Build trusted product intelligence with Norruva APIs.
Ship Digital Product Passports, compliance intelligence, and lifecycle events directly into your ERP, PLM, or commerce stack. Norruva gives you the data layer plus audit-ready trails.
Quickstart
Sign up to provision a tenant. There is no CLI for this — it happens in the browser.
https://app.norruva.com/auth/signup
Issue scoped keys from Settings → Developer. The secret is shown once.
https://app.norruva.com/workspace?view=developer
POST your product data to receive a passport ID.
curl -X POST https://app.norruva.com/api/v2/products \
-H 'Authorization: Bearer $NORRUVA_API_KEY' \
-H 'Content-Type: application/json' \
-d '{
"name": "Acme Cell 48V",
"description": "48V lithium-ion battery module for light electric vehicles.",
"category": "battery",
"status": "Draft"
}'Register an endpoint to receive signed, retried webhook deliveries.
curl -X POST https://app.norruva.com/api/v2/webhooks \
-H 'Authorization: Bearer $NORRUVA_API_KEY' \
-H 'Content-Type: application/json' \
-d '{
"url": "https://example.com/webhooks",
"events": ["revocation.created", "approval.completed"]
}'Developer Resources
Everything you need to design, build, and operate your integration.
API Playground
API Reference
Webhooks
Authentication
Security
Data Schemas
Changelog
SDKs and Tooling
Production-ready libraries and utilities for your stack.
Getting started
Two public, unauthenticated contracts are all an integrator needs to start building — on desktop or mobile, without prior Digital Product Passport expertise: the API surface itself, and the data it exchanges.
Read the OpenAPI specification
Browse the JSON Schema catalogue
Environments and Base URLs
The single API host. Scoped API keys, RBAC, tier limits and audit logging apply.
Same host and same data plane — a time-boxed flag on your workspace, not an isolated environment. Do not use it for destructive testing.
Webhook Event Catalog
Security Advisories
- Public and CORS-enabled — consumer tooling reads it without a key. 60 req/min per IP.
- Addressed by the same public company slug the Trust Center uses.
- Fails closed: 503 SECURITY_ADVISORY_PUBLISHING_NOT_CONFIGURED when the advisory channel is unbound. An empty feed means none were published — the two are never conflated.
Security Checklist
Integration Playbook
Map product schema, load 25-100 SKUs, validate audit exports.
Automate ingestion, add webhooks, enable compliance workflows.
Monitor rate limits, alerts, and audit readiness dashboards.
Partner Onboarding
Ready to start your Enterprise pilot? Get in touch with our engineering team for specialized support and custom integration architectures.
Contact Developer Support