Availability

Every endpoint below is GA on production (app.traceable.digital) as of release v0.99.6.1 (promoted 2026-07-03). The full Phase 1.5 surface — authoring, discovery, schema versioning, ERP mappings, key management, signed webhooks, and GDPR data-subject endpoints — is live and behind per-key authentication (default-deny: an unknown or missing key returns 401, never a 404 that would confirm a resource exists).

The API is feature-flagged per environment; an environment where it is not enabled returns 503 FEATURE_DISABLED. Both a live key (pk_live_*) and a sandbox key (pk_test_*) call these same paths — see Authentication → Sandbox mode. The GDPR endpoints are live-mode only (a sandbox key gets 403 CROSS_MODE_DENIED).

Every endpoint links to its full request and response schema in the API reference, rendered from the canonical OpenAPI spec.

Discovery

Method	Path	Scope
GET	/api/v1/industries	category:read
GET	/api/v1/categories	category:read
GET	/api/v1/categories/{code}/schema	schema:read
GET	/api/v1/categories/{code}/diff	schema:read
GET	/api/v1/products/{id}/schema-compatibility	dpp:read
GET	/api/v1/suppliers	supplier:read

Authoring

Method	Path	Scope
GET	/api/v1/products	dpp:read
POST	/api/v1/products	dpp:draft:write
GET	/api/v1/products/{id}	dpp:read
PATCH	/api/v1/products/{id}	dpp:draft:write
PUT	/api/v1/products/{id}/form-data	dpp:draft:write
GET	/api/v1/products/{id}/traceability	dpp:read
POST	/api/v1/products/{id}/traceability	dpp:draft:write
GET	/api/v1/products/{id}/components	dpp:read
POST	/api/v1/products/{id}/components	dpp:draft:write
GET	/api/v1/companies/me/gs1-prefixes	dpp:read
POST	/api/v1/companies/me/gs1-prefixes	dpp:draft:write

Lifecycle

Method	Path	Scope
GET	/api/v1/products/{id}/gate	dpp:gate:read
GET	/api/v1/products/{id}/readiness	dpp:gate:read
POST	/api/v1/products/{id}/submit	dpp:submit
POST	/api/v1/products/{id}/withdraw	dpp:withdraw

Documents

Method	Path	Scope
POST	/api/v1/products/{id}/documents	document:write
GET	/api/v1/products/{id}/documents	dpp:read
GET	/api/v1/documents/{id}/download	dpp:read

ERP field mapping

Map your ERP's own column names to Traceable field_ids. An unmapped column is rejected, never silently dropped.

Method	Path	Scope
GET	/api/v1/erp-mappings	mapping:read
POST	/api/v1/erp-mappings	mapping:write
PATCH	/api/v1/erp-mappings/{id}	mapping:write
DELETE	/api/v1/erp-mappings/{id}	mapping:write
POST	/api/v1/mappings/lint	mapping:read
GET	/api/v1/categories/{code}/erp-template	mapping:read

Key management

Requires the privileged keys:admin scope (see Authentication → Privileged scopes). Keys carry per-key IP allow-lists (allowedCidrs).

Method	Path	Scope
POST	/api/v1/keys	keys:admin
GET	/api/v1/keys	keys:admin
GET	/api/v1/keys/{id}	keys:admin
PATCH	/api/v1/keys/{id}	keys:admin
DELETE	/api/v1/keys/{id}	keys:admin
POST	/api/v1/keys/{id}/rotate	keys:admin
POST	/api/v1/keys/{id}/signing-secret/rotate	keys:admin
POST	/api/v1/keys/bulk-revoke	keys:admin

Webhooks

HMAC-signed event delivery with retries and a dead-letter queue. A sandbox key's endpoints receive only sandbox events.

Method	Path	Scope
GET	/api/v1/webhook-endpoints	webhook:read
POST	/api/v1/webhook-endpoints	webhook:write
GET	/api/v1/webhook-endpoints/{id}	webhook:read
PATCH	/api/v1/webhook-endpoints/{id}	webhook:write
DELETE	/api/v1/webhook-endpoints/{id}	webhook:write
POST	/api/v1/webhook-endpoints/{id}/rotate-secret	webhook:write
GET	/api/v1/webhook-endpoints/{id}/deliveries	webhook:read
POST	/api/v1/webhook-deliveries/{id}/redeliver	webhook:write

GDPR data-subject endpoints

Requires the privileged gdpr:admin scope, and are live-mode only (a sandbox key gets 403 CROSS_MODE_DENIED). See GDPR and Data Processing.

Method	Path	Scope	Regulation
GET	/api/v1/gdpr/access	gdpr:admin	Art. 15 (access)
POST	/api/v1/gdpr/erase	gdpr:admin	Art. 17 (erasure; 202 + 30-day SLA)
GET	/api/v1/gdpr/portability	gdpr:admin	Art. 20 (portability)

Platform

Operational endpoints for discovery and monitoring. health and openapi.json are unauthenticated; meta needs a valid key but no specific scope. health is not gated by the products feature flag.

Method	Path	Auth
GET	/api/v1/health	None (public)
GET	/api/v1/openapi.json	None (public)
GET	/api/v1/meta	Any valid key (no scope)

Not over the API

Publication and approval are not endpoints. A submitted DPP is published by a human operator in the Traceable portal. See Regulatory boundary. There is no AI (ai.*) scope; AI-assisted flows are portal-only.