Digital Product Passport API

What this is

From 18 February 2027, every EV, LMT and industrial battery over 2 kWh placed on the EU market needs a Digital Product Passport: roughly 80–100 Annex XIII attributes, a unique identifier, a scannable data carrier, and access control that shows different data to different audiences. This API turns the free, Commission-published data models into three calls — create → register → resolve.

Live demo — create a battery passport

Builds a real POST /v1/passports request and validates it in your browser using this project's bundled library — the same code the server runs. Toggle the tiers to see exactly which attributes each audience receives.

Access tiers — the hard part, done right

Every attribute in the data model carries a tier drawn from Battery Regulation (EU) 2023/1542. Resolution at /dpp/{uid} returns only what the caller is entitled to, and names the groups it withheld — never their values. Default-deny: an attribute with no explicit tier is treated as competent-authority, so a newly added field can never leak before someone classifies it.

Call the API

Base URL: https://apis.allanninal.dev/dpp

curl -s -X POST https://apis.allanninal.dev/dpp/v1/passports \
  -H "content-type: application/json" \
  -d '{
    "category": "battery-ev",
    "carrier": "qr",
    "attributes": {
      "manufacturerName": "ACME Cells GmbH",
      "batteryModel": "ACME-EV-75",
      "batteryCategory": "EV",
      "batteryStatus": "original",
      "manufacturingDate": "2027-03-01",
      "ratedCapacityKwh": 75,
      "nominalVoltage": 400,
      "chemistry": "NMC811",
      "stateOfHealth": 100
    }
  }'

# Public tier (anyone):
curl https://apis.allanninal.dev/dpp/v1/dpp/urn%3Adpp%3Aapis.allanninal.dev%3A000000000001

# Legitimate-interest tier:
curl -H "authorization: Bearer $DPP_LEGIT_KEY" \
  https://apis.allanninal.dev/dpp/v1/dpp/urn%3Adpp%3A...

# Competent-authority tier:
curl -H "authorization: Bearer $DPP_AUTHORITY_KEY" \
  https://apis.allanninal.dev/dpp/v1/dpp/urn%3Adpp%3A...

curl -X POST https://apis.allanninal.dev/dpp/v1/passports/{passportId}/register \
  -H "authorization: Bearer $DPP_ISSUER_KEY" \
  -H "content-type: application/json" \
  -d '{ "registryEnv": "test" }'

Also available: GET /v1/passports (list), GET /v1/passports/{id} (full, owner only), PATCH /v1/passports/{id} (draft update or versioned amendment), and GET /v1/usage. Full contract in openapi.yaml.

Access & rate limits

Creating and publicly resolving passports are free and anonymous. Managing, registering and resolving above the public tier need a scoped key sent as Authorization: Bearer dpp_... — the scope is what decides the tier you receive.

Anonymous callers get 60 requests/minute and 5,000/day per client IP; key holders get 5× the minute budget and 10× the daily one. Every response carries RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset; throttled requests return 429 with Retry-After.

Reference data (static, no auth)

• /api/v1/index.json — endpoint catalogue
• /api/v1/meta.json — regulations, key dates, registry environment, dataset versions
• /api/v1/categories.json — supported categories
• /api/v1/data-models/{category}.json — Annex XIII attributes, each with its access tier
• /api/v1/access-tiers.json — tier definitions and the group → tier map
• /api/v1/carriers.json — carrier and identifier standards
• /api/v1/schemas/ — JSON Schemas
• openapi.yaml — OpenAPI 3.1

FAQ

When does the battery passport become mandatory?

18 February 2027, for every EV, LMT and industrial battery over 2 kWh placed on the EU market — Regulation (EU) 2023/1542, Article 77 and Annex XIII.

Is this the official EU DPP Registry?

No. The Commission's registry was established by Implementing Regulation (EU) 2026/1778 and went live on 20 July 2026. This API is a client of it and defaults to the test environment. Registering for real also requires enrolling as a verified economic operator (an eIDAS identity check) with the Commission — that step happens outside this API.

Which categories are covered?

Version 1 is the battery passport: battery-ev, battery-lmt and battery-industrial. Other ESPR categories — textiles, electronics, furniture — arrive as new versioned data models as their delegated acts finalise, with no code change.

Do the QR codes actually scan?

Yes. The encoders are full implementations, and every symbol the test suite generates is rasterised and read back with two independent decoders across every version and size, so a regression fails the build instead of shipping a label nobody can scan.

How much does it cost?

Nothing. The reference data is free and open, creating and resolving are free with rate limiting, the code is MIT-licensed, and the data comes from free Commission publications with attribution.

👋 Want an API for your idea?

This API was designed and built by Allan Niñal, an AI & software engineer who ships friendly, well-made, developer-first APIs and data products. Tell me the problem in plain words — product passports, compliance, traceability, or anything else — and I'll turn it into something that works.