Developer API v1

Programmatic access to product passports — for webshop/ERP sync and bulk automation.

From the Pro plan

Authentication

Every request authenticates with an API key, in the Authorization header:

Authorization: Bearer vk_<your key>

You create a key under Settings → Developer API. The plaintext key is shown only once, at creation — store it safely. The key grants read/write access to all products in your account, so keep it confidential.

Quick test in the browser

For GET requests you can try it directly in the browser, without a header — pass the key as the ?api_key= parameter:

https://veridyn.eu/api/v1/categories?api_key=vk_<your key>

⚠️ For testing only. A key placed in the URL ends up in browser history and server logs, so in production always use the Authorization: Bearer header. POST/PATCH can only be called with a header (curl/Postman).

Base URL

https://veridyn.eu/api/v1

Responses are application/json, UTF-8 encoded.

Endpoints

What to send? (required vs. optional)

Every category has a required core — without it, schema validation rejects the request (422). All other fields are optional, but you can send them in the same data object anytime (more data = a better passport and more future-proof compliance). The exact, machine-readable field list is returned by /schema/{category} — with required: true/false, type, enum and localized markers.

curl https://veridyn.eu/api/v1/schema/textile \
  -H "Authorization: Bearer vk_<key>"

All fields by category

✓ = required · — = optional · ↳ nested sub-field · 🌐 per-language (localized) · 🔒 visible only at authority level. This list is generated from the schema — always up to date.

Languages

The languages field (e.g. ["hu","en"]) declares which languages have free-text content. The localized fields (care, end-of-life… — "localized": true in /schema) must be filled only in the first (primary) language; the rest are optional, falling back to an available language if missing. The passport's UI labels are translated to 24 languages automatically, independently of this.

Examples

Create a product

curl -X POST https://veridyn.eu/api/v1/products \
  -H "Authorization: Bearer vk_<key>" \
  -H "Content-Type: application/json" \
  -d '{
    "category": "textile",
    "data": {
      "productName": "Bio pamut póló",
      "sku": "TEE-001",
      "brandName": "Lumora",
      "languages": ["hu","en"],
      "fiberComposition": [{"fiber":"pamut","percentage":100}],
      "countryOfManufacture": "PT",
      "careInstructions": {"hu":"Mosás 30 °C","en":"Wash at 30 °C"},
      "repair": {"repairable": true, "sparePartsAvailable": false},
      "endOfLife": {
        "recyclingInstructions": {"hu":"Textilgyűjtő","en":"Textile bin"},
        "disposalInstructions": {"hu":"Ne a kukába","en":"Not household waste"}
      },
      "economicOperator": {
        "role":"manufacturer","legalName":"Lumora Kft.","address":"Budapest",
        "country":"HU","contactEmail":"hello@lumora.hu"
      }
    }
  }'

Response (201):

{
  "data": {
    "id": "a1993ef7-7562-43bb-92ff-eb63f02dcde9",
    "category": "textile",
    "status": "active",
    "version_no": 1,
    "passport_url": "https://veridyn.eu/<account>/p/a1993ef7-…",
    "qr_url": "https://veridyn.eu/api/v1/products/a1993ef7-…/qr",
    "data": { "productName": "Bio pamut póló", … }
  }
}

List

curl https://veridyn.eu/api/v1/products?limit=25 \
  -H "Authorization: Bearer vk_<key>"

Get a product

curl https://veridyn.eu/api/v1/products/{id} \
  -H "Authorization: Bearer vk_<key>"

Update (new version)

curl -X PATCH https://veridyn.eu/api/v1/products/{id} \
  -H "Authorization: Bearer vk_<key>" \
  -H "Content-Type: application/json" \
  -d '{"data": {"recycledContentPercentage": 30}}'

The provided fields are merged onto the existing data (partial update), then validated, and a new, retained version is created — the full change history is preserved.

Response & errors

Success: the payload is under the data key. On error:

{ "error": "Invalid data.", "code": "validation", "errors": [ … ] }

Webhooks

Under Settings → Webhooks you register an HTTPS URL. When a product passport is created / updated / archived, Veridyn POSTs a signed JSON to that URL — so your system is notified in real time, without polling.

Events

product.created · product.updated · product.archived · product.restored

Delivery

POST https://your-system.example/veridyn-webhook
Content-Type: application/json
X-Veridyn-Event: product.updated
X-Veridyn-Signature: sha256=<hmac>

{
  "event": "product.updated",
  "data": { "id": "a1993ef7-…", "category": "textile", "version_no": 2 },
  "sent_at": "2026-07-02T13:19:11+00:00"
}

Signature verification

The X-Veridyn-Signature is the HMAC-SHA256 of the raw body with the webhook secret (shown in Settings). Verify it — e.g. in PHP:

$body = file_get_contents('php://input');
$expected = 'sha256=' . hash_hmac('sha256', $body, $secret);
if (!hash_equals($expected, $_SERVER['HTTP_X_VERIDYN_SIGNATURE'] ?? '')) {
    http_response_code(401); exit; // invalid signature}

Respond with a 2xx status. Delivery is best-effort (short timeout); the status of the last delivery is shown in Settings.

← Settings / API keys