OpenDPP
Client Console Book a demo

OpenDPP — API Terms

Last updated: 2026-07-21 · Version: 1.0

These API Terms govern access to the OpenDPP application programming interfaces, developer tools, webhooks, machine-readable projections and public endpoints (together, the "API") provided by Opendpp UAB (§1 of the Terms of Service, the "Terms"). The API Terms are one of the Policies incorporated into the Terms and are subject to them; capitalised terms have the meaning given in the Terms. By requesting credentials or accessing the API you accept these API Terms.

1. Definitions

2. Licence

Subject to the Terms and these API Terms, we grant you a limited, non-exclusive, non-transferable, revocable licence during your subscription to access the Authenticated API and use the Documentation to build and operate integrations between the Service and your own systems and products.

Integrator use. A software vendor, consultancy or other integrator may use the API on behalf of a customer of ours, provided (a) that customer has its own workspace and has authorised the integrator, (b) the integrator accesses only that customer's workspace using credentials issued for it, and (c) the integrator remains responsible for its own compliance with these API Terms. Reselling API access, or operating a single workspace on behalf of multiple end-clients, requires our prior written agreement (a partner Order).

3. Keys and security

3.1 Keys are issued per workspace and may be scoped (roles, permissions). You are responsible for keeping Keys confidential, for rotating them on suspected compromise, and for all use made with them (Terms §4.1). Do not embed Keys in client-side code, public repositories or published artifacts.

3.2 We may revoke, rotate, re-scope or suspend Keys at any time where we reasonably believe they are compromised, abused, or used in breach of the Terms, and on termination of your subscription.

4. Plan limits, rate limits and fair use

4.1 API usage is subject to your plan's quotas and entitlements (Terms §2.1) and to the rate limits published in the Documentation. We enforce limits technically: over-quota or unentitled requests may be declined (including with HTTP 402), and excessive request rates throttled (HTTP 429). Bulk endpoints have documented batch caps.

4.2 We may adjust rate limits and technical thresholds from time to time to protect the Service; material reductions to your paid plan's documented quotas during a committed term are treated under Terms §2.2.

4.3 You must not circumvent, or attempt to circumvent, quotas, rate limits, metering or plan gates (including by rotating IPs, keys or workspaces).

5. API stability, versioning and deprecation

5.1 The API is versioned by URL major (e.g. /api/v1), with the specification version published in the OpenAPI document. Additive, backwards-compatible changes (new endpoints, new optional fields, new enum values, new response fields) may ship at any time without notice — build integrations that tolerate them.

5.2 Breaking changes are shipped as a new URL major; we aim to keep the prior major serving until a published deprecation window (target: at least ninety (90) days, announced in the changelog and, where practicable, via Deprecation/Sunset response headers) has closed. These are good-faith targets, not warranties (Terms §13.1).

5.3 Endpoints or fields marked alpha, beta, preview or experimental may change or disappear at any time (Terms §2.4). Undocumented behaviour is not part of the contract.

6. Restrictions

You must not, and must not permit any third party to:

7. Webhooks

7.1 Webhook deliveries are signed (HMAC over a timestamped payload, per the Documentation). You must verify signatures and reject stale timestamps before trusting a delivery; we are not responsible for consequences of unverified processing.

7.2 Delivery is at-least-once with bounded retries on a documented backoff schedule; deduplicate on the stable delivery ID. Deliveries that continue to fail may be dropped after the final retry, and we may disable endpoints that persistently fail, time out or misbehave. Webhooks are a convenience mechanism, not a guaranteed transport — reconcile against the API for anything critical.

7.3 You warrant that webhook endpoint URLs you configure are yours to use; deliveries to them are made at your instruction.

8. Public Interfaces, database rights and automated agents

8.1 Public Interfaces exist so that anyone — including consumers, authorities, market-surveillance bodies and automated agents — can resolve, read, verify and cite individual published passports. We welcome that use, within published rate limits and technical guidance (e.g. robots.txt, /llms.txt).

8.2 We and our customers invest substantially in obtaining, verifying and presenting the contents of the passport database. We reserve all rights in the database as a whole, including sui generis database rights under Directive 96/9/EC. Except as described in §8.1 or with our written consent, you must not extract or re-utilise the whole or a substantial part of the database (nor repeatedly and systematically extract insubstantial parts amounting to the same) — including to build or enrich a competing passport-hosting, resolution or data-aggregation offering.

8.3 Nothing in this §8 limits (a) rights our customers grant you directly in their own data, (b) uses required by product-passport regulation, or (c) text-and-data-mining rights that cannot lawfully be restricted; machine-readable reservations, where we make them, are expressed via the published crawler and agent guidance.

9. Open-source packages and the specification

9.1 The @opendpp/* client packages and the published SDKs are licensed under their own open-source licences (Apache-2.0), which govern that code. Nothing in these API Terms restricts rights validly granted by those licences; conversely, those licences grant no rights to the hosted Service, the OpenDPP trade marks, or the API itself.

9.2 The published OpenAPI specification may be used to build integrations and generate clients against the Service. It remains our copyright; you may not use it to misrepresent compatibility or endorsement.

10. Sandbox and test data

Sandbox, evaluation and free developer workspaces are for integration and testing only (Terms §2.3): do not put production workloads or real personal data in them. We may reset, purge or reclaim sandbox data at any time. Synthetic sample data we provide is fictional and must not be presented as real product information.

11. Data, logs and monitoring

We log API traffic (including identifiers, IPs, timing and status) for security, abuse prevention, capacity and billing purposes, and may monitor usage for compliance with plan limits and these API Terms. Personal data is handled per the Privacy Policy and, for Customer Content, the DPA; aggregated usage data is governed by Terms §9.8.

12. Suspension and termination

We may suspend or restrict API access per Terms §7.5 (including immediately, for security or abuse), and these API Terms terminate with the Terms. §§6, 8, 9, 11 and this sentence survive termination.

13. No warranty; liability

The API is provided "as is" per Terms §13; the liability cap and exclusions in Terms §13 apply to the API and these API Terms. Rate limits, stability targets and deprecation windows are targets, not warranties.

Opendpp UAB · Švitrigailos g. 11K-109, LT-03223 Vilnius, Lithuania · Company code 308017314 · info@opendpp-node.eu