbers are monotonic within a year and never reused. Six digits are the minimum width; the suffix may grow to seven if annual volume exceeds 999,999 lots.

Verification

The canonical lookup URL is:

https://www.goldstandardanalytics.com/coa-lookup?accession={accession}
https://www.goldstandardanalytics.com/coa-lookup?accession={accession}&key={key}

A public COA issued with an accession number resolves from the first URL; a private one requires the second, where the key is the verification key the customer received in their portal. Not every certificate resolves here: certificates issued with a verification code can be checked at /verify. Accession numbers are never recycled.

Programmatic API

For machine integrations, hit the JSON endpoint:

GET /api/coa/lookup?accession={accession}[&verificationKey={key}]
-> 200 { ok: true, found: true,  coa: {...} }
-> 200 { ok: true, found: false }
-> 429 { ok: false, error: "Too many lookups. Please slow down." }

The endpoint is rate-limited to 60 requests/minute/IP. High-volume integrators should contact us for an API key with raised limits.

Required fields on a COA in this format

accession_number — the canonical identifier (above)
compound — what was tested
lot_number — the customer-supplied lot identifier
matrix — sample form (powder, oil, capsule, soil, water, etc.)
methods — analytical methods cited by reference (USP <X>, EPA <X>, etc.)
results[] — pass/fail rows with label, value, spec, status
issued_at — date the COA was signed
received_at — date the sample arrived at our lab
status — one of draft, reviewing, published, retracted

Versioning policy

Breaking changes to the COA format (renaming a field, changing a field's shape or semantics) bump the major version and get a new spec page (/legal/coa-spec-v2 etc.). Additive changes (new optional fields) keep the same major version. A COA the public lookup serves is served in its original format.

Retraction

A COA can be marked retracted by Gold Standard if the underlying instrument data is later found to be invalid (rare, but we will reach out and replace it). A retracted COA still resolves but the lookup response will surface the retraction status.

Contact

Programmatic-integration questions: team@goldstandardanalytics.com.