freeDPP

Entry from our research · information as of 2026-10-18

Operator: inndata Datentechnik GmbH · AT
Web page: https://freedpp.eu/
Source code: https://github.com/OttoHandle/freeDPP
Licence: GPL-3.0 (SPDX: GPL-3.0-only)
API base: https://drill.freedpp.eu/v1
Checks: 7 of 11 passed · 2 warnings · read-only, weekly
Listed since: 2026-10-18
Entry: services/freedpp.yaml

Demo instance with test passports. Test data and the feature flag come from the public demo and the published source code.

This list is part of a research project and shares what we currently know. It makes no claim to be complete and is not a legal assessment. Entries from our research come from public information and may be incomplete or out of date. The operator can correct or take over this entry, or ask for its removal: how to add or correct a service.

Example passports · dpplint

drill passport

https://drill.freedpp.eu/01/5012345101095 · open in dpplint

3 of 4 automated checks passed (1 failed, 1 with warnings, 2 skipped) · checked 2026-10-18

Proposed criteria failed, not counted: 5

Criterion	Title	Result
DPP-ID-001	Product identifier resolves to its passport	failed
DPP-DAT-016	Passport is available as HTML	warning
DPP-DAT-003	Passport is delivered as structured JSON	passed
DPP-ID-013	Passport readable without registration or credentials	passed
DPP-ID-016	DID identifiers follow DID Core, DID Resolution and VC 2.0	skipped not applicable
DPP-SEC-002	Integrity of the passport version is verifiable	skipped no evidence

Service checks · dpp-validator

Run 2026-10-18T21:03:51Z · dpp-criteria 08ee851 · JSON

7 of 11 automated checks passed (4 failed, 2 with warnings, 4 skipped: 1 not applicable, 3 not sent (read-only run)) · read-only run

Proposed criteria, not counted: 0 of 0 automated checks passed

Criterion	Requirement and findings	Level	Result
DPP-API-021 v2	elementIdPath uses RFC 9535 JSONPath error: step 1 (GET /dpps/{dppId}/elements/{elementIdPath}): HTTP status is 204, expected 200 error: step 1 (GET /dpps/{dppId}/elements/{elementIdPath}): Content-Type is missing, expected application/json error: step 2 (GET /dpps/{dppId}/elements/%24%5B): HTTP status is 204, expected 400	MUST	failed
DPP-API-022 v1	Unknown passport ID is answered with 404 error: step 1 (GET /dpps/{randomId}): HTTP status is 204, expected 404	MUST	failed
DPP-DEX-002 v1	HTTPS with a valid certificate error: plain HTTP on port 80 answered 200 instead of redirecting to HTTPS	MUST	failed
DPP-DEX-006 v1	HTTP versions below HTTP/2 are not used error: HTTP/1.1 not rejected: answered 200 (ALPN offered only http/1.1)	MUST	failed
DPP-API-023 v1	API honours the representation query flag warning: step 4 (GET /dpps/{dppId}?representation=dpp-validator-unknown): HTTP status is 200, expected 400	MUST	warning
DPP-DEX-003 v1	TLS 1.2 or higher, older versions refused warning: TLS 1.3 not supported (connection closed during the TLS handshake (ECONNRESET))	MUST	warning
DPP-API-013 v1	Lifecycle API provides ReadDPPById	MUST	passed
DPP-API-014 v1	Lifecycle API provides ReadDPPByProductId	MUST	passed
DPP-API-020 v1	API paths carry the version prefix v1/	MUST	passed
DPP-DEX-004 v1	API responses are JSON	MUST	passed
DPP-DEX-005 v1	HTTP/2 is supported	MUST	passed
DPP-API-007 v2	Errors use the EN 18222 status codes read-only run: not sent, the criterion needs step 1 POST /dppsByProductIds, step 2 POST /dppsByProductIds	MUST	skipped not sent (read-only run)
DPP-API-015 v1	Lifecycle API provides ReadDPPIdsByProductIds read-only run: not sent, the criterion needs step 1 POST /dppsByProductIds	MUST	skipped not sent (read-only run)
DPP-API-019 v1	Lifecycle API provides ReadDPPVersionByIdAndDate the service does not declare historical-versions	SHOULD	skipped not applicable
DPP-SEC-001 v3	Passport cannot be changed without authorisation read-only run: not sent, the criterion needs step 2 PATCH /dpps/{dppId}, step 3 POST /dpps	MUST	skipped not sent (read-only run)
DPP-ACC-003 v1	Controlled data elements are delivered per role (proposed, not counted) the service does not declare access-levels	MUST	skipped not applicable
DPP-ACC-006 v1	Controlled data elements are not delivered without authorisation (proposed, not counted) the service does not declare access-levels	MUST	skipped not applicable
DPP-ACC-008 v1	Access policy defines element-level rights, granting and revocation (proposed, not counted) the service does not declare access-levels	MUST	skipped not applicable
DPP-ACC-012 v1	Fine-granular read of a controlled element without credentials is refused (proposed, not counted) the service does not declare access-levels	MUST	skipped not applicable
DPP-ACC-014 v1	Access to controlled data is logged tamper-evidently (proposed, not counted) the service does not declare access-levels	MUST	skipped not applicable
DPP-API-016 v1	Lifecycle API provides UpdateDPPById (proposed, not counted) the service does not declare write-api	MUST	skipped not applicable
DPP-BAT-004 v2	Battery passport releases Annex XIII point 3 data only to authorities (proposed, not counted) the service does not declare battery, access-levels	MUST	skipped not applicable
DPP-OPS-006 v1	Separate test and production environments (proposed, not counted) self-declared criterion: declarations are not evaluated in this version and never count as passed	SHOULD	skipped not evaluated
DPP-STO-017 v1	Archived versions keep the access restrictions (proposed, not counted) the service does not declare access-levels, historical-versions	MUST	skipped not applicable

Results of automated checks only. They are no certification and establish no presumption of conformity.