Our commitment to open source
OpenDPP is open-core. The client surface — the helpers, schemas and SDKs you integrate with — is open under Apache-2.0, so you can build on it, audit it, and avoid lock-in. The hosted node that signs, seals and resolves your passports is the product we run for you.
Pick your language
Official SDKs and client libraries, scoped to your stack. The SDKs are generated from the public OpenAPI contract and version-locked to it — the SDK version is the API contract version.
TypeScriptnpm
Fully-typed ESM client, zero runtime dependencies. Node 20 and later.
npm install @opendpp/sdk
Client libraries on npm
@opendpp/gs1
GS1 Digital Link URI builders and GS1 mod-10 check-digit helpers — the identifier maths behind every scannable passport.
@opendpp/csv
A pure CSV-to-passport reference mapper: turn a spreadsheet row into a structured passport payload, with errors reported by line.
@opendpp/webhooks
OpenDPP webhook event types plus a constant-time HMAC-SHA256 signature verifier, so you can trust the payloads you receive.
@opendpp/eori
EORI customs-identifier validation against the European Commission's authoritative EOS service, plus pure offline EORI syntax and parsing helpers.
@opendpp/aeo
Authorised Economic Operator (trusted-trader) status lookup against the European Commission's authoritative EOS service — a supply-chain due-diligence signal.
@opendpp/vies
EU VAT-number existence validation against the European Commission's authoritative VIES service, plus pure offline VAT-ID syntax and parsing helpers.
@opendpp/testdata
Deterministic synthetic sample passports for every ESPR category, plus supply-chain event chains and import-ready CSV — test an integration without hand-crafting payloads.
JavaMaven Central
Typed client built on the JDK HTTP client. Java 17 and later; GPG-signed artifacts.
implementation("eu.opendpp-node:opendpp-sdk:1.11.0")
Java client libraries are on the roadmap. The SDK ships today and covers the full public API — everything the npm helpers wrap is a typed call away.
Kotlinvia Java
The Java artifact is idiomatic from Kotlin — same coordinates, no separate package.
implementation("eu.opendpp-node:opendpp-sdk:1.11.0")
Your language
More official SDKs are on the roadmap. The OpenAPI contract is public — generate a client for any stack today.
curl https://opendpp-node.eu/openapi.json
What we open, and why
A simple rule: if it helps you integrate with OpenDPP it is open; if it protects your keys or runs the node it stays with the hosted service.
Open — the client surface
Every helper you call to format identifiers, map your data, verify a webhook or talk to the API is published under Apache-2.0. Read it, fork it, vendor it — no account required.
- Identifier, CSV and webhook helpers
- The typed API SDKs, generated from the public OpenAPI contract
- AAS and UNTP / W3C-VC interop schemas, samples and validators
- The AI knowledge bundle (OKF) and /llms.txt
Closed — the hosted node
Key custody, sealing, DID and revocation issuance, and resolution run on the managed node. That boundary is what keeps every tenant's private keys inside the vault.
- Per-tenant key vault and passport sealing
- did:web and revocation status-list issuance
- The resolver, persistence and retention layer
- The multi-tenant control plane
The closed line is deliberate and load-bearing: your signing keys never leave the vault, and the node never hands out a credential emitter that could sign on your behalf off-platform.
Also open — the interoperability & knowledge repositories
opendpp-interop
The interop boundary kit: official AAS (IDTA) and UNTP / W3C-VC schemas, live-reproducible samples, an offline conformance validator, and OpenDPP-authored non-normative SHACL shapes.
opendpp-knowledge
The OpenDPP knowledge bundle in Open Knowledge Format (OKF) — machine-readable Markdown that lets AI agents learn the API. Also served live at /okf and advertised via /llms.txt.
Apache-2.0, and a word on the name
The open packages and repositories are licensed under Apache-2.0 — use them in commercial and open projects alike. The OpenDPP hosted service and its server components remain proprietary.
OpenDPP™ is a trademark of Opendpp UAB. You are welcome to build integrations that work with OpenDPP and to say so; "OpenDPP-conformant" describes software that interoperates with the OpenDPP node — it is not a certification or endorsement we grant.
Build with OpenDPP
Start from the open packages and the public API contract — no account required to read the code.
Explore the OpenDPP org on GitHub