CANARY API

Query the falsified-medicine signal store: check a batch number, or pull district-level signals for a country. Free for public-interest use — health systems, pharmacy networks, researchers and journalists.

The one rule. This API tells you when something is known against a product. It never tells you a medicine is safe. An empty result means nothing has been reported — not that the product is genuine. Any interface you build on top of this must carry that distinction, or it will mislead the person holding the bottle.

Base URL and authentication

https://checkmymedicine.com/api

Authorization: Bearer ck_live_xxxxxxxxxxxx

Keys are issued by request — write to joseph@josmolgroup.com with your organisation and intended use. Default limit is 60 calls per minute; higher limits are granted for operational integrations. A key can also be passed as ?key= for quick testing, but the header is preferred.

Endpoints

GET /api/health

No authentication. Confirms the service is up and lists endpoints.

GET /api/batch/{code}

Check one batch or lot number against published regulator alerts and corroborated signals.

curl https://checkmymedicine.com/api/batch/NC177832 \
  -H "Authorization: Bearer ck_live_xxxxxxxxxxxx"

{
  "batch": "NC177832",
  "status": "flagged",
  "disclaimer": "This batch appears in a published alert or corroborated signal.",
  "matches": [
    {
      "batch": "NC177832",
      "product": "Nexterone (amiodarone HCl) 360 mg/200 mL …",
      "status": "flagged",
      "severity": "alert",
      "country": "US",
      "finding": "CGMP Deviations",
      "source": "openFDA",
      "published_at": "2026-08-21T00:00:00Z"
    }
  ]
}

When nothing is known, status is no_known_signal and matches is empty — with a disclaimer stating plainly that this is not a guarantee of safety.

GET /api/signals

District-level signals, newest first.

Parameter	Type	Notes
`country`	ISO-2	Optional. Omit for all territories.
`limit`	integer	Default 100, maximum 500.

curl "https://checkmymedicine.com/api/signals?country=NG&limit=50" \
  -H "Authorization: Bearer ck_live_xxxxxxxxxxxx"

Response codes

Code	Meaning
`200`	Success.
`400`	Missing or malformed parameter.
`401`	Missing, unknown or revoked key.
`429`	Rate limit exceeded. Back off and retry.
`502`	Upstream query failed. Retry; if persistent, contact us.

What this API will never return

CANARY publishes the fact and never the method. These are excluded at the database level, not merely omitted by the client:

The deviation grammar — the catalogue of how falsification shows itself.
Which specific features triggered a detection.
Raw citizen reports, before corroboration.
Authentic reference data contributed by manufacturers.
Anything identifying a person. CANARY records products and places, never patients.

Why. A public list of exactly how counterfeits get caught is a counterfeiter's quality-control manual. Regulators receive full methodological detail for their own territory under agreement; manufacturers receive it for their own products.

Attribution and fair use

Attribute as “Data: CANARY (checkmymedicine.com)”. Cache responses for at least 60 seconds. Do not present CANARY data as a safety certification, and do not build interfaces that imply a product is genuine because no signal exists. Keys used in ways that could mislead patients will be revoked.