DPP Registry: EU publishes new guides for APIs, data and authentication

Official technical documentation published on 30 October 2026. This updates integration guidance and must be distinguished from the adoption of new legal obligations.

What has been published

The European Commission has added six DPP Registry resources: API integration instructions, OpenAPI specifications, a semantic data guide and supporting artifacts, service-account integration guidance and authentication guidance for passports hosted by operators. The three integration manuals reviewed are marked version 1.0, dated 30 October 2026.

Registration: an accepted request is not a completed registration

The API guide distinguishes submission from registration completion: an HTTP 202 response starts asynchronous processing. Integrations must track the task and inspect its final outcome; a completed task can still have a negative result. For requests containing several DPPs, one non-compliant item prevents registration of the entire submission. Validation, errors and request retries therefore require careful handling.

Service accounts and key protection

The dedicated manual describes system-to-system access through accounts linked to a verified operator. Authentication uses OAuth 2.0 and private_key_jwt: the system signs an assertion with its private key to obtain a temporary token. The public key is supplied to the Registry; the private key must remain protected within the operator's infrastructure.

Public data, protected data and authorisation

The guide for passport hosting distinguishes public and protected representations. For protected access, it describes local token validation and authorisation of the requestor for the specific DPP. Checking the token's intended audience alone does not separate different operators served by the same system.

Practical impact for businesses and DPP providers

Our operational recommendation is to compare planned integrations with the newly published documents, including tests for negative outcomes and separation of customer data. Relevant teams include manufacturers, importers, DPP service providers and passport hosts. Availability of these guides neither certifies software nor automatically extends DPP duties to every product: obligations and deadlines must still be checked against the legal acts applicable to each sector.

Verified against official sources on 30 October 2026. Operational recommendations are editorial analysis and must be distinguished from the legal status of the source.