DPP Agent docs

EN 18216 — Data exchange protocols

EN 18216:2026 sets how passport data travels between systems and in which formats. It is short: one clause on protocols, one on formats. This page summarises it and states where DPP Agent stands. It is not a substitute for the text, which the national standards bodies sell.

What the standard asks

Protocol (clause 4)

  • HTTPS. Passport access runs over HTTP with TLS. TLS 1.2 is the minimum, TLS 1.3 is strongly recommended, and TLS 1.0, 1.1 and SSL are prohibited.
  • HTTP/2 or later. HTTP/2 is the minimum version; HTTP/3 is recommended.
  • REST. An API built on the protocol should follow the RESTful style. The API itself is EN 18222's subject.

Formats (clause 5)

  • JSON (ISO/IEC 21778) is the format for syntactic interoperability.
  • XML and JSON-LD may be offered as well, chosen by HTTP content negotiation. JSON-LD has to stay readable by a plain JSON parser.
  • HTML is provided for people, also by content negotiation, and the human-readable form has to meet the accessibility requirements of EN 301 549.

How the data is stored is EN 18221's subject, not this one's.

Where DPP Agent stands

Implemented.

  • Every passport answers over HTTPS on HTTP/2.
  • One address, several forms. Accept: text/html gets the passport page; Accept: application/json gets JSON; Accept: application/ld+json gets JSON-LD. The JSON-LD is plain JSON with an @context. Each response lists the other forms in its Link header.
  • ?linkType=all returns the passport's links as an RFC 9264 linkset (application/linkset+json).
  • The passport page is rendered on the server, so the content is in the first response without JavaScript.

Not implemented.

  • XML. A request that accepts only XML gets HTML. XML is optional in the standard.
  • We have not had the passport page audited against EN 301 549.

See the resolve API for the request and response details.

Standard reference

CEN/CENELEC JTC 24. EN 18216:2026 — Digital product passport — Data exchange protocols. Cited in the Official Journal by Commission Implementing Decision (EU) 2026/1736.