Standards
EN 18222: Passport APIs and Lifecycle
Which API operations EN 18222 defines — create, read, update, search, version queries and registry submission — and how to evaluate a platform against them.
EN 18222:2026 defines passport lifecycle management and searchability APIs. When you ask what a platform must be able to do, the answer largely lives in this standard.
Operations
| Operation | What it does |
|---|---|
| Create | Creates a new passport record |
| Read | Returns the passport for a given identifier |
| Update | Updates fields by creating a new version |
| Search | Finds passports by criteria |
| Bulk retrieve | Fetches many at once (a batch, for example) |
| Version query | Returns the version as of a given date |
| Registry submit | Sends the identifier and hosting address to the EU registry |
See the EU DPP Registry guide and EN 18216 data exchange.
Why version queries matter
The most common question in an audit is: "what did you declare on the date this product was placed on the market?" Answering that requires a version query in the API.
A system that returns only "current state" is incomplete for audit purposes. See audit trails and versioning and EN 18221 archiving.
Platform evaluation questions
Concrete questions drawn from this standard:
- Can I retrieve the version as of a specific date through the API?
- Can I do bulk updates (renewing a certificate across 5,000 SKUs)?
- Is registry submission automatic or manual?
- Which fields can be searched?
- What is the API versioning policy, and is backward compatibility guaranteed?
Relationship to access tiers
API operations work together with the access tier policy: the same read call returns a different field set depending on the caller's role. FprEN 18239 defines that layer. See access rights and roles.
Frequently asked questions
Should I expose the API to consumers?
The public tier is already open to everyone, and machine access uses content negotiation — a separate consumer API is not needed. See what a resolver service is.
Are there limits on bulk operations?
The standard defines the operation; limits are an implementation choice. At high SKU counts, bulk retrieval and pagination design matter.
When should registry submission be triggered?
When the passport is published and the identifier first used — and again on update if the hosting address changed. See registering a DPP step by step.
