Skip to main content
    Norruva
    Pricing
    DashboardGet Started
    Norruva Developer Platform

    Build trusted product intelligence with Norruva APIs.

    Ship Digital Product Passports, compliance intelligence, and lifecycle events directly into your ERP, PLM, or commerce stack. Norruva gives you the data layer plus audit-ready trails.

    Explore API ReferenceView the Node.js SDK

    Quickstart

    CLI
    Spin up a tenant, issue keys, and push your first passport in minutes.
    Step 1
    Create your workspace

    Sign up to provision a tenant. There is no CLI for this — it happens in the browser.

    https://app.norruva.com/auth/signup
    Step 2
    Generate API credentials

    Issue scoped keys from Settings → Developer. The secret is shown once.

    https://app.norruva.com/workspace?view=developer
    Step 3
    Send your first DPP

    POST your product data to receive a passport ID.

    curl -X POST https://app.norruva.com/api/v2/products \
      -H 'Authorization: Bearer $NORRUVA_API_KEY' \
      -H 'Content-Type: application/json' \
      -d '{
        "name": "Acme Cell 48V",
        "description": "48V lithium-ion battery module for light electric vehicles.",
        "category": "battery",
        "status": "Draft"
      }'
    Step 4
    Subscribe to events

    Register an endpoint to receive signed, retried webhook deliveries.

    curl -X POST https://app.norruva.com/api/v2/webhooks \
      -H 'Authorization: Bearer $NORRUVA_API_KEY' \
      -H 'Content-Type: application/json' \
      -d '{
        "url": "https://example.com/webhooks",
        "events": ["revocation.created", "approval.completed"]
      }'
    Create an API keyFull HTTP quickstartTry it in the playground

    Developer Resources

    Everything you need to design, build, and operate your integration.

    Updated weekly
    Runnable

    API Playground

    Run the public endpoints from your browser and read the live JSON response.
    Read documentation
    Interactive

    API Reference

    Explore our RESTful API endpoints for bulk import and compliance.
    Read documentation
    Real-time

    Webhooks

    Real-time updates for product status and compliance events.
    Read documentation
    Essential

    Authentication

    Secure your integration with SHA-256 and bcrypt API keys.
    Read documentation
    Safe

    Security

    Data practices and encryption standards.
    Read documentation
    Schema

    Data Schemas

    Digital Product Passport and compliance data models.
    Read documentation
    Updates

    Changelog

    Release notes, deprecations, and upcoming changes.
    Read documentation

    SDKs and Tooling

    Production-ready libraries and utilities for your stack.

    Node.js SDK

    Typed TypeScript client for API v2 (@norruva/api-client)

    OpenAPI specification

    Generate a client in any language from the published spec

    Webhook tester

    Replay and verify signatures

    Getting started

    Two public, unauthenticated contracts are all an integrator needs to start building — on desktop or mobile, without prior Digital Product Passport expertise: the API surface itself, and the data it exchanges.

    Read the OpenAPI specification

    The full, machine-readable API v2 contract — generate a typed client in any language, or read it directly.

    Browse the JSON Schema catalogue

    NRPF Digital Product Passport schemas with human-readable descriptions and per-schema download URLs — validate payloads before you send them.

    Environments and Base URLs

    Standardize deployments with clear separation and SLAs.
    Production
    Live
    https://app.norruva.com

    The single API host. Scoped API keys, RBAC, tier limits and audit logging apply.

    Sandbox mode
    Same host
    https://app.norruva.com

    Same host and same data plane — a time-boxed flag on your workspace, not an isolated environment. Do not use it for destructive testing.

    Webhook Event Catalog

    Subscribe to lifecycle changes and compliance alerts.
    passport.created
    passport.verified
    passport.expired
    compliance.alert
    supplychain.handoff
    audit.export.ready
    All events are signed with HMAC SHA-256. Use the timestamp header to prevent replay attacks.

    Security Advisories

    One stable, per-manufacturer URL serving that manufacturer's published security advisories in a machine-readable shape. Designed to align with the CRA Art. 14(8) user-information limb; no conformity assessment has been performed and no external advisory format is claimed.
    GET /api/v2/public/security-advisories/{companySlug}
    norruva.security-advisory.v1 · schema https://norruva.com/schemas/security-advisory/v1.json
    • Public and CORS-enabled — consumer tooling reads it without a key. 60 req/min per IP.
    • Addressed by the same public company slug the Trust Center uses.
    • Fails closed: 503 SECURITY_ADVISORY_PUBLISHING_NOT_CONFIGURED when the advisory channel is unbound. An empty feed means none were published — the two are never conflated.

    Security Checklist

    Recommended controls for production integrations.
    Use scoped keys per integration and rotate quarterly.
    Verify webhook signatures with request timestamps.
    Encrypt supplier data before transmit when needed.
    Store passport IDs separately from PII datasets.

    Integration Playbook

    Recommended milestones from pilot to production.
    Pilot (2-4 weeks)

    Map product schema, load 25-100 SKUs, validate audit exports.

    Scale (1-2 months)

    Automate ingestion, add webhooks, enable compliance workflows.

    Operate

    Monitor rate limits, alerts, and audit readiness dashboards.

    Partner Onboarding

    Ready to start your Enterprise pilot? Get in touch with our engineering team for specialized support and custom integration architectures.

    Contact Developer Support
    Norruva

    The trusted infrastructure platform for Compliance, Traceability & Digital Product Passports.

    Product

    • Product data & passports
    • Pricing
    • Open the sandbox

    Developers

    • Developers
    • Read the changelog

    Company

    • Talk to the team
    • Sign in
    PrivacyTermsAccessibility

    Notice: Regulatory application dates shown on this site are read from the underlying legal texts we track and may evolve as delegated acts land.

    © 2026 Norruva. All rights reserved.