PoLI access
What is PoLI?
PoLI (Person of Legal Interest) is a concept under EU Battery Regulation 2023/1542. Certain entities, market surveillance authorities, customs authorities, the European Commission, and other bodies with a statutory right of access, may view restricted DPP fields that are not shown to the general public (for example detailed supply chain traceability, raw material sourcing documentation, and internal test references).
Traceable grants this access through an audited, human-reviewed workflow.
PoLI access is a web flow, not a developer REST API. There is no API key, and no endpoint that returns restricted passport fields as JSON. The one exception is the BMS history of a single battery unit, which an approved legitimate-interest requester can read with the access token as a bearer token. See BMS endpoints. Access is requested from the public DPP page, confirmed by email, approved by the manufacturer, and then granted to the requester's browser. If you are looking for a programmatic interface to author DPPs, see the Integration API instead.
How access works
1. Request: fill the access form on the public DPP page (email, name, organisation, role and an optional purpose)
2. Verify: click the link emailed to you → GET /api/poli/verify?token=...
3. Review: the manufacturer approves or rejects the request in their portal
4. Access: open the link emailed on approval → GET /api/poli/access?token=...
(this grants your browser access; the DPP page now shows restricted fields)
1. Request access
On a published DPP page, a person of legal interest opens the request access form and submits their email, name, organisation, and role, and optionally a purpose. The role you select determines the access tier you are granted if approved.
There is no public API for this step: it is a form on the DPP page. The form submits to POST /api/poli/request (see Endpoint summary). Submitting it creates a pending, email-unverified access request and sends you a verification email.
2. Verify your email
The verification email contains a one-time link:
GET https://app.traceable.digital/api/poli/verify?token=<verification_token>
Opening it in your browser confirms your email address and marks the request ready for the manufacturer to review. It redirects to a public status page, /poli/status?state=...&product=<slug>, that says what happened. It is a redirect, not a JSON response: there is no body to parse and no authentication header.
3. Manufacturer review
A request from a person with a legitimate interest is decided by an Admin of the manufacturer's team, who approves or rejects it in the Company Portal and confirms the decision with a code emailed to them. See Access requests. A request from an authority, such as a Notified Body, the European Commission or market surveillance, is decided by Traceable, and the manufacturer is told afterwards which organisation asked, in which role, and the decision. There is no fixed SLA; the timing depends on the reviewer. A rejection reason, where given, is not part of the email to the requester: they are told the request was not approved.
4. Access the restricted fields
If the request is approved, you receive an access link:
GET https://app.traceable.digital/api/poli/access?token=<access_token>
Opening it in your browser validates the token, grants your browser access (via an httpOnly cookie valid for 30 days), and redirects you to the full passport page, /dpp/{slug}/full. That page then displays the restricted, PoLI-tier fields that your access level permits. Access is time-limited; when it lapses, request access again.
Endpoint summary
The flow uses two tokenised browser links and two same-origin browser endpoints that the DPP page calls itself. None accepts an API key and none is intended for server-to-server use.
The two tokenised browser links are delivered by email. They take a token query parameter, require no Authorization header, and respond with redirects, not JSON.
| Endpoint | Purpose |
|---|---|
GET /api/poli/verify?token= | Confirm the requester's email after they submit the access form |
GET /api/poli/access?token= | Grant an approved requester access and redirect to the full passport page |
The two same-origin browser endpoints are called by the DPP page with a same-origin check:
| Endpoint | Purpose |
|---|---|
POST /api/poli/request | The access form. JSON body fields email, name, organization, role, productId and an optional purpose. Rate limited per IP address and per recipient address |
POST /api/poli/documents/{documentId}/download | Returns a JSON body holding a signed link, valid for 15 minutes, to a passport's dismantling guide. Needs the httpOnly access cookie of an approved, unexpired grant on that passport |
Restricted fields are served on the DPP page, not the JSON API
The public JSON API (GET /api/dpp/{slug} and /jsonld) always returns public fields only. It never returns restricted fields, and it has no access-token parameter. Restricted PoLI-tier fields are visible only on the rendered DPP web page, and only to a browser session that has been granted access through the flow above. See DPP endpoints for the public JSON surface.
For developers
There is nothing to integrate here programmatically: no endpoint on this page takes an API key. If you are an authority seeking access, use the request form on the relevant DPP page. If you are building a system that authors DPPs, use the Integration API.