Add a traceability record (closes the traceability gate)

POST 
/api/v1/products/:id/traceability

Required scope: dpp:draft:write. A WRITE (HMAC + Idempotency-Key). Adds one supply-chain material; a single record closes the traceability_required_for_category publish gate for categories that require traceability. supplierId MUST be owned-or-linked to your company (discover via GET /suppliers) — a non-accessible supplier returns 404 SUPPLIER_NOT_ACCESSIBLE (never 403). All guards (product editability, cross-tenant linked DPP, circular parent) are enforced identically to the operator UI.

Request

Responses

201

Created

400

400 — INVALID_JSON, VALIDATION_ERROR, or IDEMPOTENCY_KEY_REQUIRED.

401

401 — INVALID_SIGNATURE or SIGNING_NOT_CONFIGURED (or bearer auth failure).

403

403 — missing scope (FORBIDDEN_SCOPE) or module (FORBIDDEN_MODULE).

404

Product not found, or supplierId/linked DPP not accessible (no existence oracle).

409

Product is frozen (PRODUCT_FROZEN) — published DPPs are immutable.

422

Circular parent reference (CIRCULAR_REFERENCE).

429

429 — RATE_LIMITED (per-key limit, reads and writes alike; fails closed, so a limiter outage also returns 429). A limiter-down 429 is deliberately indistinguishable from a quota 429. Carries Retry-After (seconds).

Response Headers

Retry-After

Seconds to wait before retrying (429 only).

RateLimit-Limit

Per-minute request ceiling for this key's tier.

RateLimit-Remaining

Requests left in the current window (floored at 0).

RateLimit-Reset

Seconds until the window resets.

503

503 — the API is not enabled on this environment (FEATURE_DISABLED).