SKANNIT API FOR BRANDS

The product authentication & Digital Product Passport API for brands.

Connect your ERP, PIM or e-commerce stack to Skannit once. Push products and production orders in, get item-level QR codes out, and receive every factory scan, shipment, sale, repair and recycling event back — as signed webhooks, in real time.

Start free trial See the integration flow

REST + JSON: OpenAPI-described, cursor-paginated
GS1 Digital Link: One QR per physical item
Signed webhooks: HMAC-SHA256 with retries
26 languages: Passports in every EU language

YOUR ERP → SKANNITCURL

# 1. Exchange your client credentials for a token
curl -X POST https://www.skannit.com/api/v1/oauth/token \
  -d grant_type=client_credentials \
  -d client_id=$SKANNIT_CLIENT_ID \
  -d client_secret=$SKANNIT_CLIENT_SECRET

# 2. Raise a production order straight from your ERP
curl -X POST https://www.skannit.com/api/v1/brands/production-orders \
  -H "Authorization: Bearer $TOKEN" \
  -H "Idempotency-Key: PO-2026-8842" \
  -H "Content-Type: application/json" \
  -d '{
    "order_name": "PO-2026-8842",
    "order_date": "2026-10-01",
    "product_id": "prd_7f3a…",
    "factory": { "factory_id": "fac_lisbon_01", "name": "Tecidos Lisboa" },
    "quantity_matrix": [
      { "color": "Navy", "quantities": { "S": 200, "M": 350, "L": 250 } }
    ],
    "unit_cost_estimated": 18.40
  }'

WHY CONNECT

One integration. Every product, from factory floor to second owner.

No double entry

Your ERP stays the system of record. Products and orders flow in automatically instead of being retyped into another portal.

Real-time supply-chain events

Stock, shipping and sales systems update the moment an item is activated, packed, shipped, sold or returned.

Counterfeit signals, not guesses

Every scan is tied to one physical item, so clones surface as events your fraud and brand-protection tools can act on.

A passport as a by-product

The data ESPR asks for — materials, origin, custody, repair, end-of-life — accumulates per item while you run your normal flow.

HOW IT WORKS · A BRAND'S VIEW

Your product's life, as API calls.

Follow one production order from your ERP to the product's second owner. On the left, what happens in the real world. On the right, what your systems call — and what Skannit tells them.

01
Connect your systems
Create an API client in the developer portal and choose exactly what it may do. Your ERP swaps its client ID and secret for a short-lived token.
YOU CALL
- POST/oauth/token— Client credentials → 1-hour scoped token
02
Sync your catalogue
Your ERP or PIM stays the master. New styles, materials and GTINs flow into Skannit the moment you create them — no double entry.
YOU CALL
- GET/brands/categories— Valid product categories
- POST/brands/create-product— Create a product with materials and GTIN
- PUT/brands/products/{id}— Keep it in step with your ERP
- GET/products— List and filter your catalogue
03
Raise a production order
When your ERP raises a purchase order, Skannit gets the same order: product, colour and size matrix, and the factory making it.
YOU CALL
- POST/brands/production-orders— Create the order
- PUT/brands/production-orders/{id}— Amend before production starts
- GET/brands/production-orders— List orders and their status
SKANNIT TELLS YOU
- order.status_changed
04
Generate item-level QR codes
One GS1 Digital Link QR per physical item, each tied to its own on-chain record. Finalise, then send the print job straight to the factory.
YOU CALL
- PUT/brands/qr-wizard/orders/{id}/step-1— Serial and quantity setup
- PUT/brands/qr-wizard/orders/{id}/step-3— Box allocation plan
- POST/brands/qr-wizard/orders/{id}/finalize— Lock the order and mint records
- POST/brands/qr-wizard/orders/{id}/transmit— Send the job to the factory
- GET/brands/qr-wizard/orders/{id}/export-qr.zip— Print files, if you print yourself
SKANNIT TELLS YOU
- order.minted
- order.transmitted
05
Watch production happen
The factory scans and packs on a phone. Your ERP hears about every activated item and sealed box without anyone logging in.
YOU CALL
- GET/brands/production-orders/{id}/tracking— Progress timeline
- GET/brands/production-orders/{id}/boxes— Sealed boxes and contents
SKANNIT TELLS YOU
- item.activated
- box.sealed
06
Follow every shipment
Custody moves factory → carrier → warehouse → shop, each hand-off scanned or reported by the carrier. Damage and tampering arrive as structured events.
YOU CALL
- GET/brands/qr-wizard/orders/{id}/destinations— Where the goods are going
- GET/brands/hierarchy/{token_id}— Item → box → pallet → container
SKANNIT TELLS YOU
- custody.transferred
- custody.exception
07
Know when it sells
In a shop the passport moves at the till, the moment the item is scanned. Online it is linked when the warehouse picks the item and moves automatically when your web shop reports the parcel delivered — never from the order itself.
YOU CALL
- POST/retail/integrations/fulfillment/orders— Shop key: customer bought online — no passport linked yet
- POST/retail/integrations/fulfillment/tasks/{task_id}/shipped— Carrier and tracking number
- POST/retail/integrations/fulfillment/tasks/{task_id}/delivered— Carrier delivered it — passport moves to the customer
- POST/retail/integrations/fulfillment/tasks/{task_id}/return— Customer started a return
SKANNIT TELLS YOU
- web_order.item_linked
- ownership.transferred
- return.received
- ownership.returned
08
Keep the passport alive
Resale, repair and recycling keep writing to the same record — the lifecycle data a Digital Product Passport needs, per item.
YOU CALL
- GET/brands/production-orders/{id}/units/{unit_id}/dpp— Passport for one item
- GET/brands/repair/secondary-market— Verified resale activity
- GET/brands/repair/recycled— End-of-life records
SKANNIT TELLS YOU
- item.resold
- item.repair.completed
- item.recycled

BUILT FOR PRODUCTION

Safe to wire into the systems that run your business.

OAuth 2.0 client credentials

One-hour bearer tokens, scoped per client and revocable instantly. Secrets are shown once and stored only as hashes.

Your data, and only yours

Every token is bound to the brand that authorised it. No parameter can reach another brand's data.

Signed webhooks

HMAC-SHA256 with a timestamp, retried over 8 hours, then replayable from the portal.

Predictable limits

Per-client rate limits with HTTP 429 and Retry-After, cursor pagination and one error shape with a request ID.

PRICING

Start free. Pay when you go live.

Free trial

£0 for 14 days

Explore the API against sandbox data. No card needed.

60 requests / minute
Sandbox environment
Read + write scopes on test data
Sample webhook events
Community support

Start free trial

Pro

£199 per month

Production access for live brand integrations.

5,000 requests / minute
Live + sandbox environments
All scopes, incl. qr:write
Signed webhooks with retries + replay
90-day request & delivery logs
Email support, 1 working day

Get Pro

QUESTIONS

Straight answers.

What is the Skannit API?

A REST API that lets a brand run Skannit from its own systems: push products, raise production orders, generate item-level QR codes, and receive every scan, hand-off, sale, repair and recycling event back as a signed webhook. It is the same platform as the brand portal, with no screens.

What is a Digital Product Passport API?

It is an API for creating and maintaining the product data that EU ecodesign rules (ESPR) will require for each product — materials, origin, supply chain and end-of-life. Skannit builds that passport per item as a by-product of the normal flow, and exposes it through a single endpoint.

How does authentication work?

OAuth 2.0 client credentials. You create an API client in the developer portal, pick its scopes (for example products:write or qr:write), and exchange the client ID and secret for a one-hour bearer token. Clients are always locked to the data of the brand that authorised you.

How are webhooks secured?

Every delivery is signed with HMAC-SHA256 using your endpoint's secret and a timestamp, so you can reject forged or replayed requests. Failed deliveries retry after 1 minute, 5 minutes, 30 minutes, 2 hours and 8 hours before landing in a dead-letter queue you can replay.

Do I get my customers' personal data?

No. Sale events carry the country and date of sale, never the buyer's name or contact details. Consumer data stays with the consumer under GDPR.

Do my developers need to understand blockchain?

No. You call a normal REST API. Skannit handles signing, gas and confirmations, and every on-chain event is mirrored off-chain first so reads keep working even during a network outage.

How much does it cost?

Every developer account starts with a 14-day free trial on sandbox data, no card needed. Pro is billed monthly through Stripe and unlocks live data, higher rate limits and longer log retention. You can cancel at any time from the portal.

How do I test my integration safely?

Build against the sandbox with test keys — nothing you do there touches real products or items. You can send sample webhook events of any type to your endpoint, and the portal shows every call and delivery so you can see exactly what happened.

Connect your systems once. Trust every product after.

Create a developer account, get sandbox keys in minutes and make your first call today. Upgrade to Pro when you're ready for live data.