On this pageBase URL and transport

Base URL and transport

All endpoints are under https://dppapi-production.up.railway.app/v1, over HTTPS only. The public resolver lives at https://dppapi-production.up.railway.app/p/…, outside /v1, because it is the address printed in QR codes. Cross-origin requests are allowed on /v1 from any origin — keys travel in a header, never a cookie — but keys are secrets: call the API from your servers.

JSON in, JSON out

Request bodies are JSON with Content-Type: application/json, except document uploads (multipart/form-data).
Send Content-Type: application/json only when there is a body. A write without a body (publish, test webhook) that declares JSON is rejected with 400.
Responses are JSON (application/json; charset=utf-8), except QR images, documents, the export archive and JSON-LD (application/ld+json).
Property names are camelCase on resources; list envelopes, error fields and query parameters use snake_case (has_more, request_id, updated_since).

Identifiers

Kind	Example	Notes
Record id	`cm1q8y0bq0006l70fx9y8z7w6`	Opaque string. Store it as text; do not parse it.
Battery unique identifier	`C-7KQ2M9XHT4R`	`C-` + 11 characters, no ambiguous letters. Immutable, printed on the label, resolvable at `/p/{uniqueIdentifier}`.
Serial number	`C48-2027-0001`	Yours. Searchable, not unique across models.
Request id	`3f1c2a9e-8d4b-4c6f-9e2a-7b5d1c0e8f34`	Per request; see below.

Dates and times

Timestamps are ISO 8601 in UTC (2027-01-15T10:02:11.000Z). Date inputs accept a date (2027-01-15) or a full timestamp. Filters such as updated_since accept a date or a date-time with an offset.

Request IDs

Every response carries an X-Request-Id header, and every /v1 error body repeats it as request_id. Log it with every failure: quoting it is the fastest way for us to find exactly what happened. You may also send your own X-Request-Id (for example your trace id) and it is used for the request.

404 · a mistyped path

{"error": "route_not_found","message": "GET /v1/pasports is not part of the API. See /v1/openapi.json.","request_id": "3f1c2a9e-8d4b-4c6f-9e2a-7b5d1c0e8f34"}

Headers at a glance

Header	Direction	Purpose
`Authorization: Bearer dpp_…`	Request	Your API key. Required on `/v1` except `/openapi.json`.
`Content-Type: application/json`	Request	Only with a JSON body.
`Idempotency-Key`	Request	Makes a POST or PATCH safe to retry. Details.
`X-DPP-Dry-Run: true`	Request	Live key: validate without storing. Details.
`X-Request-Id`	Both	Correlates a request with our logs.
`X-DPP-Mode`	Response	`live` or `test`.
`X-DPP-Dry-Run: true`	Response	This answer is a dry run; nothing was stored.
`X-DPP-Api-Version`	Response	The API version that answered, e.g. `1.0.0`.
`Idempotent-Replayed: true`	Response	This is a stored response being replayed.
`x-ratelimit-limit` / `-remaining` / `-reset`	Response	Your rate-limit budget. Details.
`retry-after`	Response	On `429`: seconds to wait.

Success codes

Status	Meaning
`200 OK`	Read, update, or a dry run that would have succeeded.
`201 Created`	A record was created (model, battery, document, event, linked passport).
`207 Multi-Status`	A bulk request where at least one row failed; read `results`.

Every failure is described in Errors.

Requests and responses