---
title: Create a passport
description: "Create one passport bound to a product. GTIN + serial uniqueness enforced. 402 overage_required when over cap; confirmOverage:true to accept the charge."
canonical: "https://www.tracepass.eu/docs/create-passport"
locale: en
source: "https://www.tracepass.eu/docs/create-passport"
---

# Create a passport

> Create one passport bound to a product. GTIN + serial uniqueness enforced. 402 overage_required when over cap; confirmOverage:true to accept the charge.

```http
POST /api/v1/passports
```

Create a single Digital Product Passport. The passport is bound to a product (productId) and identified by a GS1 GTIN + serial number that's unique within that GTIN. New passports start in `draft` status — fields are populated via subsequent PATCH calls and the passport is published from the dashboard once review is complete.

GTIN must be 14 digits with a valid GS1 check digit and not yet registered to another tenant. Counts as one v1 write AND consumes one DPP slot from your plan's `maxDpps` quota — when that quota is exhausted and your plan supports overage, the call returns 402 with an `overage_required` body; retry with `confirmOverage: true` to accept the per-passport charge.

Honours the optional `Idempotency-Key` header — the platform replays the original 201 response for 24 hours on the same key, so a network retry is safe.

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `Authorization` | header | string | yes | `Bearer <token>` — either a `tp_` API key (Developer → API Keys; simplest, for server-to-server) or an OAuth 2.0 access token (Developer → OAuth Apps; for user-authorized apps, scoped + revocable). The Authentication page has the full OAuth flow and scope list. |
| `Idempotency-Key` | header | string | no | UUID v4 (or any opaque string ≤ 255 chars) per logical operation. The first response is replayed for 24 hours. |
| `productId` | body | ObjectId | yes | ID of the product the passport belongs to. Must belong to the API key's company. |
| `gs1.gtin` | body | string (14 digits) | yes | GTIN-14 with a valid GS1 check digit. Must not already be registered by another tenant. |
| `gs1.serialNumber` | body | string (1-100 chars) | yes | Serial unique within the GTIN. The most common pattern is the product model + a sequence (BP-48V-100-000001). |
| `parties` | body | Record<role, Party> | no | Optional structural parties block. A map keyed by role — `manufacturer`, `importer`, `authorisedRepresentative`, `distributor`, `recycler`, `producerResponsibilityOrg`. Each value is a Party. See the Upsert party endpoint for the per-Party body shape. Roles can also be added or replaced after creation via PATCH /api/v1/passports/{id}/parties/{role}. |
| `confirmOverage` | body | boolean | no | Accept the per-passport overage charge when the plan's `maxDpps` quota is already exhausted. Required only after a 402 response on a previous attempt. |

## Examples

```bash
curl -sS https://app.tracepass.eu/api/v1/passports \
  -H "Authorization: Bearer tp_REDACTED_xxxxxxxxxxxx" \
  -H "Idempotency-Key: 7b4f1e2c-9a3d-4e5b-8c1a-2d3e4f5a6b7c" \
  -H "Content-Type: application/json" \
  -d '{
    "productId": "6650a1b2c3d4e5f6a7b8c9d0",
    "gs1": {
      "gtin": "04012345000016",
      "serialNumber": "BP-48V-100-000001"
    }
  }'
```

```typescript
import { randomUUID } from "node:crypto";

const res = await fetch("https://app.tracepass.eu/api/v1/passports", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.TRACEPASS_API_KEY}`,
    "Idempotency-Key": randomUUID(),
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    productId: "6650a1b2c3d4e5f6a7b8c9d0",
    gs1: {
      gtin: "04012345000016",
      serialNumber: "BP-48V-100-000001",
    },
  }),
});

if (!res.ok) throw new Error(`Create failed: ${res.status}`);
const passport = await res.json();
console.log(passport.gs1.digitalLinkUri);
```

```python
import os, uuid, requests

res = requests.post(
    "https://app.tracepass.eu/api/v1/passports",
    headers={
        "Authorization": f"Bearer {os.environ['TRACEPASS_API_KEY']}",
        "Idempotency-Key": str(uuid.uuid4()),
        "Content-Type": "application/json",
    },
    json={
        "productId": "6650a1b2c3d4e5f6a7b8c9d0",
        "gs1": {
            "gtin": "04012345000016",
            "serialNumber": "BP-48V-100-000001",
        },
    },
)
res.raise_for_status()
passport = res.json()
print(passport["gs1"]["digitalLinkUri"])
```

## Responses

### 201 — Created

```json
{
  "_id": "6650b2c3d4e5f6a7b8c9d0e1",
  "companyId": "6650a0b1c2d3e4f5a6b7c8d9",
  "productId": "6650a1b2c3d4e5f6a7b8c9d0",
  "templateId": "6650a1b2c3d4e5f6a7b8c9d1",
  "gs1": {
    "gtin": "04012345000016",
    "serialNumber": "BP-48V-100-000001",
    "digitalLinkUri": "https://id.tracepass.eu/p/01/04012345000016/21/BP-48V-100-000001"
  },
  "status": "draft",
  "completionPercentage": 32,
  "fieldCounts": {
    "total": 52,
    "empty": 35,
    "approved": 17,
    "pendingReview": 0,
    "flagged": 0
  },
  "fields": { "...": "...seeded from product defaults + template defaults + company prefill..." },
  "createdAt": "2026-05-09T10:00:00.000Z"
}
```

### 400 — Validation error

```json
{
  "error": "Validation error",
  "details": {
    "fieldErrors": {
      "gs1.gtin": ["GTIN must be 14 digits"]
    }
  }
}
```

### 402 — Overage required

```json
{
  "error": "overage_required",
  "planLimit": 100,
  "currentUsage": 100,
  "extraPriceCents": 75,
  "message": "DPP quota reached. Retry with { confirmOverage: true } to accept the per-passport charge."
}
```

### 409 — Conflict

```json
// GTIN owned by another tenant
{ "error": "This GTIN is already registered by another company. Contact support if this is an error." }

// Or: serial collision within the GTIN
{ "error": "Serial number already exists for this GTIN" }
```

### 429 — Rate limit

```json
{
  "error": "API rate limit: 200 writes/day via /api/v1. Currently 200 today; requested 1. Retry tomorrow (UTC) or upgrade your plan."
}
```

## Related

- [Update one field on a passport](https://www.tracepass.eu/docs/update-field.md)
- [Attach an economic-operator party](https://www.tracepass.eu/docs/upsert-party.md)