Build trusted product intelligence with Norruva APIs.
Ship Digital Product Passports, compliance intelligence, and lifecycle events directly into your ERP, PLM, or commerce stack. Norruva gives you the data layer plus append-only evidence trails traceable to obligation ids.
Quickstart
Sign up to provision a tenant. There is no CLI for this. It happens in the browser.
https://www.norruva.com/auth/signup
Issue scoped keys from Settings → Developer. The secret is shown once.
https://www.norruva.com/workspace?view=developer
POST your product data to receive a passport ID.
curl -X POST https://www.norruva.com/api/v2/products \
-H 'Authorization: Bearer $NORRUVA_API_KEY' \
-H 'Content-Type: application/json' \
-d '{
"name": "Acme Cell 48V",
"description": "48V lithium-ion battery module for light electric vehicles.",
"category": "battery",
"status": "Draft"
}'Register an endpoint to receive signed, retried webhook deliveries.
curl -X POST https://www.norruva.com/api/v2/webhooks \
-H 'Authorization: Bearer $NORRUVA_API_KEY' \
-H 'Content-Type: application/json' \
-d '{
"url": "https://example.com/webhooks",
"events": ["revocation.created", "approval.completed"]
}'Developer Resources
Everything you need to design, build, and operate your integration.
API Playground
API Reference
Webhooks
Authentication
Security
Data Schemas
Changelog
API, specification and webhooks
Build against the API reference, generate a client from the OpenAPI specification, and verify your webhook handling.
Getting started
Two public, unauthenticated contracts are all an integrator needs to start building, on desktop or mobile, without prior Digital Product Passport expertise: the API surface itself, and the data it exchanges.
Read the OpenAPI specification
Browse the JSON Schema catalogue
Environments and Base URLs
The single API host. Scoped API keys, RBAC, tier limits and audit logging apply.
Same host and same data plane, a time-boxed flag on your workspace, not an isolated environment. Do not use it for destructive testing.
Webhook Event Catalog
Security Advisories
- Public and CORS-enabled. Consumer tooling reads it without a key. 60 req/min per IP.
- Addressed by a public company slug derived from the company name.
- Fails closed: 503 SECURITY_ADVISORY_FEED_UNAVAILABLE whenever no feed is served, for any reason, so the answer never reveals whether a company exists. An empty feed means none were published. The two are never conflated.
Security Checklist
Integration Playbook
Map product schema, load 25-100 SKUs, validate audit exports.
Automate ingestion, add webhooks, enable compliance workflows.
Monitor rate limits, alerts, and audit readiness dashboards.
Partner Onboarding
Ready to start your Enterprise pilot? Get in touch with our engineering team for specialized support and custom integration architectures.
Contact Developer Support