PoLI access
What is PoLI?
PoLI (Person of Legal Interest) is a concept under EU Battery Regulation 2023/1542. Certain entities — market surveillance authorities, customs authorities, the European Commission, and other bodies with a statutory right of access — may view restricted DPP fields that are not shown to the general public (for example detailed supply chain traceability, raw material sourcing documentation, and internal test references).
Traceable grants this access through an audited, human-reviewed workflow.
PoLI access is a web flow, not a developer REST API. There is no bearer-authenticated PoLI API, no API key, and no JSON endpoint that returns restricted fields. Access is requested from the public DPP page, confirmed by email, approved by the manufacturer, and then granted to the requester's browser. If you are looking for a programmatic interface to author DPPs, see the Integration API instead.
How access works
1. Request — fill the access form on the public DPP page (email, name, organisation, role)
2. Verify — click the link emailed to you → GET /api/poli/verify?token=...
3. Review — the manufacturer approves or rejects the request in their portal
4. Access — open the link emailed on approval → GET /api/poli/access?token=...
(this grants your browser access; the DPP page now shows restricted fields)
1. Request access
On a published DPP page, a person of legal interest opens the request access form and submits their email, name, organisation, and role. The role you select determines the access tier you are granted if approved.
There is no public API for this step — it is a form on the DPP page. Submitting it creates a pending, email-unverified access request and sends you a verification email.
2. Verify your email
The verification email contains a one-time link:
GET https://app.traceable.digital/api/poli/verify?token=<verification_token>
Opening it in your browser confirms your email address and marks the request ready for the manufacturer to review. It is a redirect, not a JSON response — there is no body to parse and no authentication header.
3. Manufacturer review
The manufacturer (and Traceable platform administrators) are notified of a verified request and review it. They approve or reject it. There is no fixed SLA; the timing depends on the manufacturer. Rejection reasons, where given, are sent to the email address on the request.
4. Access the restricted fields
If the request is approved, you receive an access link:
GET https://app.traceable.digital/api/poli/access?token=<access_token>
Opening it in your browser validates the token, grants your session access (via a cookie), and redirects you to the product's DPP page. The DPP page then displays the restricted, PoLI-tier fields that your access level permits. Access is time-limited; when it lapses, request access again.
Endpoint summary
These are the only two HTTP endpoints in the PoLI flow. Both are tokenised browser links delivered by email — they take a token query parameter, require no Authorization header, and respond with redirects, not JSON.
| Endpoint | Purpose |
|---|---|
GET /api/poli/verify?token= | Confirm the requester's email after they submit the access form |
GET /api/poli/access?token= | Grant an approved requester access and redirect to the DPP |
Restricted fields are served on the DPP page, not the JSON API
The public JSON API (GET /api/dpp/{slug} and /jsonld) always returns public fields only. It never returns restricted fields, and it has no access-token parameter. Restricted PoLI-tier fields are visible only on the rendered DPP web page, and only to a browser session that has been granted access through the flow above. See DPP endpoints for the public JSON surface.
For developers
There is nothing to integrate here programmatically. If you are an authority seeking access, use the request form on the relevant DPP page. If you are building a system that authors DPPs, use the Integration API.