DPP Agent docs

Public API overview

DPP Agent has a small HTTP API for creating and reading Digital Product Passports in every category: textiles, batteries, electronics, tyres, furniture and the rest. The endpoints are the same for every category; only the keys inside dpp_data differ (see the category guides).

New here? Start with the quickstart.

Base URLs

Layer URL Notes
Passport addresses https://{slug}.dpp.dppagent.com What a QR code points at. A brand with a verified domain uses that instead.
API https://dppagent.com/api/v1 Creating, updating and reading passports, QR codes, labels, validation.
Documentation https://docs.dppagent.com This reference.

Authentication

Three kinds of endpoint:

Endpoint Public API key Dashboard session
Passport addresses (resolve) yes — —
GET /api/v1/qr, GET /api/v1/label yes — —
GET/POST /api/v1/validate yes, limited more detail, no anonymous limits —
GET /api/v1/dppsByProductId/{gtin}, POST /api/v1/dppsByProductIds, GET /api/v1/dpps/{id}/versions yes — —
POST /api/v1/dpps, GET/PATCH/DELETE /api/v1/dpps/{id}, POST /api/v1/dpps-batch — yes yes
Tenants, certifications, suppliers, files, members, custom domains, analytics, imports — no yes

The last row is what the dashboard uses. Those endpoints need a signed-in user who is an admin or editor of the tenant; an API key gets 401 there. This reference documents them, but an integration can only use the passport endpoints.

API keys

A tenant admin creates keys in the dashboard under Settings → API. The key is shown once, when it is created; afterwards only its prefix is visible. Keys start with dpp_live_, belong to one tenant, and can be revoked at any time, which takes effect at once.

POST /api/v1/dpps
Authorization: Bearer dpp_live_a8b1c2d3e4…
Content-Type: application/json

With a key, the tenant comes from the key: tenant_id can be left out, and a request naming another tenant is refused with 403 tenant_mismatch. Keep keys on a server; never put one in browser code.

Rate limits

With an API key, each tenant has a quota by plan, counted over a rolling minute and a rolling 24 hours:

Plan Per minute Per 24 hours
Free 10 100
Light 60 1 000
Custom 600 100 000

Responses to key-authenticated requests carry X-RateLimit-Limit and X-RateLimit-Remaining for the 24-hour quota. Over a limit the answer is 429 with { "error": "quota_exceeded", "message": "…" } and Retry-After (60 seconds after the per-minute limit, 86 400 after the daily one).

Public endpoints are limited per IP address instead:

Endpoint Limit
Passport addresses 120 a minute; identified search-engine crawlers are not counted
GET /api/v1/dpps/{id}, dppsByProductId, /versions 60 a minute
POST /api/v1/dppsByProductIds, POST /api/v1/dpps-batch 30 and 60 a minute
validate, anonymous 20 a minute and 60 address checks an hour

Over a per-address limit the answer is 429 with Retry-After. The per-minute counts are kept per server instance, so treat them as approximate.

Conventions

  • Format: JSON in and out unless stated otherwise, Content-Type: application/json; charset=utf-8.
  • Identifiers: every passport has a UUID (id) and a public address (passport_id). GET /api/v1/dpps/{id} takes either; PATCH and DELETE take the UUID.
  • Dates: ISO 8601 in UTC (2026-06-26T13:42:05.000Z).
  • Countries and currencies: ISO 3166-1 alpha-2 (SE, DK, FR) and ISO 4217 (EUR, SEK).
  • Lists: there is no endpoint that lists all of a tenant's passports. Look passports up by GTIN with dppsByProductId / dppsByProductIds.

Versioning

The API is on v1. Changes that would break an integration go into a new version; additions (new fields, endpoints, optional parameters) are made within v1.

Errors

A non-2xx status with a JSON body that always has error:

{ "error": "Validation failed", "details": ["gtin: must be 8-14 digits"] }

See Errors for what each status means.

CORS

All the endpoints above answer cross-origin requests (Access-Control-Allow-Origin: *), so validators, scanner apps and browser tools can call them. That is not a reason to call the key-authenticated endpoints from a browser.

Caching

Published passports are cached at the CDN for up to five minutes; see Caching. QR codes and labels are cached for ten minutes.

Next