Digital Product Passport service implementing EN 18222:2026 and EN 18223:2026 — REST API on Rails
5.6K
An API-only service implementing the Digital Product Passport endpoints of the CEN/CENELEC JTC 24 standards: the REST contract from EN 18222:2026 (APIs for product passport lifecycle management), payloads from EN 18223:2026 (semantic model), identifier schemes from EN 18219:2026.
Passports are stored in its own PostgreSQL database and served from it. Reading a passport is public and needs no token; writing needs one.
The compose file brings its own PostgreSQL, runs the migrations once and starts the service.
curl -fsSLO https://raw.githubusercontent.com/OwnYourData/dpp-service-public/main/docker-compose.yml
curl -fsSLO https://raw.githubusercontent.com/OwnYourData/dpp-service-public/main/.env.example
cp .env.example .env
Fill in the three values .env asks for — two generated secrets and a database password; the file says how to generate them — then:
docker compose up -d
The API is on http://localhost:3000, the Swagger UI at http://localhost:3000/api-docs. The full guide is docs/Standalone.md.
CreateDPP, ReadDPPById, UpdateDPPById (RFC 7396), DeleteDPPById, ReadDPPByProductId, ReadDPPVersionByIdAndDate, ReadDPPIdsByProductIds, RegisterProductDPP, ReadDataElement, UpdateDataElement — plus, beyond the standard's method set, a change of custodian and the mandate under which a custodian is written to. The machine-readable contract is docs/openapi.yaml, which the service also serves at /api-docs.
| Variable | Meaning |
|---|---|
SECRET_KEY_BASE | mandatory in production |
KEY_VAULT_KEK | encrypts the DID keys of passports the service mints itself — set it before the first one, or those passports become irrevocable when SECRET_KEY_BASE is rotated |
DPP_DB_HOST · DPP_DB_NAME · DPP_DB_USER · DPP_DB_PASSWORD | PostgreSQL |
DPP_SERVICE_ENDPOINT_BASE | the public address of this instance; written into the DID document of every passport it mints, and unchangeable afterwards |
DPP_AUTH_MODE | permissive for a first look; did verifies the caller's self-issued EdDSA token against their DID document and lets only the creator change a passport |
OYDID_LOCATION | registry for did:oyd |
The full table is in docs/Standalone.md.
The uniqueProductIdentifier you send is what is registered and what goes on the data carrier — the service issues no second token. The registry limits it to 50 characters over https, and the service refuses a longer one at creation, saying how many characters are over. Its host should belong to the economic operator rather than to whoever stores the passport; that is what lets a passport move without a reprint.
| Port | 3000 |
| Needs | PostgreSQL 14 or newer |
| Architectures | linux/amd64, linux/arm64 |
latest — the current build260906 — a fixed build to pin tocurl calls: DPP-Service-Demo.mdA public instance runs at https://dpp-service.ownyourdata.eu; it keeps passports at a hosting pod of the data intermediary DID FlexCo rather than in its own database. That mode needs a provisioned collection and is not what this image does by default.
Built by OwnYourData. Apache License 2.0.
Content type
Image
Digest
sha256:c2b360fd5…
Size
119.3 MB
Last updated
13 days ago
docker pull oydeu/dpp-servicePulls:
67
Last week