Supplier Evidence API

Supplier evidence can power DPP systems Redy does not host.

Redy is the supplier-authorized evidence exchange behind Digital Product Passport programs: suppliers maintain reusable evidence, authorize access, and manufacturers or external DPP platforms consume versioned packages through APIs, exports, and webhooks.

View API examplesSupplier workflow
Data exchange model
supplier grant -> evidence package -> API consumer
Supplier-first
Supplier authority
Grant-based

Evidence delivery starts from supplier authorization, not unilateral manufacturer access.

Consumer
Any DPP stack

Manufacturers and external DPP platforms can consume authorized evidence without replacing their host system.

Package state
Versioned

Evidence packages need version, provenance, expiry, freshness, and trust-state metadata.

Change path
Webhook-ready

Updates, revocations, expiry, and trust-state changes move through events and exports.

Exchange model

The supplier is not an afterthought in the integration layer.

Data exchange preserves the same role model as the portal: suppliers own evidence and grants; manufacturers and API consumers receive what has been authorized for a specific scope.

Supplier

Owns the reusable evidence package

Maintains certificates, declarations, documents, extracted values, freshness windows, access terms, and revocation state.

  • Package evidence once
  • Authorize access
  • Update or revoke grants
Manufacturer

Consumes supplier-authorized evidence

Requests or subscribes to the evidence needed for DPP fields, even when the final passport is hosted outside Redy.

  • Request missing fields
  • Subscribe to package updates
  • Map evidence into DPP systems
External DPP platform

Receives evidence without owning the supplier relationship

Uses API, export, or webhook surfaces to ingest authorized supplier evidence with provenance and access terms attached.

  • Pull package JSON
  • Receive webhook events
  • Import evidence attachments
Redy

Brokers authorization, provenance, and delivery

Keeps supplier grants, package versions, access logs, revocation semantics, and buyer entitlements in the same control model.

  • Enforce grants
  • Record access
  • Deliver versioned packages
Evidence package

A useful package carries more than values.

External systems need the value, but they also need to know who authorized it, what it supports, how fresh it is, what version they consumed, and whether access has changed.

Package identity

Package idSupplier orgProduct or component scopeEvidence category

Evidence payload

Structured valuesSource documentsCertificate referencesAttachment metadata

Provenance

Source recordSupplier attestationReview stateVersion history

Access terms

Grant idAuthorized consumerScopeExpiry and revocation state

Freshness

Valid fromExpires atStaleness statusUpdate timestamp

Delivery

API responseWebhook eventExport adapterAudit log entry
API examples

Make the contract shape buyers ask about concrete.

These examples make the integration posture concrete: request evidence, package supplier records, consume authorized packages, and export to another DPP host.

Create supplier evidence request

Manufacturer asks for scoped evidence

POST /api/v1/supplier-evidence/requests
Authorization: Bearer redy_api_key

{
  "supplierOrgId": "sup_7f4",
  "productRef": "JACKET-TS-2408",
  "requiredFields": [
    "materialComposition",
    "chemicalSafetyDeclaration",
    "carbonFootprintEvidence"
  ],
  "requestedUse": "textile_dpp_readiness"
}
Publish supplier package

Supplier packages reusable evidence

POST /api/v1/supplier-evidence/packages
Authorization: Bearer supplier_platform_key

{
  "category": "chemical_safety",
  "scope": {
    "material": "recycled polyester shell",
    "products": ["JACKET-TS-2408"]
  },
  "documents": ["doc_certificate_91", "doc_declaration_12"],
  "attestation": "supplier_confirmed"
}
Consume authorized package

External DPP system pulls evidence

GET /api/v1/supplier-evidence/packages/pkg_42
Authorization: Bearer buyer_api_key

{
  "packageId": "pkg_42",
  "version": "2026.06.12",
  "grantId": "grant_18",
  "supplier": "Northline Apparel",
  "trustState": "supplier_attested",
  "expiresAt": "2027-06-12T00:00:00Z"
}
Export evidence for DPP host

Approved evidence moves to another platform

POST /api/v1/supplier-evidence/exports
Authorization: Bearer buyer_api_key

{
  "packageIds": ["pkg_42", "pkg_43"],
  "format": "json",
  "target": "external_dpp_platform",
  "includeDocuments": true,
  "includeAuditRefs": true
}
Webhook events

Supplier changes reach connected DPP systems.

Evidence is not static. Packages expire, suppliers update documents, grants are revoked, and trust state changes. Webhooks keep consumers aligned without polling spreadsheets.

supplier_evidence.package.updated

A supplier publishes a new package version or changes structured values.

supplier_evidence.grant.revoked

A supplier revokes access for a buyer, DPP platform, or integration client.

supplier_evidence.package.expiring

A certificate, declaration, or package validity window is approaching expiry.

supplier_evidence.trust_state.changed

A package moves between draft, supplier-attested, reviewed, stale, or revoked states.

Product boundaries

The exchange story only works if supplier control is explicit.

This path makes buyers curious about the API while making suppliers confident Redy is not turning their evidence into an uncontrolled data marketplace.

Supplier authorization is the product boundary.

Redy brokers supplier-authorized evidence. Supplier data access is never positioned as something buyers can obtain without supplier grants.

Evidence packages are not raw inbox dumps.

Every package carries scope, source context, version, freshness, trust state, and access terms so consumers know what they received.

External DPP systems can consume without becoming Redy-hosted DPPs.

The integration value is strongest when Redy can power supplier evidence for PLM, PIM, ERP, LCA tools, and DPP hosts the buyer already uses.

Audit logs prove access and revocation.

A credible exchange records who accessed which package, under which grant, when, and what changed after delivery.

Use Redy as the supplier evidence layer behind your DPP stack.

The full Redy platform can host the workflow end to end. The Supplier Evidence API path explains how authorized supplier records can also power external systems.

View architectureSee proof chain