Skip to main content

Integration API — Phase 1.5 GA on production

The full Integration API is now GA on production (app.traceable.digital), shipped with release v0.99.6.1. Everything an integration needs to author Digital Product Passports headlessly, and to operate that integration at scale, is live behind per-key authentication.

This supersedes the earlier "Phase 1.5 on staging" preview: those endpoints are no longer staging-only.

What's live​

  • Full headless wizard parity — discover a category's fields, batch-ingest form data with fail-closed validation, close the traceability / component / GS1 gates, check the same readiness numbers the operator wizard shows, and submit for review. Publication stays a human step in the portal. See The wizard flow.
  • ERP field mapping — map your ERP's own column names to Traceable field_ids, lint a mapping before use, scaffold one from a category template, and apply it with ?mapping=<id> on writes. Unmapped columns are rejected, never silently dropped.
  • Sandbox mode — build with a pk_test_ key (send X-Traceable-Mode: test); its data never touches a real passport. See Sandbox mode.
  • Key management + IP allow-lists — mint, rotate, revoke, and bulk-revoke keys programmatically under /api/v1/keys, restrict a key to CIDR ranges (allowedCidrs, fail-closed), and get a Warning: 299 nudge on keys older than 90 days. Requires the privileged keys:admin scope.
  • Signed webhooks — HMAC-signed event delivery with retries and a dead-letter queue, plus delivery history and one-click redelivery under /webhook-endpoints.
  • GDPR data-subject endpoints — Article 15 access, Article 17 erasure (202 + 30-day SLA), and Article 20 portability under /api/v1/gdpr/*. Requires the privileged gdpr:admin scope and are live-mode only.

Auth model​

Every endpoint is behind per-key authentication with default-deny: an unknown or missing key returns 401, and an unknown or cross-tenant resource returns 404 (never a 403 that would confirm it exists). The grantable scope vocabulary is now thirteen, with two further privileged scopes (keys:admin, gdpr:admin) minted only from the Company Portal.

Read more​