Designed to align with EN 18222:2026 — Digital Product Passport, Application Programming Interfaces (APIs). EN 18222:2026 is OJEU-cited by Commission Implementing Decision (EU) 2026/1736; no conformity assessment against it has been performed here, and this catalogue makes no presumption-of-conformity claim for this platform or for Norruva.
EN 18222:2026 Clause 4.1 defines a five-tier responsibility model: for each lifecycle method, which parties — the DPP creator, its main service provider, and/or a back-up DPP service provider — are obligated to make it available. The table below labels every method by what this deployment actually offers today.
Tier 1 — SHALL — creator or main service provider, and back-up service provider
SHALL
| Method | Endpoint | Responsible party | Back-up service provider | This deployment | Try it |
|---|---|---|---|---|---|
ReadDPPById | GET /api/v1/dpps/{dppId} | Creator or main service provider | Back-up service provider Not offered by this deployment | Route available Route available, but no data source: it reads the `passport_projections` bi-temporal projection, which nothing writes yet (ADR-169 §2 interim). Expect 404 for every real passport until the projector write path is ratified. | Try it |
ReadDPPByProductId | GET /api/v1/dppsByProductId/{productId} | Creator or main service provider | Back-up service provider Not offered by this deployment | Route available | Try it |
ReadDPPIdsByProductIds | POST /api/v1/dppsByProductIds | Creator or main service provider | Back-up service provider Not offered by this deployment | Route available |
Tier 2 — SHOULD — creator or main service provider, and back-up service provider
SHOULD
| Method | Endpoint | Responsible party | Back-up service provider | This deployment | Try it |
|---|---|---|---|---|---|
ReadDataElement | GET /api/v1/dpps/{dppId}/elements/{elementIdPath} | Creator or main service provider | Back-up service provider Not offered by this deployment | Route available Route available, but no data source: it reads the `passport_projections` bi-temporal projection, which nothing writes yet (ADR-169 §2 interim). Expect 404 for every real passport until the projector write path is ratified. | Try it |
Tier 3 — SHOULD — main service provider only, and back-up service provider (creator not listed)
SHOULD
| Method | Endpoint | Responsible party | Back-up service provider | This deployment | Try it |
|---|---|---|---|---|---|
CreateDPP | POST /api/v1/dpps | Main service provider only | Back-up service provider Not offered by this deployment | Route available | |
DeleteDPPById | DELETE /api/v1/dpps/{dppId} | Main service provider only | Back-up service provider Not offered by this deployment | Route available | |
ReadDPPVersionByIdAndDate | GET /api/v1/dppsByIdAndDate/{dppId} | Main service provider only | Back-up service provider Not offered by this deployment | Route available Route available, but no data source: it reads the `passport_projections` bi-temporal projection, which nothing writes yet (ADR-169 §2 interim). Expect 404 for every real passport until the projector write path is ratified. | Try it |
Tier 4 — conditional SHALL — creator or main service provider only
SHALL — authorized third parties have access rights to update parts of the DPP
| Method | Endpoint | Responsible party | Back-up service provider | This deployment | Try it |
|---|---|---|---|---|---|
UpdateDPPByIdCondition: authorized third parties have access rights to update parts of the DPP | PATCH /api/v1/dpps/{dppId} | Creator or main service provider | Not named by the standard for this tier Not offered by this deployment | Route available |
Tier 5 — conditional SHOULD — creator or main service provider only
SHOULD — authorized third parties have access rights to update parts of the DPP
| Method | Endpoint | Responsible party | Back-up service provider | This deployment | Try it |
|---|---|---|---|---|---|
UpdateDataElementCondition: authorized third parties have access rights to update parts of the DPP | PATCH /api/v1/dpps/{dppId}/elements/{elementIdPath} | Creator or main service provider | Not named by the standard for this tier Not offered by this deployment | Route available — declines write (501 ServerNotImplemented) Route exists and is reachable but returns 501 ServerNotImplemented — the write is not yet performed. |
No back-up DPP service provider deployment topology exists in this codebase today — that is an infrastructure/commercial decision outside this repository's scope, not a build gap. Every method above records that honestly rather than leaving the column blank.
Searchability surface (Clause 4.1, informative note)
EN 18222:2026 Clause 4.1 names exactly three methods as the surface a client may use to build search functionality. This group renders those three methods and nothing else — no other route on this platform, however search-shaped, belongs to this normative surface.
Registry API (Clause 5)
The registration method is a Clause 5 DPP Registry API call — it sits outside the Clause 4.1 five-tier lifecycle responsibility model above.
RegisterProductDPP
POST /api/v1/registerDPP — Table 17
Clause 5 registry method — outside the Clause 4.1 five-tier lifecycle responsibility model.
Table 15 — response status codes
| Status code | HTTP | Meaning | Has Result object |
|---|---|---|---|
Success | 200 | Success | No |
SuccessCreated | 201 | New resource created | No |
SuccessAccepted | 202 | Request received successfully | No |
SuccessNoContent | 204 | Success, no content in payload | No |
ClientErrorBadRequest | 400 | Bad / malformed request | Yes |
ClientNotAuthorized | 401 | Wrong / missing credentials | Yes |
ClientForbidden | 403 | Authorization refused | Yes |
ClientErrorResourceNotFound | 404 | Resource not found | Yes |
ClientMethodNotAllowed | 405 | Method request not allowed | Yes |
ClientResourceConflict | 409 | Resource already exists | Yes |
ServerInternalError | 500 | Unexpected error | Yes |
ServerNotImplemented | 501 | Functionality not supported | No |
ServerErrorBadGateway | 502 | Bad gateway | Yes |