Enterprise Licence & Inventory API

• ▪ Unlimited reports and dossiers across every establishment in the licence — no per-report charge, no seat licences.
• ▪ REST inventory API — post your establishment and substance register, receive the stored record identifier and the Seveso III Σ(q/Q) result, then pull the full dossier.
• ▪ On-premise generator — the same validation and document builders packaged to run inside your network, so substance quantities never leave your infrastructure.
• ▪ Metered API keys — issue and revoke per-integration keys; every call is logged with route, status and resulting record.
• ▪ Group-level change registers — year-over-year revision comparison retained across every site in the licence.
• ▪ Named support contact and advance notice when Annex I qualifying quantities or CLP notation change.

Requests are validated against exactly the same schemas as the wizard, including CAS and EC check-digit arithmetic. Invalid identifiers return HTTP 422 with the failing field — bad data cannot enter the register through the API either.

curl -X POST https://chempac.uk/api/public/v1/inventory-report \
  -H "Authorization: Bearer chk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "region": "eu",
    "reporting_year": 2025,
    "chemical_count": 1,
    // Sealed client-side (AES-256-GCM, DEK wrapped under your vault key).
    // CHEMPAC stores ciphertext only — no plaintext facility or substance data.
    "envelope": {
      "payload_ciphertext": "base64...",
      "payload_iv": "base64...",
      "wrapped_dek": "base64...",
      "wrapped_dek_iv": "base64...",
      "enc_version": 1, "dek_scope": "user"
    },
    // Optional: validated in memory to return the Seveso summation. Never stored.
    "facility": {
      "facility_name": "Rotterdam Terminal 4",
      "street": "Havenweg 22", "city": "Rotterdam",
      "state": "Zuid-Holland", "postal_code": "3089 JR",
      "country": "Netherlands",
      "competent_authority": "DCMR Milieudienst Rijnmond",
      "contact_person": "A. Visser", "contact_title": "HSE Manager",
      "contact_phone": "+31 10 555 0100",
      "contact_email": "hse@example.com",
      "emergency_phone": "+31 10 555 0199",
      "reporting_year": 2025
    },
    "chemicals": [{
      "chemical_name": "Toluene", "cas_number": "108-88-3",
      "ec_number": "203-625-9",
      "clp_hazard_classes": ["Flam. Liq. 2"],
      "seveso_category": "P5c",
      "physical_state": "Liquid",
      "max_amount": 4200, "max_unit": "t",
      "avg_daily_amount": 3100,
      "storage_location": "Tank Farm B",
      "storage_type": "Aboveground Tank"
    }]
  }'

On-premise deployment is scoped per group during onboarding — tell us your establishment count and identity provider in the enquiry form and we will confirm the licence band and rollout sequence.