Skip to content
DASH Help Center

GSK Vendor API

The GSK Vendor API lets DASH transmit a signed certificate directly to GSK’s supplier Certificate of Analysis service, with no manual upload. You set it up as an API submission channel (CHANNEL-002) on the Material whose certificates should be delivered to GSK. When a certificate is submitted, DASH builds the CoA XML, wraps it in the JSON body GSK expects and posts it to the endpoint your vendor contact provides.

What you need from GSK

Section titled “What you need from GSK”

GSK provisions these per supplier and material. Gather them before you start:

Detail Example / where it goes
Endpoint URL The upload-coa service URL — the channel’s endpoint
API key A secret token, sent as an HTTP header (kept masked as •••••••• after saving)
Material ID GSK’s identifier for the material, referenced in the request body
Organisation name & code Your registered supplier details
Site name The shipping/manufacturing site

Store the Material ID, Organisation and Site values as metadata fields on the Material (and Organisation) so the channel can pull them into the request — see Material fields & dates.

Configure the API channel

Section titled “Configure the API channel”
  1. Open the Material and go to the Data channels section.
  2. Add a channel with direction Submission and kind API.
  3. Give it a clear name, for example GSK Vendor API.
  4. Paste the GSK endpoint URL into the endpoint field.
  5. Add an HTTP header for your API key exactly as GSK specifies (for example a header named apikey with your key as the value).
  6. Provide the JSON body template GSK requires. Use placeholders so DASH fills in the live values at submission time — for example [coa] for the Base64-encoded certificate XML, [id] for the certificate ID, and [org.OrganizationName] or [proj.MaterialID] for your metadata.
  7. Save the channel.

Test the connection

Section titled “Test the connection”

Use Test connection on the channel. DASH probes the endpoint and reports the result:

  • Pass — “Endpoint reachable (HTTP <code>).” Any HTTP response counts as reachable.
  • Fail — “Connection error — endpoint unreachable.” or “Request timed out…” means DNS, the network or the URL is wrong.
  • “No API endpoint configured.” means the endpoint field is empty.

A test only checks reachability, not that GSK accepted the payload — the real result appears when you submit a certificate. Testing never blocks saving or using the channel.

Common pitfalls

Section titled “Common pitfalls”
  • Wrong or missing header name. GSK rejects requests without the exact API-key header they specify. Match the header name precisely.
  • Body placeholders don’t resolve. If a value comes through empty, the referenced metadata field is missing or misspelled. Add the field to the Material or Organisation and re-check.
  • Secret shows as •••••••• when editing. That’s expected — leave the placeholder in place to keep the stored key; only overtype it to change the key.
  • Endpoint reachable but submission fails. The connection test passed but GSK returned an error status. Open the certificate and read the transmission message — see Retry a certificate.
Section titled “Related”