---
title: Get compliance profile
description: "Read the company's DPP compliance profile — role, product categories, EU markets, size band, and data systems. Company facts only, no personal data."
canonical: "https://www.tracepass.eu/docs/get-compliance-profile"
locale: en
source: "https://www.tracepass.eu/docs/get-compliance-profile"
---

# Get compliance profile

> Read the company's DPP compliance profile — role, product categories, EU markets, size band, and data systems. Company facts only, no personal data.

```http
GET /api/v1/company/compliance-profile
```

Returns the company's stored compliance profile and its `updatedAt` timestamp. The profile holds company facts that the DPP Assistant tools use as defaults — `role`, `ownBrand`, `categories`, `markets`, `products`, `sizeBand`, `salesChannels`, and `dataSystems`. When the profile has not been set, the response is `{ "complianceProfile": {} }`. The profile holds company facts only: it never stores personal data about individual users.

Counts no scope answer (read-only, no regulatory data served). Auth: an API key or OAuth with `regulatory:read` or `passports:read`. Add `X-Source: assistant` when calling on behalf of the DPP Assistant MCP server — the OAuth account gate then applies (verified, non-disposable email required).

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `Authorization` | header | string | yes | `Bearer <token>` — either a `tp_` API key (Developer → API Keys; simplest, for server-to-server) or an OAuth 2.0 access token (Developer → OAuth Apps; for user-authorized apps, scoped + revocable). The Authentication page has the full OAuth flow and scope list. |

## Examples

```bash
curl -sS https://app.tracepass.eu/api/v1/company/compliance-profile \
  -H "Authorization: Bearer tp_REDACTED_xxxxxxxxxxxx"
```

```typescript
const res = await fetch("https://app.tracepass.eu/api/v1/company/compliance-profile", {
  headers: { Authorization: `Bearer ${process.env.TRACEPASS_API_KEY}` },
});
const { complianceProfile, updatedAt } = await res.json();
// complianceProfile.role, .categories, .markets, …
```

```python
import os, requests
resp = requests.get(
    "https://app.tracepass.eu/api/v1/company/compliance-profile",
    headers={"Authorization": f"Bearer {os.environ['TRACEPASS_API_KEY']}"},
)
data = resp.json()
```

## Responses

### 200 — Compliance profile

```json
{
  "complianceProfile": {
    "role": "manufacturer",
    "ownBrand": true,
    "categories": ["battery"],
    "markets": ["EU"],
    "sizeBand": "sme",
    "salesChannels": ["own_shop", "b2b"],
    "dataSystems": "SAP ERP"
  },
  "updatedAt": "2026-10-11T19:01:12.152Z"
}
```

### 200 — Empty profile (not yet set)

```json
{ "complianceProfile": {} }
```

### 401 — Unauthorized

```json
{ "error": "Invalid or revoked API key" }
```

### 403 — Account not eligible

```json
{ "error": "account_not_eligible", "reason": "email_not_verified" }
```

## Related

- [PATCH Update compliance profile](https://www.tracepass.eu/docs/patch-compliance-profile.md)
- [DELETE Delete compliance profile](https://www.tracepass.eu/docs/delete-compliance-profile.md)