Server URL
https://app.authorized.by/api/public/mcp
Free No account or API key Read-only Streamable HTTP 20 requests / minute
Connection typeRemote MCP server
TransportStreamable HTTP, stateless
AuthenticationNone
Protocol versionsHandshake (initialize): 2025-03-26, 2025-06-18, 2025-11-25
Per request (_meta): 2026-07-28
Registry nameby.authorized/brands
Rate limit20 requests per minute per IP address
CostFree

The server provides access to the same public data as the authorized.by Brands API. All tools are read-only (readOnlyHint: true).

What can you ask?

Once connected, you can ask questions such as:

  • “Is santosgrills.de an authorized Napoleon retailer?”
  • “I found the product with GTIN 00629162151315 at santosgrills.de – is the shop authorized to sell it?”
  • “Show me five authorized Deuter retailers and their shop domains.”
  • “Which brands is this retailer authorized to sell? Include the certificate links.”
  • “Show me the profile and opening hours of the retailer santosgrills.de.”

Results reflect the data returned at the time of your query and may change.

Check an authorization directly

For the question “Is shop X authorized by brand Y?” a single call is enough: verify_retailer_authorization. The tool takes the shop domain plus either the brand or the product number.

Parameters

  • retailer_domain – the shop’s domain or any URL on that domain
  • brand – the brand’s slug, ID or website, e.g. weber or weber.com
  • gtin – the GTIN/EAN of the product being checked, as an alternative to brand

Checking by product number works without knowing the brand: the GTIN resolves to the brand, the brand to the recorded relationship with the shop.

Return values

  • AUTHORIZEDAn active authorization is recorded – with certificate links and the start date of the relationship.
  • NO_RECORD_FOR_BRANDNo authorization record exists for this brand–retailer combination.
  • RETAILER_NOT_REGISTEREDThe retailer is not registered in the directory.
  • BRAND_NOT_REGISTEREDThe brand is not registered in the directory.

Only AUTHORIZED confirms an authorization. The other three statuses do not prove the opposite, because authorizations may exist outside the directory. A failed request or server error is never a result.

When the direct check does not apply

For broader discovery, or when the domain is unclear, use the two-step lookup:

  1. Search for the retailer by company name or alias using get_retailers.
  2. Compare the returned shop_url with the domain being checked.
  3. Use the returned retailer ID or slug with get_retailer_brands.
  4. Report only the brand relationships actually returned, each with its certificate link.

Similarly named shops are not necessarily the same business. In the other direction, get_brand_retailers returns all retailers currently authorized by a brand.

Marketplaces: always check against the exact seller address

On Amazon, eBay and similar platforms, an authorization can only be checked against the exact store address of the individual seller. Authorization of one seller does not apply to other sellers on the same platform or to the marketplace as a whole.

Connect your client

Any client that supports remote MCP servers over Streamable HTTP can use the endpoint above. Select no authentication and follow your client’s documentation for the exact configuration format.

ChatGPT

Custom MCP connections require developer mode. Availability depends on your account and workspace settings.

  1. Open Settings → Security and login and enable Developer mode.
  2. Open ChatGPT Plugins and select the plus button.
  3. Enter authorized.by as the name.
  4. Select Server URL and paste the endpoint shown above.
  5. Set authentication to None.
  6. Review the notice and create the connection.
  7. Start a new conversation and select the authorized.by connection from the tools menu.

Adding this connection makes the tools available in your account. It does not make authorized.by automatically available in every ChatGPT conversation or to other users.

Read OpenAI’s setup guide

Claude (Web and Desktop)

Workspace policies may require an administrator to add the connector first.

  1. Open Settings → Connectors → Add custom connector.
  2. Enter authorized.by as the name.
  3. Paste the server URL shown above.
  4. Leave optional OAuth fields empty and save.
  5. Enable the connector for your conversation.

Read Claude’s connector guide

Claude Code

Add the remote MCP server using the command line:

claude mcp add --transport http authorized-by https://app.authorized.by/api/public/mcp

Cursor

Add the server to ~/.cursor/mcp.json (global) or .cursor/mcp.json (project):

{
  "mcpServers": {
    "authorized-by": {
      "url": "https://app.authorized.by/api/public/mcp"
    }
  }
}

VS Code (GitHub Copilot)

Add the following to .vscode/mcp.json:

{
  "servers": {
    "authorized-by": {
      "type": "http",
      "url": "https://app.authorized.by/api/public/mcp"
    }
  }
}

Try this first

After connecting, paste this prompt to see a full check end to end:

Use authorized.by to check whether santosgrills.de is an authorized Napoleon retailer. Report the returned status, the start date and the certificate link.

Menu labels may differ depending on interface language and version.

Available tools

Seven tools: one for checking an authorization directly, six for exploring the network in both directions – from brands to their authorized retailers and from retailers to their authorizing brands.

ToolPurposeParameters
verify_retailer_authorizationDirectly check whether a shop is an authorized retailer of a brand. Returns an explicit status and, when authorized, certificate links and the start date.Required: retailer_domain
plus brand or gtin
get_brandsSearch brands by name, alias, or website domain/URL (partial matches). Returns names, slugs, logos, retailer counts, network-wide totals and pagination. Omit search for the full index.Optional: search, page, size
get_brandBrand profile with website, logo, product and retailer counts, categories and descriptions in English/German, headquarters country and social links.Required: id_or_alias
get_brand_retailersAuthorized retailers of a brand, including relationship start dates, certificate links and seal_implemented.Required: id_or_alias
get_retailersSearch shops by company name, alias, or shop domain/URL (partial matches). Returns shop URLs, logos, brand counts and seal_implemented.Optional: search, page, size
get_retailerRetailer profile including address, contact details, opening hours, categories, subscription plan, TÜV certification, customer rating and seal_implemented.Required: id_or_alias
get_retailer_brandsBrands authorizing a retailer, sorted alphabetically by brand name, with start dates and certificate links.Required: id_or_alias

Search pagination starts at 0; the documented default page size is 500. Search filters also match domains and URLs. Pagination indicates whether more results are available. Profile fields may be empty when information is unavailable.

Understanding the results

Authorization is specific to a brand–retailer relationship.

A confirmed relationship with one brand does not establish authorization for every brand in a retailer’s assortment.

A missing result is not proof of non-authorization.

It means that no matching record was found through the lookup. Authorizations may exist outside the authorized.by directory.

Authorization is not a blanket guarantee of shop reliability.

It should be considered alongside other relevant information when assessing a retailer.

Field or attributeHow to interpret it
partnership_dateThe recorded start date of the authorization relationship, not the date of its latest update.
certificate_urlThe public English certificate link for the specific relationship, where available.
certificate_url_deThe public German certificate link for the specific relationship, where available.
seal_implementedWhether the authorized.by seal is implemented on the retailer’s shop.
Subscription planThe retailer’s package level. It is not a quality or safety score.
tuv_certification_dateA recorded TÜV certification date. The date alone should not be interpreted as proof of current validity or scope.

Retailer lists returned by get_brand_retailers are sorted by subscription plan – PREMIUM, START, FREE – and then by the number of brand connections. This ordering is not a ranking of retailer quality.

Technical details

The server uses JSON-RPC 2.0 over HTTP POST with Content-Type: application/json. Supported methods:

initialize (versions 2025-03-26 through 2025-11-25)
tools/list
tools/call
server/discover (version 2026-07-28)

Clients on 2025-03-26, 2025-06-18 and 2025-11-25 begin with initialize; the response echoes the client protocol version. Clients on 2026-07-28 skip this handshake and send the protocol version and capabilities in params._meta on every request, mirrored in the MCP-Protocol-Version and Mcp-Method headers.

The server is stateless and does not use Server-Sent Events. Notifications without an id, such as notifications/initialized, receive HTTP 202 Accepted with an empty body.

Each tool publishes an inputSchema, an outputSchema and read-only annotations (readOnlyHint: true, destructiveHint: false). Results include both text content and machine-readable structuredContent. Check isError before interpreting results: an unknown brand or retailer can return JSON-RPC success with isError: true. A message beginning with Tool execution failed indicates a technical error. Neither should be presented as proof of non-authorization.

JSON-RPC errors

-32601Unknown method (HTTP 404 on 2026-07-28)
-32602Unknown tool, missing or invalid arguments
-32603Internal server error
-32020HTTP 400: mirrored header differs from request body (2026-07-28)
-32022HTTP 400: unsupported protocol version; error.data.supported lists supported versions

An unsupported MCP-Protocol-Version header also returns HTTP 400 on legacy requests.

Rate limits and responsible use

The server allows 20 requests per minute per IP address. Exceeding this limit returns HTTP 429 Too Many Requests.

Use targeted queries, avoid unnecessary repeated calls and apply backoff when rate-limited. If you cache results, retain the retrieval time and do not present cached information as a current check.

Prefer REST?

The REST API provides the same data and the same verification capability, with the same rate limit:

https://app.authorized.by/api/public/v1/
/authorizations?retailer_domain={domain}&brand={brand}
/authorizations?retailer_domain={domain}&gtin={gtin}
/brands
/brands/{id}
/brands/{id}/retailers
/retailers
/retailers/{id}
/retailers/{id}/brands

The REST API caps the page size at 100 records.

API examples for developers

These requests use JSON-RPC 2.0 over HTTP POST. Responses include both content and structuredContent.

List tools

curl -s https://app.authorized.by/api/public/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

Retrieve a brand profile

curl -s https://app.authorized.by/api/public/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_brand","arguments":{"id_or_alias":"deuter"}}}'

These examples follow the calls documented in the Markdown. Clients using protocol 2026-07-28 must additionally supply the corresponding _meta fields and headers.

Usage guidelines

The public data is intended for discovering and verifying authorized brand–retailer relationships. Respect the rate limit and, when caching, record the retrieval time.

About authorized.by

authorized.by enables brands to confirm their retail partners and makes those relationships accessible through public profiles, authorization certificates and machine-readable data.

authorized.by GmbH is part of the TÜV Saarland Group.

Explore authorized.by

What the server returns

  • Direct authorization check by shop domain and brand, or by GTIN/EAN
  • Brand-confirmed retailer relationships, maintained by the brands themselves
  • Public authorization certificates in English and German
  • Brand and retailer profiles with shop domains and connection counts
  • Free, read-only access without an account or API key

Questions about the API?


Talk to the team behind the data.

Contact usCreate a free account
Logo weiß authorized.by® Member of TÜV Saarland

The authorized.by® platform connects brands and authorized distribution partners through an official, brand-controlled directory. It simplifies the establishment, verification, and maintenance of partnerships between brands and retailers, creating transparent and trustworthy authorizations.

Verified partnerships are made visible wherever consumers, businesses, and systems look for trustworthy sources of supply – including online stores, marketplaces, dealer locators, physical retail locations, search engines, and AI systems.

This strengthens consumer trust in brands and official sources of supply, supports informed purchasing decisions, and helps brands and retailers differentiate themselves from unauthorized sellers. The brand remains the sole issuer of the authorization. Retailers cannot assign or modify their own status. All authorizations are managed by the respective brand in real time and may be amended or revoked at any time.

authorized.by is the official source for verified distribution partnerships between brands and retailers and makes this information available to consumers, brands, retailers, marketplaces, search engines, and AI systems.

Imprint | Privacy Policy | | Terms & Conditions | © Copyright 2026 authorized.by | Made with ♡ in Bavaria

authorized.by logo