---
title: "The sealed basket behind a handoff link"
method: GET
path: "/v1/handoffs/{id}"
tags: ["delivery"]
---

# The sealed basket behind a handoff link

`GET /v1/handoffs/{id}`

## Request

- Base URL: `https://supermcp.co.il`
- URL: `https://supermcp.co.il/v1/handoffs/{id}`
- Auth: none required

Public and unauthenticated: the caller is a shopper's browser following a link out of a chat window, with no API key and no reason to get one. The response is the basket encrypted with AES-256-GCM, and this service cannot decrypt it: the key lives only in the link's fragment, which never reaches a server. Reading a row without that fragment gains nothing.

## Path parameters

- `id` string, required

## Response `200`

OK

- object
  - `data` object
    - `iv` string: base64 of the 12-byte AES-GCM nonce.
    - `ciphertext` string: base64 of the ciphertext with its 16-byte auth tag appended.

## Other responses

- `400`: Malformed id
- `404`: Unknown or expired, deliberately indistinguishable: saying which would confirm that an id was real, and links stop working after 30 days.
- `429`: Rate limited

---

[API](https://skmtc.dev/supermcp/apis/super-mcp-api.md) · [All operations](https://skmtc.dev/supermcp/apis/super-mcp-api/llms.txt) · [OpenAPI document](https://skmtc.dev/supermcp/apis/super-mcp-api/revisions/f0dea9415b1c?raw)