Verify by API.
Hear about revocations the moment they happen.

1 · Verify a code

GET /v1/registrations/{code}

curl https://api.poalock.com/v1/registrations/LOCK-A2C4-E6G8-J3K5 \
  -H "Authorization: Bearer pk_live_..."

{
  "code": "LOCK-A2C4-E6G8-J3K5",
  "status": "ACTIVE",
  "instrument_type": "Durable Power of Attorney",
  "governing_state": "New York",
  "principal_name": "Jane Q. Smith",
  "agent_name": "John R. Smith",
  "executed_on": "2026-03-15",
  "witnesses": "Robert Chen; Maria Diaz",
  "notarized_by": "Maria Gonzalez, Notary Public",
  "pages": 12,
  "attorney_of_record": { "name": "Alexandra Reyes, Esq.", "phone": "+15550142900", "email": "areyes@examplefirm.com" },
  "death_reported": null,
  "status_declared_at": "2026-07-11T14:02:11Z",
  "checked_at": "2026-07-12T09:30:00Z"
}

2 · Subscribe to status changes

POST /v1/registrations/{code}/watch

curl -X POST https://api.poalock.com/v1/registrations/LOCK-A2C4-E6G8-J3K5/watch \
  -H "Authorization: Bearer pk_live_..." \
  -d '{ "webhook_url": "https://yourbank.com/webhooks/poalock", "email": "ops@yourbank.com" }'

3 · Receive the webhook (signed)

POST https://yourbank.com/webhooks/poalock · signature in X-POALock-Signature (HMAC-SHA256)

{
  "event": "registration.revoked",          // or .reactivated, .death_reported
  "code": "LOCK-A2C4-E6G8-J3K5",
  "status": "REVOKED",
  "status_declared_at": "2026-09-02T16:40:00Z",
  "sent_at": "2026-09-02T16:40:01Z"
}

API calls draw down your plan's check allowance ($99–$599/month tiers, institutional program above that); watch subscriptions and webhooks are included with every plan. Keys are issued per organization with per-branch sub-keys; every response is served over TLS and logged for your audit file.

Sandbox — live in the pilot

When the site runs on the POALock registry server, sandbox keys are self-serve. Both credentials are shown once:

curl -X POST https://poalock.com/api/institutions \
  -H "Content-Type: application/json" \
  -d '{ "orgName": "First National Bank", "email": "ops@yourbank.com" }'

{ "apiKey": "pk_test_…", "signingSecret": "whsec_…" }

The apiKey authenticates every /v1 call as a Bearer token; the signingSecret verifies the X-POALock-Signature header on webhooks (HMAC-SHA256 of t.body, same scheme as Stripe's). GET /v1/me reports your usage.