# DPPAutomate

> DPPAutomate issues, manages and resolves EU Digital Product Passports (DPPs). A DPP is the structured, machine-readable record EU regulation (ESPR - Ecodesign for Sustainable Products Regulation) requires for products placed on the EU market. DPPAutomate generates a passport from a single product photo, keeps it compliant, and exposes it to the world through a GS1 Digital Link resolver, a public JSON-LD endpoint, a full REST API and an MCP server. It is built agentic-first: hand an LLM a workspace master API key and it can run the entire DPP workflow end to end.

A passport has 12 sections (identification, economic operator, production, materials, chemical compliance, environmental impact, sustainability, care instructions, end-of-life, compliance, data interoperability, metadata) plus an AI-written summary. Coverage spans the ESPR core plus product groups such as batteries (EU Battery Regulation 2023/1542, Annex XIII), textiles, electronics, furniture, packaging, tyres, toys and steel/aluminium.

## Start here (machine-readable)

- [OpenAPI 3.1 spec](https://dppautomate.com/api/openapi.json): the complete, unversioned contract for every endpoint, schema and error code. Fetch this once to learn the whole API surface.
- [API reference](https://dppautomate.com/en/docs/api): human-readable reference for the Layer 2 management API.
- [Quickstart](https://dppautomate.com/en/docs/quickstart): the fastest path from zero to your first passport.

## How it works (the model)

- A **workspace** owns passports, learnings, settings and API keys.
- A **master API key** is scoped to one workspace. Create it in the dashboard under Settings > API Keys. Give it to an LLM and it can run your entire DPP workspace.
- **AI mode** governs persistence: in *Review* mode AI-generated and imported passports become drafts awaiting human approval; in *Auto* mode they become active immediately.
- **Learnings** are natural-language instructions that steer future AI generations. They are captured automatically from human corrections on draft approval, or added manually.

## Two access layers

- **Layer 1 - public regulatory access (no auth).** `GET https://dppautomate.com/api/public/v1/passports/{dppUid}` returns the published passport as JSON-LD (`application/ld+json`), redacted per its data access level. This is what QR codes and crawlers resolve.
- **GS1 Digital Link resolver.** This domain is a GS1 DL resolver: `GET https://dppautomate.com/01/{gtin}/21/{serial}` 302-redirects to `https://dppautomate.com/dpp/{dppUid}`. The GTIN is validated (GS1 mod-10 check digit) and normalised to GTIN-14.
- **Layer 2 - the management API (Bearer master key).** Base path `https://dppautomate.com/api/v1`. Authenticate every request with `Authorization: Bearer ep_live_sk_...`. Key permissions are read | write | delete. A `402` is a billing gate (CAPACITY_REACHED or WORKSPACE_NEEDS_PLAN); billing is managed in the dashboard, not over the API.

## Rate limits

Per key, per minute, by billing tier: sandbox 60, starter 120, operator 600, scale 1200, enterprise 6000 requests/min. A `429` includes `Retry-After` and `X-RateLimit-Limit` / `X-RateLimit-Remaining` / `X-RateLimit-Reset` headers - back off and retry after the window resets.

## Key endpoints

- [Generate a passport from a product image](https://dppautomate.com/api/openapi.json): `POST https://dppautomate.com/api/v1/passports/generate` (write). Body `{ "image": "data:image/png;base64,...", "category"?: string, "create"?: boolean }`. The main agentic entry point. Respects AI mode (Review -> draft, Auto -> active); `create:false` returns a preview without saving.
- Passports: `GET|POST https://dppautomate.com/api/v1/passports`, `GET|PATCH|DELETE https://dppautomate.com/api/v1/passports/{id}`, `GET .../{id}/qr` (svg/png/json), `GET .../passports/export` (json|jsonld|csv|excel|pdf|qr).
- Drafts (Review-mode queue): `GET https://dppautomate.com/api/v1/drafts`, `POST .../drafts/{id}/approve`, `POST .../drafts/{id}/reject`.
- Learnings: `GET|POST https://dppautomate.com/api/v1/learnings`, `PATCH|DELETE .../learnings/{id}`.
- Workspace + AI mode: `GET https://dppautomate.com/api/v1/workspace`, `GET|PUT .../workspace/mode` (`{ "mode": "review" | "auto" }`).
- Webhooks (signed `passport.*` / `draft.*` events): `GET|POST https://dppautomate.com/api/v1/webhooks` and `.../webhooks/{id}` lifecycle + `.../deliveries` + `.../test`.

Idempotency: `POST` create endpoints accept an `Idempotency-Key` header (opaque, <= 256 chars, remembered 24h) so retries are safe. Request bodies are size-limited (2 MB JSON, 8 MB for the base64 image on generate).

## MCP server (Model Context Protocol)

For MCP-capable agents we expose a Streamable HTTP MCP endpoint: `POST https://dppautomate.com/api/mcp` (JSON-RPC 2.0, stateless). Authenticate with the same `Authorization: Bearer ep_live_sk_...` master key. Tools include `list_passports`, `search_passports`, `get_passport`, `create_passport`, `generate_passport_from_image`, `get_compliance_readiness`, `get_workspace_stats`, `list_drafts`, `update_passport`, `approve_draft`, `reject_draft`, `import_passports`, and the `*_learning` family. The full human-in-the-loop cycle is generate -> list_drafts -> update_passport -> approve_draft / reject_draft.

## Learn about Digital Product Passports

- [What is the ESPR](https://dppautomate.com/en/espr): the Ecodesign for Sustainable Products Regulation that mandates DPPs.
- [DPP timeline](https://dppautomate.com/en/dpp-timeline): rollout dates by product group.
- [DPP deadlines tracker](https://dppautomate.com/en/dpp-deadlines-tracker): the honest master matrix answering "when is the digital product passport mandatory?" - binding dates (battery passport 18 Feb 2027; toy DPP 1 Aug 2030; ESPR registry 19 Jul 2026) vs indicative delegated-act windows (textiles/steel/aluminium/tyres ~2026-2027, furniture ~2028), each cited to EUR-Lex/EC and stamped last verified July 2026. Electronics and cosmetics have no fixed DPP date.
- Per-industry "when is a DPP mandatory for X" pages: [batteries](https://dppautomate.com/en/dpp-mandatory-batteries) (18 Feb 2027, confirmed), [textiles](https://dppautomate.com/en/dpp-mandatory-textiles) (~2027, indicative), [electronics](https://dppautomate.com/en/dpp-mandatory-electronics) (no fixed date), [furniture](https://dppautomate.com/en/dpp-mandatory-furniture) (~2028, indicative), [toys](https://dppautomate.com/en/dpp-mandatory-toys) (1 Aug 2030, confirmed), [cosmetics](https://dppautomate.com/en/dpp-mandatory-cosmetics) (no fixed date, not an ESPR priority group).
- [Battery passport](https://dppautomate.com/en/battery-passport) and [2027 battery deadlines](https://dppautomate.com/en/battery-passport-deadlines-2027): EU Battery Regulation specifics.
- [GS1 Digital Link](https://dppautomate.com/en/gs1-digital-link): how QR codes resolve to passports.
- [DPP platform](https://dppautomate.com/en/dpp-platform), [pricing](https://dppautomate.com/en/pricing) and [DPP cost](https://dppautomate.com/en/dpp-cost): the product and what it costs.
- [ERP / PIM integration](https://dppautomate.com/en/erp-pim-integration) and [integrations](https://dppautomate.com/en/integrations): connecting your existing systems.
- [Glossary](https://dppautomate.com/en/glossary) and [blog](https://dppautomate.com/en/blog): background reading.
- Free DPP readiness check: https://dppautomate.com/en/dpp-readiness-check

## Product-group passports

- [Textile DPP](https://dppautomate.com/en/textile-dpp)
- [Electronics DPP](https://dppautomate.com/en/electronics-dpp)
- [Furniture DPP](https://dppautomate.com/en/furniture-dpp)
- [Packaging DPP](https://dppautomate.com/en/packaging-dpp)
- [Tyres DPP](https://dppautomate.com/en/tyres-dpp)
- [Toys DPP](https://dppautomate.com/en/toys-dpp)
- [Steel & aluminium DPP](https://dppautomate.com/en/steel-aluminium-dpp)

## Company

- [About](https://dppautomate.com/en/about): DPPAutomate is built and operated from Winterthur, Switzerland.
- [Contact](https://dppautomate.com/en/contact): talk to the team.
- [Trust & security](https://dppautomate.com/en/trust): how we handle data.

## Optional

- [Privacy policy](https://dppautomate.com/en/privacy)
- [Terms of service](https://dppautomate.com/en/terms)
- [Cookie policy](https://dppautomate.com/en/cookie-policy)
- [Data processing agreement](https://dppautomate.com/en/dpa)