GET /intent) instead.
Required scope
Your API key must includemedia:v2:private-read in addition to sr:v2:create and sr:v2:read. Legitmark grants this scope when private media is enabled for your organization.
Send the same leo_ key on every call below:
media:v2:private-read, GET /api/v2/sr/{sr_uuid} returns empty media_url arrays and a null certificate_url for private-CDN organizations.
Integration steps
Same flow as the public partner API, with two changes: do not call/intent, and treat every media URL as short-lived.
1
Create the service request
POST /api/v2/sr?sides=true&item=true with your leo_ key and the usual body. Passing sides=true&item=true returns the required/optional photo list inline so you do not need a second fetch before upload.API Reference: POST /api/v2/sr2
Upload photos
POST /api/media/signed-urls/{sr_uuid} once for all sides, then PUT each image to the returned signed_url. Do not call GET /intent.3
Read photos
GET /api/v2/sr/{sr_uuid}?item=true&sides=true with the same key. media_url (and summary.thumbnail if you pass summary=true) are signed private-CDN links that last about 15 minutes.4
Read the certificate
Use
certificate_url from the latest Get Full SR. If you get Access Denied or 403, fetch again. You can also regenerate from Download certificate in the dashboard.Upload photos
Do not callGET https://asset.legitmark.com/intent (or the development/staging asset host). That route writes to the public bucket and cannot route private-organization uploads.
Request every side’s upload URL in one call, then PUT the image bytes to each URL.
API Reference: POST /api/media/signed-urls/{sr_uuid}
Response
The TypeScript SDK still uses
GET /intent. Private-CDN organizations should call POST /api/media/signed-urls/{sr_uuid} over HTTP until the SDK is updated.Browser uploads (CORS)
If a warehouse or web appPUTs the image from the browser, S3 must allow that page’s origin. Share every upload origin with Legitmark (exact origins and https://*.example.com wildcards). Origins already allowlisted for your organization keep working. A CORS error on the PUT means a new origin needs to be added — do not fall back to /intent.
Read photos
Fetch the service request with the same API key.media_url values are CloudFront-signed links on your private CDN host.
API Reference: GET /api/v2/sr/{sr_uuid}
- Keep
Expires,Key-Pair-Id, andSignatureon the URL. Stripping the query string returns403. summary.thumbnailis signed the same way when you passsummary=true.- Public
cdn.legitmark.comlinks from earlier testing no longer serve these photos.
Certificates
certificate_url on the latest GET /api/v2/sr/{sr_uuid} is a signed PDF link on the same private host. Use that URL. If you get Access Denied or 403, the signature expired — call GET again and use the new URL.
You can also regenerate a fresh link from Download certificate in the dashboard (https://app.legitmark.com or the development/staging app host).
Do not reuse a certificate link you stored earlier.
URL lifetime
Signed read URLs last 15 minutes from the moment they are issued (expires_in default 900 seconds).
- Do not persist or cache signed URLs in your database.
- Do not log or forward a signed URL as a durable share link. Anyone who has the URL can fetch the object until it expires.
- Call
GET /api/v2/sr/{sr_uuid}again whenever you need to display or download a photo or certificate. - An expired or unsigned URL returns
403. That is expected. Fetch a fresh URL.
state_change arrives, fetch the SR if you need photos or the certificate.
Public share page
The public share page does not show photos for private-CDN organizations. That is intended. Photos and certificates stay available through the partner API with your keyed requests.Environments
Replace
{org} with the hostname Legitmark provisioned for your organization. Use the URL returned by the API rather than constructing CDN hosts yourself.
Image requirements
Same as the public workflow:- Format: JPG/JPEG/PNG
- Size: 600 x 600 px minimum
- File size: 5 MB maximum per image
- Quality: Clear, well-lit, focused images