1. Trust & Identity
Cryptographic identity documents for PassportLab. These endpoints are used by verifiers, wallets, and DID resolvers to retrieve the public signing key and conformance manifest.
Returns the PassportLab DID:Web document containing the organisation's Ed25519 public key. Used by third-party verifiers to check digital signatures on W3C Verifiable Credentials and SD-JWTs without contacting PassportLab at verification time.
Request
GET /.well-known/did.json HTTP/1.1
Host: api.passportlab.io
Accept: application/json
Response 200 OK
{
"@context": ["https://www.w3.org/ns/did/v1"],
"id": "did:web:passportlab.io",
"verificationMethod": [{
"id": "did:web:passportlab.io#key-1",
"type": "JsonWebKey2020",
"controller": "did:web:passportlab.io",
"publicKeyJwk": {
"kty": "OKP",
"crv": "Ed25519",
"x": "..."
}
}],
"assertionMethod": ["did:web:passportlab.io#key-1"]
}
UNTP (UN Transparency Protocol) conformance manifest. Declares PassportLab's conformance with the UN Transparency Protocol v0.7.0 and lists the credential types issued (DigitalProductPassport, DigitalConformityCredential, DigitalTraceabilityEvent, DigitalFacilityRecord).
Request
GET /.well-known/untp-conformance.json HTTP/1.1
Host: api.passportlab.io
Response 200 OK
{
"conformsTo": "https://uncefact.github.io/spec-untp/docs/specification/",
"version": "0.7.0",
"implementationName": "PassportLab",
"credentials": [
{
"type": "DigitalProductPassport",
"version": "0.7.0",
"issuerDid": "did:web:passportlab.io",
"credentialFormats": ["W3C VC v2.0 (eddsa-jcs-2022)", "SD-JWT (vc+sd-jwt, EdDSA)"]
}
]
}
2. GS1 Digital Link Resolver
Resolves GS1-standard product identifiers (GTIN + serial number) to the corresponding Digital Product Passport. Compatible with any GS1-compliant scanner or resolver network. Supports Accept: application/linkset+json for GS1 link-set responses.
Resolves a GS1 Digital Link (GTIN + serial) to the associated DPP. Returns a redirect to the DPP public URL, or a JSON/linkset response depending on the Accept header. This is the URL embedded in QR codes printed on physical products.
Parameters
| Name | In | Type | Description |
|---|
gtin | path | string | GS1 GTIN-14 (14-digit global trade item number) |
serial | path | string | GS1 Serial Number (AI 21) |
Headers
| Name | Required | Description |
|---|
Accept | No | Set to application/linkset+json to receive a GS1 link-set document instead of a redirect |
Request
GET /api/v1/public/01/09506000134352/21/SN-2024-001 HTTP/1.1
Host: api.passportlab.io
Accept: application/json
Response 200 OK
{
"dppCode": "DPP-09506000134352-SN-2024-001",
"gtin": "09506000134352",
"serial": "SN-2024-001",
"passportUrl": "https://www.passportlab.io/dpp/DPP-09506000134352-SN-2024-001",
"apiUrl": "https://api.passportlab.io/api/v1/public/dpp/DPP-09506000134352-SN-2024-001",
"productName": "Lithium Battery Pack 48V",
"manufacturer": "ACME Energy GmbH"
}
Lists all active Digital Product Passports registered under a GTIN. Useful when the serial number is not available (e.g. from a product class barcode). Falls back to the GS1 global resolver at id.gs1.org if no DPPs are registered for this GTIN.
Parameters
| Name | In | Type | Description |
|---|
gtin | path | string | GS1 GTIN-14 |
Request
GET /api/v1/public/01/09506000134352 HTTP/1.1
Host: api.passportlab.io
Response 200 OK
{
"gtin": "09506000134352",
"results": [
{
"dppCode": "DPP-09506000134352-SN-2024-001",
"passportUrl": "https://www.passportlab.io/dpp/DPP-09506000134352-SN-2024-001",
"apiUrl": "https://api.passportlab.io/api/v1/public/dpp/DPP-09506000134352-SN-2024-001"
}
],
"total": 1
}
3. DPP Public Access
Read the full content of a Digital Product Passport and retrieve its QR code. These endpoints are used by consumer apps, retailer systems, recyclers, and customs authorities to access product sustainability data.
Returns the full public data of a Digital Product Passport. Includes product identity, materials, carbon footprint, repairability score, certifications, and all ESPR-mandated fields. The response language adapts to the Accept-Language header, using whichever ISO 639-1 translations the manufacturer supplied. Role-based field visibility applies when an X-Stakeholder-Key header is present.
Parameters
| Name | In | Type | Description |
|---|
dpp_code | path | string | DPP identifier (e.g. DPP-09506000134352-SN-001 or a UUID-based code) |
Headers
| Name | Required | Description |
|---|
Accept-Language | No | ISO 639-1 language code. Returns translated field labels for any language the manufacturer supplied a translation for (not limited to a fixed set). |
X-Stakeholder-Key | No | Stakeholder API key for role-filtered views (consumer, retailer, customs, msa, notified_body). |
Request
GET /api/v1/public/dpp/DPP-09506000134352-SN-001 HTTP/1.1
Host: api.passportlab.io
Accept-Language: de
Response 200 OK
{
"dppCode": "DPP-09506000134352-SN-001",
"productName": "Lithium Battery Pack 48V",
"manufacturer": "ACME Energy GmbH",
"countryOfOrigin": "DE",
"carbonFootprint": "12.4 kg CO₂e",
"repairabilityScore": 8.2,
"materials": [
{ "name": "Lithium", "percentage": 6.2, "recycledContent": 0 },
{ "name": "Cobalt", "percentage": 4.1, "recycledContent": 40 }
],
"certifications": ["IEC 62619", "UN 38.3"],
"vcUrl": "https://api.passportlab.io/api/v1/public/dpp/DPP-09506000134352-SN-001",
"verifiedAt": "2025-11-14T09:22:00Z"
}
Returns the raw W3C Verifiable Credential JSON (Content-Type: application/vc+ld+json). The proof is an eddsa-jcs-2022 DataIntegrityProof; the verificationMethod points to did:web:passportlab.io#key-1. Resolve /.well-known/did.json to get the Ed25519 public key and verify offline.
Parameters
| Name | In | Type | Description |
|---|
dpp_code | path | string | DPP identifier |
Request
GET /api/v1/public/dpp/DPP-09506000134352-SN-001/vc HTTP/1.1
Host: api.passportlab.io
Accept: application/vc+ld+json
Response 200 OK
{
"@context": [
"https://www.w3.org/ns/credentials/v2",
"https://vocabulary.uncefact.org/untp/dpp/0.7.0/"
],
"id": "https://www.passportlab.io/credentials/dpp/DPP-09506000134352-SN-001",
"type": ["VerifiableCredential", "DigitalProductPassport"],
"issuer": { "id": "did:web:passportlab.io" },
"validFrom": "2025-11-14T09:22:00Z",
"credentialSubject": { "...": "..." },
"proof": {
"type": "DataIntegrityProof",
"cryptosuite": "eddsa-jcs-2022",
"verificationMethod": "did:web:passportlab.io#key-1",
"proofPurpose": "assertionMethod",
"proofValue": "z5j4K..."
}
}
Returns the DPP credential as a compact JWS (vc+jwt). The JWT header contains alg=EdDSA and kid=did:web:passportlab.io#key-1. Decode the header, resolve the DID document, get the publicKeyJwk for that kid, and verify the Ed25519 signature. Compatible with any standard JWT library that supports OKP keys.
Parameters
| Name | In | Type | Description |
|---|
dpp_code | path | string | DPP identifier |
Request
GET /api/v1/public/dpp/DPP-09506000134352-SN-001/vc.jwt HTTP/1.1
Host: api.passportlab.io
Response 200 OK
eyJhbGciOiJFZERTQSIsInR5cCI6InZjK2p3dCIsImtpZCI6ImRpZDp3ZWI6cGFzc3BvcnRsYWIuaW8ja2V5LTEifQ
.eyJpc3MiOiJkaWQ6d2ViOnBhc3Nwb3J0bGFiLmlvIiwianRpIjoiaHR0cHM6Ly9wYXNzcG9ydGxhYi5pby9jcmVkZW50aWFscy9...
.signature
Returns a PNG QR code image encoding the GS1 Digital Link URL for this product. Print it on packaging, labels, or product inserts. Scanning the QR code takes the end consumer to the public DPP view at passportlab.io/dpp/{code}.
Parameters
| Name | In | Type | Description |
|---|
dpp_code | path | string | DPP identifier |
size | query | integer | Image size in pixels (default: 300). Range: 100–2000. |
Request
GET /api/v1/public/dpp/DPP-09506000134352-SN-001/qr.png?size=400 HTTP/1.1
Host: api.passportlab.io
Response 200 OK
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 3214
<binary PNG data>
4. Verification
Verify the cryptographic integrity of a Digital Product Passport. These endpoints validate Ed25519 signatures, check W3C VC proof chains, and verify SD-JWT selective disclosure tokens issued by PassportLab.
Verifies the cryptographic proof on a DPP and returns the verification result. Checks that the Ed25519 signature is valid against the PassportLab DID:Web public key. Returns the signing key, issuer DID, and whether the proof passes.
Parameters
| Name | In | Type | Description |
|---|
dpp_code | path | string | DPP identifier |
Request
GET /api/v1/verify/DPP-09506000134352-SN-001 HTTP/1.1
Host: api.passportlab.io
Response 200 OK
{
"valid": true,
"dppCode": "DPP-09506000134352-SN-001",
"issuer": "did:web:passportlab.io",
"verificationMethod": "did:web:passportlab.io#key-1",
"algorithm": "Ed25519",
"signedAt": "2025-11-14T09:22:00Z",
"productName": "Lithium Battery Pack 48V"
}
Verifies a raw W3C Verifiable Credential JSON-LD document. Submit any VC issued by PassportLab to check the proof. Returns validation status and the decoded credential subject.
Request
POST /api/v1/verify HTTP/1.1
Host: api.passportlab.io
Content-Type: application/json
{
"@context": ["https://www.w3.org/ns/credentials/v2"],
"type": ["VerifiableCredential", "DigitalProductPassport"],
"issuer": "did:web:passportlab.io",
"proof": {
"type": "DataIntegrityProof",
"cryptosuite": "eddsa-jcs-2022",
"proofValue": "..."
}
}
Response 200 OK
{
"valid": true,
"issuer": "did:web:passportlab.io",
"credentialType": "DigitalProductPassport",
"issuanceDate": "2025-11-14T09:22:00Z"
}
Verifies an SD-JWT Verifiable Credential. Accepts the compact serialisation (header.payload.signature~disclosure~...) and returns which fields were selectively disclosed, whether the EdDSA signature is valid, and the decoded claims.
Request
POST /api/v1/verify/sd-jwt HTTP/1.1
Host: api.passportlab.io
Content-Type: application/json
{
"token": "eyJhbGciOiJFZERTQSJ9.eyJfc2QiOlsiLi4uIl19.signature~disclosure~"
}
Response 200 OK
{
"valid": true,
"algorithm": "EdDSA",
"issuer": "did:web:passportlab.io",
"disclosedClaims": {
"productName": "Lithium Battery Pack 48V",
"carbonFootprint": "12.4 kg CO₂e",
"materials": [...]
},
"undisclosedFields": ["hsCode", "producerLei"]
}
Returns a summary of customs-relevant product data: HS tariff code, country of origin, materials declaration, and ESPR compliance status. Designed for use by customs authorities, EU border inspection posts, and trade compliance systems. No authentication required.
Parameters
| Name | In | Type | Description |
|---|
dpp_code | path | string | DPP identifier |
Request
GET /api/v1/public/customs/verify/DPP-09506000134352-SN-001 HTTP/1.1
Host: api.passportlab.io
Response 200 OK
{
"dppCode": "DPP-09506000134352-SN-001",
"productName": "Lithium Battery Pack 48V",
"manufacturer": "ACME Energy GmbH",
"countryOfOrigin": "DE",
"hsCode": "8507.60",
"materials": [
{ "name": "Lithium", "percentage": 6.2 },
{ "name": "Cobalt", "percentage": 4.1 }
],
"espr_compliant": true,
"hasVerifiableCredential": true,
"signatureValid": true
}
5. Supply Chain Events
EPCIS 2.0-compliant supply chain event log. Each DPP accumulates traceability events (ObjectEvent, TransformationEvent, AggregationEvent) from all stakeholders in the supply chain. These events are export-ready in EPCIS 2.0 Document format.
Returns the full EPCIS 2.0 Document for a DPP — all recorded supply chain events from manufacture to retail. Compatible with GS1-certified EPCIS repositories. The response follows the EPCIS 2.0 JSON-LD context. Stakeholder-key filtering applies: customs authorities and MSAs can access additional event metadata.
Parameters
| Name | In | Type | Description |
|---|
dpp_code | path | string | DPP identifier |
Headers
| Name | Required | Description |
|---|
X-Stakeholder-Key | No | Stakeholder key for role-filtered event visibility (customs, msa, retailer, notified_body). |
Request
GET /api/v1/dpp/DPP-09506000134352-SN-001/events/document HTTP/1.1
Host: api.passportlab.io
Accept: application/json
Response 200 OK
{
"@context": ["https://ref.gs1.org/standards/epcis/2.0.0/epcis-context.jsonld"],
"type": "EPCISDocument",
"schemaVersion": "2.0",
"creationDate": "2025-11-14T09:22:00Z",
"epcisBody": {
"eventList": [
{
"type": "ObjectEvent",
"eventTime": "2025-10-01T08:00:00Z",
"action": "ADD",
"bizStep": "commissioning",
"epcList": ["urn:epc:id:sgtin:0950600.013435.SN-2024-001"],
"readPoint": { "id": "urn:epc:id:sgln:0950600.00000.0" }
}
]
}
}
6. Notified Bodies
Search the EU NANDO database of notified conformity assessment bodies. Use this to look up which laboratories and certification bodies are authorised to issue conformity certificates for specific EU legislation.
Searches the list of EU-recognised notified bodies indexed by PassportLab. Returns name, notified body number, country, and the EU directives/regulations they are accredited for. Currently covers 28 bodies across ESPR-relevant product categories.
Parameters
| Name | In | Type | Description |
|---|
q | query | string | Search term (body name, country, or directive number) |
country | query | string | ISO 3166-1 alpha-2 country code filter (e.g. DE, FR, IT) |
Request
GET /api/v1/public/nando/search?q=battery&country=DE HTTP/1.1
Host: api.passportlab.io
Response 200 OK
{
"results": [
{
"id": "0123",
"name": "TÜV SÜD Product Service GmbH",
"country": "DE",
"notifiedNumber": "0123",
"directives": ["2006/66/EC Battery Directive", "2014/30/EU EMC"],
"website": "https://www.tuvsud.com"
}
],
"total": 3
}
7. Interoperability Standards
PassportLab maps each credential and data format to the EU standard that governs it (EN 18223 §4 — Interoperability Requirements). Use this table to understand which protocol to use for each integration.
| Standard / Protocol | Role in PassportLab | EN 18223 reference |
|---|
W3C VC v2.0 (eddsa-jcs-2022) | Primary credential format for DPP assertions. Ed25519 signed, JSON-LD serialisation. Used by customs, MSAs, and notified bodies for offline verification. | §4.2 — Verifiable Credentials |
SD-JWT VC (IETF draft) | Selective disclosure — share only the fields required by a given stakeholder (e.g. carbon footprint to customs, not supply chain origin to consumers). | §4.3 — Selective Disclosure |
GS1 Digital Link 1.1 | Physical-to-digital bridge. QR codes encode a GS1 DL URL (/01/{gtin}/21/{serial}) that resolves to the DPP. Compatible with any GS1-certified scanner. | §4.4 — Product Identifiers |
UNTP v0.7.0 | UN Transparency Protocol credential types: DigitalProductPassport, DigitalConformityCredential, DigitalTraceabilityEvent. Manifest at /.well-known/untp-conformance.json. | §4.5 — Traceability Credentials |
EPCIS 2.0 (GS1 CBV 2.0) | Supply chain event log. All events (ObjectEvent, AggregationEvent, TransformationEvent) are exported as EPCIS 2.0 Documents with JSON-LD context. | §4.6 — Event Log |
AAS Part 2 (IEC 63278) | Asset Administration Shell export (/aas.json). Five submodels: Nameplate, TechnicalData, CarbonFootprint, Circularity, EnergyConsumption. Required for Catena-X and IDSA data spaces. | §4.7 — Digital Twin Shell |
DID:Web (W3C) | Platform-level and per-organisation decentralised identifiers. Resolves to an Ed25519 public key. Verifiers resolve /.well-known/did.json to verify signatures without contacting PassportLab. | §4.2 — Issuer Identity |
SHACL (W3C) | Data shape validation. Shapes for battery, electronics, textile, steel, and construction categories published at /public/schemas/shacl/{category}.ttl. | §4.8 — Data Validation |