REST API

The DPPAutomate REST API generates, manages, resolves and exports EU Digital Product Passports. Every endpoint accepts and returns JSON (the public regulatory endpoint returns JSON-LD). There is no SDK - talk to the API directly, or hand a master key to an LLM and let it drive. The full machine-readable contract lives at /api/openapi.json.

Two layers

The surface is split into two layers for two audiences:

Layer 1 - public regulatory. Base https://dppautomate.com/api/public/v1. Unauthenticated. Resolves a published passport to redacted JSON-LD - what QR codes, crawlers and notified bodies fetch.

Layer 2 - management API. Base https://dppautomate.com/api/v1. Authenticated with a per-workspace master key. Everything else: CRUD, AI generation, drafts, learnings, workspace mode, account resources.

Public endpoint

The one Layer-1 endpoint takes no authorization and is edge-cached with open CORS. It returns application/ld+json redacted to the passport's data access level (owner ids and confidential sections are never exposed), or 404 if nothing is published for the identifier.

# No auth. application/ld+json out.
curl https://dppautomate.com/api/public/v1/passports/DPP-1717-AB12CD

Authentication

Layer-2 requests use bearer-token authentication. Create a master key in the dashboard under Settings > API Keys - the secret starts with ep_live_sk_ and is shown once. Send it on every request:

Authorization: Bearer ep_live_sk_...

Permissions

Each key carries a set of permissions. The required permission is listed on every endpoint below.

• read - all GET endpoints.
• write - POST/PUT/PATCH that create or mutate.
• delete - DELETE and key revocation.
• An admin (or *) key satisfies every permission.

Endpoints

The full surface, grouped by resource. Path parameters are written as :id; Layer-2 paths are relative to https://dppautomate.com/api/v1. The badge after each path is the required permission.

Examples

Generate a passport from an image

The agentic entry point. Returns { passport, mode, status, created }; status is draft in Review mode, active in Auto mode, or preview when create:false.

curl https://dppautomate.com/api/v1/passports/generate \
  -X POST \
  -H "Authorization: Bearer $DPP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "image": "data:image/png;base64,<...>" }'

List passports

Paginated, filterable index. Supports status, category, search, favorite, page and per_page.

curl "https://dppautomate.com/api/v1/passports?status=active&per_page=25" \
  -H "Authorization: Bearer $DPP_API_KEY"

The response is paginated under meta with cursor links:

{
  "data": [
    {
      "id": "...",
      "object": "digital_product_passport",
      "status": "active",
      "identification": {
        "productName": "Merino Wool Beanie",
        "productCategory": "Textiles & Apparel",
        "dppUid": "DPP-1717-AB12CD"
      },
      "sustainability": { "sustainabilityScore": 82, "recyclabilityClass": "B" }
    }
  ],
  "meta": { "total": 42, "page": 1, "per_page": 25, "total_pages": 2 },
  "links": { "self": "...", "next": "...", "prev": null }
}

Rate limits

Layer-2 requests are rate limited per key over a rolling 60-second window, by billing tier. Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. Exceeding the ceiling returns 429 with a Retry-Afterheader. Layer 1 is unauthenticated and edge-cached, so it isn't counted here.

Errors

The API uses conventional HTTP status codes. Errors carry a uniform JSON envelope with a stable machine code:

{
  "error": {
    "message": "API key does not have write permission",
    "code": "FORBIDDEN",
    "status": 403
  }
}

OpenAPI & llms.txt

The reference above is the human view. The canonical, machine-readable sources of truth are:

• /api/openapi.json - the full OpenAPI 3.1 spec covering both layers, every schema, and every error code.
• /llms.txt - a concise operator guide written for AI agents, with an agent quickstart recipe.

MCP server. MCP-capable agents can connect to the Streamable HTTP endpoint at /api/mcp (JSON-RPC 2.0, stateless), authenticated with the same Authorization: Bearer ep_live_sk_... master key. It exposes tools to list, search, read, create and generate passports, score compliance readiness, and read workspace stats.

Webhooks. Register HTTPS endpoints under /api/v1/webhooks to receive a signed POST on passport lifecycle events (created, published, archived, deleted, draft approved/rejected). Each delivery carries an X-DPP-Signature header (Stripe-style HMAC-SHA256); verify it with the endpoint signing secret shown once at creation.

New to the API? Start with the Quickstart. Need help integrating? Contact support.