Chain of custody
Most descriptions of a product passport stop at publication — import, validate, sign, publish. That is the first half. A product is repaired, resold, remanufactured and eventually recycled, and the record has to survive all of it while answering different people differently.
Eight stations. Each names the actor who touches the record there, and the endpoint that serves them.
The spine
The data arrives the way it actually exists: spreadsheets.
CSV and Excel, with a dry run that reports errors per row rather than rejecting the file. Nobody's product data starts life in a schema, and a tool that insists otherwise is a tool nobody can start using.
/integrator/api/v1/import/{productGroup}
A document a supplier has not sent is visible as a gap, not as a blank.
Evidence is a first-class object with its own address and its own verification, rather than a field someone filled in. The difference matters when an auditor asks where a number came from.
/api/v1/dpp/{id}/evidence
Checked against the product group's signed ruleset, before anything is signed.
Rules arrive as signed bundles and are verified fail-closed. When a threshold changes, the ruleset changes — not the software, and not a redeploy.
/api/v1/dpp/{id}/lint
Signed with the operator's own key, on their own infrastructure. Claims freeze here.
The identity is a did:web in a domain they control. Nothing is sent anywhere to be signed, which is the difference between holding a record and renting access to it.
/api/v1/dpp/{id}/publish
Scan the code, get the public view. No login, no fee — because the regulation says so.
A GS1 Digital Link when the product is identified by a GTIN, and a plain passport URL when it is not. Requiring the barcode would mean requiring GS1 membership.
/01/{gtin}/21/{serial}
Depth proven by credential, not by a header the caller sets.
The same record answers differently depending on who is asking, enforced per field. For batteries this is a lattice rather than a ladder: an authority sees less than a recycler in one specific respect.
/credential/dpp/{id}
Responsibility changes hands with both parties' signatures on the record.
Remanufacture, repurposing, a sold product line. The chain of custody is part of the passport rather than an email thread, and either side can refuse or withdraw.
/api/v1/dpp/{id}/transfer/initiate · /accept
A typed end of life, and a dossier that verifies with no network and no trust in us.
Passport, signatures, identity documents and the full hash-chained history in one signed file. Someone who has never heard of Odal Node can check it offline.
/api/v1/dpp/{id}/eol · /evidence
The gap
Import, validate, sign, publish, resolve — that is a passport generator, and it is genuinely useful. It is also where the difficult half begins.
Stations 6, 7, 8 are the ones that make a record survive a decade of ownership changes rather than describing a product on the day it was made:
They are the reason this page is long. A capability that only shows up three years after purchase cannot be demonstrated in a screenshot, so the alternative is to describe it precisely enough to be checked.
Status
All eight stations exist in the software today. Nobody is running it in production — no customers, no pilots, no live deployments. The battery passport obligation begins on 18 February 2027, and we would rather be correct when it arrives than early and wrong.
The code is open: dpp-core is Apache-2.0 and can be read, audited or reused by anyone, including a competitor.