Skip to main content

PoLI access flow

This page walks through the PoLI (Person of Legal Interest) access flow end to end. See PoLI access for the reference.

No code to write

PoLI access is a human, web-based workflow, not a programmatic API. There is no bearer key, no POST endpoint, and no JSON response to integrate against. This page describes what happens, not how to script it — there is nothing to script. To author DPPs programmatically, use the Integration API.

The flow​

1. Request   — fill the access form on the public DPP page (email, name, organisation, role)
2. Verify    — click the link in your email → GET /api/poli/verify?token=...
3. Review    — the manufacturer approves or rejects the request
4. Access    — open the link in your approval email → GET /api/poli/access?token=...
               → your browser is granted access and the DPP shows restricted fields

Step 1 — Request access​

Open the DPP page for the product whose restricted fields you need, and use its request access form. You provide:

  • your email (where the verification and approval links are sent),
  • your name,
  • your organisation (the authority or body you represent),
  • your role (this determines the access tier you receive if approved).

Submitting the form creates a pending request and emails you a verification link. There is no API call and no key.

Step 2 — Verify your email​

Click the verification link in the email:

https://app.traceable.digital/api/poli/verify?token=<verification_token>

This confirms your email and puts the request in front of the manufacturer. The link is single-purpose and opens in a browser; it redirects rather than returning data.

Step 3 — Wait for the manufacturer's decision​

The manufacturer (and Traceable administrators) review verified requests and approve or reject them. There is no guaranteed turnaround, and you cannot poll for status — you will receive an email when a decision is made. If your request is rejected, the reason (where provided) is sent to your email.

Step 4 — Access the restricted fields​

On approval you receive an access link:

https://app.traceable.digital/api/poli/access?token=<access_token>

Open it in your browser. Traceable validates the token, grants your session access, and redirects you to the product's DPP page, which now shows the restricted PoLI-tier fields your access level permits. Access is time-limited; when it lapses, submit the request form again.

Why there is no programmatic path​

Restricted fields are deliberately not available through the public JSON API. GET /api/dpp/{slug} and /jsonld always return public fields only and have no access-token parameter. Restricted data is shown only on the rendered DPP web page to a browser session that has completed the flow above. This keeps a human (email verification plus manufacturer approval) in every grant of restricted access, as the regulation intends.