Ask a supplier for the data points only they know. A request is a password-less, expiring link: the supplier opens /u/{token} on the public passport host, enters the fields you asked for or uploads documents, and you receive supplier.submitted. Nothing reaches your model until you accept it. See the supplier data guide.
Supplier requests (supplier_requests) are included in the Growth and Connected plans; on Free and Starter these calls answer 402 plan_upgrade_required.
Personalise the samples. Paste a test key and every snippet uses it — and your own model and passport ids.
/v1/upload-linksList supplier requests
Every request, newest first, with a derived status — sent, opened, responded, accepted, expired or cancelled — the values the supplier proposed (submittedValues), pendingFiles awaiting review and lastActivity.
Responses
- 200OK — The requests, as an array.
Errors1
- 401
unauthorizedThe key is missing, unknown or revoked.
curl "https://dppapi-production.up.railway.app/v1/upload-links" \-H "Authorization: Bearer $DPP_API_KEY"/v1/upload-linksAsk a supplier for data
Creates the request and its link. The response carries the link’s token; send the supplier /u/{token} on the public passport host. A link always expires (expiresInDays, at most 365) because the token is a credential travelling in a URL.
Request body7
modelIdstringoptionalThe model the answers belong to. Needed to accept values later.
requestedFieldsstring[], ≤ 200optionalAPI field names to ask for. The supplier can answer only these.
supplierNamestring, ≤ 200optionalWho is being asked.
supplierEmailemailoptionalTheir address.
messagestring, ≤ 2000optionalShown to the supplier.
expiresInDaysinteger, 1–365optionalLifetime of the link.
labelstring, ≤ 200optionalYour own label.
Headers2
Idempotency-KeystringheaderoptionalOptional. A unique string per logical operation (a UUID is ideal). The first response is stored for 24 hours and replayed for retries; see Idempotency.
X-DPP-Dry-Run"true"headeroptionalOptional, live keys. Validate the write in full and store nothing. Test keys always dry-run; see Test keys.
Responses
- 201Created — The request, including its
tokenandexpiresAt.
Errors4
- 400
Validation faileddetailsnames each invalid field. - 401
unauthorizedThe key is missing, unknown or revoked. - 402
plan_upgrade_requiredSupplier requests are not in your plan. - 403
insufficient_scopeThe key has nowritescope.
curl -X POST "https://dppapi-production.up.railway.app/v1/upload-links" \-H "Authorization: Bearer $DPP_API_KEY" \-H "Content-Type: application/json" \-H "Idempotency-Key: 7b3e0c52-1f7d-4b8a-9a52-2f0e6d1c9a44" \-d '{"supplierName": "Cell Supplier Co.","supplierEmail": "qa@cellsupplier.example","modelId": "cm1q8x2k40003l70f9a8s7d6e","requestedFields": ["criticalRawMaterials","detailedComposition"],"expiresInDays": 30,"message": "Please confirm the cathode composition for the 2027 passport."}'token and expiresAt./v1/upload-links/{id}/filesFiles a supplier uploaded
The files uploaded through the request, newest first, with their review status.
Parameters1
idstringpathrequiredThe supplier request id.
Responses
- 200OK — The files, as an array.
Errors2
- 401
unauthorizedThe key is missing, unknown or revoked. - 404
Not foundNo supplier request with this id in your organisation.
curl "https://dppapi-production.up.railway.app/v1/upload-links/cm1qg5h6j0070l70fr7t8y9u0/files" \-H "Authorization: Bearer $DPP_API_KEY"/v1/upload-links/{id}/acceptAccept values into the model
Copies the proposed values you name into the request’s model, field by field, and records the supplier as the source of each — so the passport can still say where a number came from years later. Values you do not accept stay proposed; once nothing is left, the request is finished.
Parameters1
idstringpathrequiredThe supplier request id.
Request body1
fieldsstring[], 1–200requiredField names to accept from
submittedValues.
Headers2
Idempotency-KeystringheaderoptionalOptional. A unique string per logical operation (a UUID is ideal). The first response is stored for 24 hours and replayed for retries; see Idempotency.
X-DPP-Dry-Run"true"headeroptionalOptional, live keys. Validate the write in full and store nothing. Test keys always dry-run; see Test keys.
Responses
- 200OK — How many were accepted, and how many proposals remain.
Errors6
- 400
Validation faileddetailsnames each invalid field. - 401
unauthorizedThe key is missing, unknown or revoked. - 403
insufficient_scopeThe key has nowritescope. - 404
Not foundNo supplier request with this id in your organisation. - 409
no_modelThe request is not attached to a model. - 422
nothing_to_acceptNone of those fields were proposed.
curl -X POST "https://dppapi-production.up.railway.app/v1/upload-links/cm1qg5h6j0070l70fr7t8y9u0/accept" \-H "Authorization: Bearer $DPP_API_KEY" \-H "Content-Type: application/json" \-d '{"fields": ["criticalRawMaterials","detailedComposition"]}'{"accepted": 2,"remaining": 0}