https://app.authorized.by/api/public/mcp
| Connection type | Remote MCP server |
| Transport | Streamable HTTP, stateless |
| Authentication | None |
| Protocol versions | Handshake (initialize): 2025-03-26, 2025-06-18, 2025-11-25Per request ( _meta): 2026-07-28 |
| Registry name | by.authorized/brands |
| Rate limit | 20 requests per minute per IP address |
| Cost | Free |
The server provides access to the same public data as the authorized.by Brands API. All tools are read-only (readOnlyHint: true).
What can you ask?
Once connected, you can ask questions such as:
- “Is santosgrills.de an authorized Napoleon retailer?”
- “I found the product with GTIN 00629162151315 at santosgrills.de – is the shop authorized to sell it?”
- “Show me five authorized Deuter retailers and their shop domains.”
- “Which brands is this retailer authorized to sell? Include the certificate links.”
- “Show me the profile and opening hours of the retailer santosgrills.de.”
Results reflect the data returned at the time of your query and may change.
Check an authorization directly
For the question “Is shop X authorized by brand Y?” a single call is enough: verify_retailer_authorization. The tool takes the shop domain plus either the brand or the product number.
Parameters
retailer_domain– the shop’s domain or any URL on that domainbrand– the brand’s slug, ID or website, e.g.weberorweber.comgtin– the GTIN/EAN of the product being checked, as an alternative tobrand
Checking by product number works without knowing the brand: the GTIN resolves to the brand, the brand to the recorded relationship with the shop.
Return values
AUTHORIZEDAn active authorization is recorded – with certificate links and the start date of the relationship.NO_RECORD_FOR_BRANDNo authorization record exists for this brand–retailer combination.RETAILER_NOT_REGISTEREDThe retailer is not registered in the directory.BRAND_NOT_REGISTEREDThe brand is not registered in the directory.
Only AUTHORIZED confirms an authorization. The other three statuses do not prove the opposite, because authorizations may exist outside the directory. A failed request or server error is never a result.
When the direct check does not apply
For broader discovery, or when the domain is unclear, use the two-step lookup:
- Search for the retailer by company name or alias using
get_retailers. - Compare the returned
shop_urlwith the domain being checked. - Use the returned retailer ID or slug with
get_retailer_brands. - Report only the brand relationships actually returned, each with its certificate link.
Similarly named shops are not necessarily the same business. In the other direction, get_brand_retailers returns all retailers currently authorized by a brand.
On Amazon, eBay and similar platforms, an authorization can only be checked against the exact store address of the individual seller. Authorization of one seller does not apply to other sellers on the same platform or to the marketplace as a whole.
Connect your client
Any client that supports remote MCP servers over Streamable HTTP can use the endpoint above. Select no authentication and follow your client’s documentation for the exact configuration format.
ChatGPT
Custom MCP connections require developer mode. Availability depends on your account and workspace settings.
- Open Settings → Security and login and enable Developer mode.
- Open ChatGPT Plugins and select the plus button.
- Enter authorized.by as the name.
- Select Server URL and paste the endpoint shown above.
- Set authentication to None.
- Review the notice and create the connection.
- Start a new conversation and select the authorized.by connection from the tools menu.
Adding this connection makes the tools available in your account. It does not make authorized.by automatically available in every ChatGPT conversation or to other users.
Claude (Web and Desktop)
Workspace policies may require an administrator to add the connector first.
- Open Settings → Connectors → Add custom connector.
- Enter authorized.by as the name.
- Paste the server URL shown above.
- Leave optional OAuth fields empty and save.
- Enable the connector for your conversation.
Claude Code
Add the remote MCP server using the command line:
claude mcp add --transport http authorized-by https://app.authorized.by/api/public/mcp
Cursor
Add the server to ~/.cursor/mcp.json (global) or .cursor/mcp.json (project):
{
"mcpServers": {
"authorized-by": {
"url": "https://app.authorized.by/api/public/mcp"
}
}
}VS Code (GitHub Copilot)
Add the following to .vscode/mcp.json:
{
"servers": {
"authorized-by": {
"type": "http",
"url": "https://app.authorized.by/api/public/mcp"
}
}
}Try this first
After connecting, paste this prompt to see a full check end to end:
Use authorized.by to check whether santosgrills.de is an authorized Napoleon retailer. Report the returned status, the start date and the certificate link.
Menu labels may differ depending on interface language and version.
Available tools
Seven tools: one for checking an authorization directly, six for exploring the network in both directions – from brands to their authorized retailers and from retailers to their authorizing brands.
| Tool | Purpose | Parameters |
|---|---|---|
verify_retailer_authorization | Directly check whether a shop is an authorized retailer of a brand. Returns an explicit status and, when authorized, certificate links and the start date. | Required: retailer_domainplus brand or gtin |
get_brands | Search brands by name, alias, or website domain/URL (partial matches). Returns names, slugs, logos, retailer counts, network-wide totals and pagination. Omit search for the full index. | Optional: search, page, size |
get_brand | Brand profile with website, logo, product and retailer counts, categories and descriptions in English/German, headquarters country and social links. | Required: id_or_alias |
get_brand_retailers | Authorized retailers of a brand, including relationship start dates, certificate links and seal_implemented. | Required: id_or_alias |
get_retailers | Search shops by company name, alias, or shop domain/URL (partial matches). Returns shop URLs, logos, brand counts and seal_implemented. | Optional: search, page, size |
get_retailer | Retailer profile including address, contact details, opening hours, categories, subscription plan, TÜV certification, customer rating and seal_implemented. | Required: id_or_alias |
get_retailer_brands | Brands authorizing a retailer, sorted alphabetically by brand name, with start dates and certificate links. | Required: id_or_alias |
Search pagination starts at 0; the documented default page size is 500. Search filters also match domains and URLs. Pagination indicates whether more results are available. Profile fields may be empty when information is unavailable.
Understanding the results
A confirmed relationship with one brand does not establish authorization for every brand in a retailer’s assortment.
It means that no matching record was found through the lookup. Authorizations may exist outside the authorized.by directory.
It should be considered alongside other relevant information when assessing a retailer.
| Field or attribute | How to interpret it |
|---|---|
partnership_date | The recorded start date of the authorization relationship, not the date of its latest update. |
certificate_url | The public English certificate link for the specific relationship, where available. |
certificate_url_de | The public German certificate link for the specific relationship, where available. |
seal_implemented | Whether the authorized.by seal is implemented on the retailer’s shop. |
| Subscription plan | The retailer’s package level. It is not a quality or safety score. |
tuv_certification_date | A recorded TÜV certification date. The date alone should not be interpreted as proof of current validity or scope. |
Retailer lists returned by get_brand_retailers are sorted by subscription plan – PREMIUM, START, FREE – and then by the number of brand connections. This ordering is not a ranking of retailer quality.
Technical details
The server uses JSON-RPC 2.0 over HTTP POST with Content-Type: application/json. Supported methods:
tools/list
tools/call
server/discover (version 2026-07-28)
Clients on 2025-03-26, 2025-06-18 and 2025-11-25 begin with initialize; the response echoes the client protocol version. Clients on 2026-07-28 skip this handshake and send the protocol version and capabilities in params._meta on every request, mirrored in the MCP-Protocol-Version and Mcp-Method headers.
The server is stateless and does not use Server-Sent Events. Notifications without an id, such as notifications/initialized, receive HTTP 202 Accepted with an empty body.
Each tool publishes an inputSchema, an outputSchema and read-only annotations (readOnlyHint: true, destructiveHint: false). Results include both text content and machine-readable structuredContent. Check isError before interpreting results: an unknown brand or retailer can return JSON-RPC success with isError: true. A message beginning with Tool execution failed indicates a technical error. Neither should be presented as proof of non-authorization.
JSON-RPC errors
-32601 | Unknown method (HTTP 404 on 2026-07-28) |
-32602 | Unknown tool, missing or invalid arguments |
-32603 | Internal server error |
-32020 | HTTP 400: mirrored header differs from request body (2026-07-28) |
-32022 | HTTP 400: unsupported protocol version; error.data.supported lists supported versions |
An unsupported MCP-Protocol-Version header also returns HTTP 400 on legacy requests.
Rate limits and responsible use
The server allows 20 requests per minute per IP address. Exceeding this limit returns HTTP 429 Too Many Requests.
Use targeted queries, avoid unnecessary repeated calls and apply backoff when rate-limited. If you cache results, retain the retrieval time and do not present cached information as a current check.
Prefer REST?
The REST API provides the same data and the same verification capability, with the same rate limit:
https://app.authorized.by/api/public/v1/
/authorizations?retailer_domain={domain}>in={gtin}
/brands
/brands/{id}
/brands/{id}/retailers
/retailers
/retailers/{id}
/retailers/{id}/brands
The REST API caps the page size at 100 records.
API examples for developers
These requests use JSON-RPC 2.0 over HTTP POST. Responses include both content and structuredContent.
List tools
curl -s https://app.authorized.by/api/public/mcp \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'Retrieve a brand profile
curl -s https://app.authorized.by/api/public/mcp \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_brand","arguments":{"id_or_alias":"deuter"}}}'These examples follow the calls documented in the Markdown. Clients using protocol 2026-07-28 must additionally supply the corresponding _meta fields and headers.
Usage guidelines
The public data is intended for discovering and verifying authorized brand–retailer relationships. Respect the rate limit and, when caching, record the retrieval time.
About authorized.by
authorized.by enables brands to confirm their retail partners and makes those relationships accessible through public profiles, authorization certificates and machine-readable data.
authorized.by GmbH is part of the TÜV Saarland Group.
What the server returns
- Direct authorization check by shop domain and brand, or by GTIN/EAN
- Brand-confirmed retailer relationships, maintained by the brands themselves
- Public authorization certificates in English and German
- Brand and retailer profiles with shop domains and connection counts
- Free, read-only access without an account or API key