Build passport
For developers

Every passport also answers with JSON. No key, no limit.

The same address a customer scans returns data to a machine. All it takes is an Accept header. One identifier and two representations, as EN 18221 requires. None of the providers we checked has this today.

See the endpoints Build a passport
curl200 OK · application/json
curl -H "Accept: application/json" \
  https://dppera.com/01/05901234123457/10/2026-08-A

{
  "public_id": "7f3ac21",
  "url": "https://dppera.com/01/05901234123457/10/2026-08-A",
  "did": "did:web:dppera.com:p:7f3ac21",
  "gtin": "05901234123457",
  "batch": "2026-08-A",
  "granularity": "batch",
  "product_name": "Płaszcz wełniany 03",
  "brand": "Northwind Apparel",
  "category": "textile",
  "data": { "composition": "Wełna merino - 100%", ... },
  "documents": [ { "kind": "declaration", "href": "https://dppera.com/d/…" } ],
  "published_at": "2026-08-14T09:12:00Z"
}

One address, three representations. The header chooses, not a separate endpoint.

This is how a GS1 Digital Link conformant resolver works and what EN 18221 asks for: one identifier, and the client says what it can read.

HTML for people

Accept: text/html

The passport page in the browser language or with an explicit ?lang=en. The same page a customer sees after scanning the code.

JSON for machines

Accept: application/json

An extract of the public record fields: identifiers, product, composition, responsible operator, documents, publication date. ?format=json works too.

Linkset GS1

?linkType=linkset

A link list per the GS1-Conformant Resolver Standard 1.2.0 and RFC 9264, with the gs1:dpp type. Also via Accept: application/linkset+json. Every response carries a Link header pointing at the linkset.

Addresses that work today. No registration, no token.

Reading is public, because a passport is public by definition. Writing and account export require a panel login.

MethodAddressWhat it returnsAccess
GET/01/{gtin}/10/{batch}Passport under a GS1 Digital Link address. Variants: GTIN alone (model), /22/{variant}, /21/{serial}, qualifiers in this order.public
GET/p/{public_id}Passport without a GTIN, with your own product identifier.public
GET/p/{public_id}/did.jsonThe DID document (W3C DID Core, did:web) for the passport.public
GET…?linkType=linksetLinkset per GS1-Conformant Resolver, also via Accept: application/linkset+json.public
GET/d/{document_id}Download of a passport document, always as an attachment (EN 18221 clause 4.4). A withdrawn passport serves no documents.public
POST/api/demo/previewRenders a preview from form data, nothing is stored. Preview creation limit: 2 per hour per IP address.public
GET/api/passports/{id}/scansPassport scan analytics: 90-day total and per-day counts. User token from the panel.account
POST/api/passports/publishPublishes a passport from the panel: HTML and JSON snapshot under a permanent address, plan limit check.account
POST/api/passports/{id}/documentsUploads a document to a passport (PDF and others, up to 10 MB).account
GET/api/account/exportThe complete account data as JSON, CSV or ZIP with documents. Works also in arrears.account

What is in the response. And what honestly is not there yet.

JSON response fields

public_idthe permanent passport identifier, the same as in the QR code and the DID
url, didthe canonical address and the did:web identifier
gtin, variant, batch, serialthe GS1 identifiers present at the given level
granularity, model_idthe identification level (model, batch, item) and the model identifier
product_name, brand, categoryname, brand and product group
datacomposition, origin, care, durability, substances, warranty, manufacturer
documents[]id, kind, title, filename, content_type, size_bytes, mandatory, href
published_atpublication date of this version

What is not there yet

  • Registering a passport in the DPP Registry through the API. The Commission registry does not accept passports yet, and its API is announced for Q4 2026.
  • Scan webhooks. Analytics is read on demand.
  • Write API keys. Publication and document uploads work with the user token from the panel.
  • A versioned JSON schema. The fields are stable, but a formal schema will be published together with the first delegated act that defines the data set.