GS1 Identifiers & Onboarding

qr3.app follows a BYO-GTIN/BYO-GLN model (Bring Your Own): you bring your existing GS1 identifiers — qr3 provides the digital product layer on top.

What does GS1 do?

GS1 issues globally unique identifiers for products and locations:

Identifier	Description	Example
GTIN-14	Global Trade Item Number (product ID)	`04012345678901`
GLN-13	Global Location Number (location/company)	`4012345000009`
Company Prefix	Company prefix (7-12 digits) from which GTINs are derived	`4012345`

To obtain GTINs, you need a GS1 membership from your national GS1 organization (e.g. GS1 Austria, GS1 Germany).

What does qr3.app do?

qr3.app uses your existing GS1 identifiers and provides:

GS1-compliant resolver — /01/{GTIN}/21/{Serial} with content negotiation
EU Digital Product Passport — DPP creation, validation, consumer view
Print-ready QR assets — SVG, PNG, vector PDF, EPS
JSON-LD, DCAT-AP — Machine-readable product data

Onboarding Flow

1. Register GS1 Identifiers

Before creating DPPs, register your GTINs (or your Company Prefix):

Via API:

curl -X POST https://qr3.app/v1/gs1/identifiers \
  -H "Authorization: Bearer qr3_sk_..." \
  -H "Content-Type: application/json" \
  -d '{"identifier_type": "company_prefix", "value": "4012345", "label": "GreenPower GmbH"}'

Via Dashboard:

Navigate to Dashboard → GS1
Select the type (GTIN, GLN, or Company Prefix)
Enter the value — check digit validation happens automatically
Click Add identifier

Your organization holds each identifier only once, in one of its workspaces. If you register a removed identifier again, it comes back (201, the same id) as a self-declaration and unverified, even if it was verified before it was removed; if it was in another workspace, it moves to this one. If it is still registered, the answer is 409 with reason already_registered (in this workspace) or registered_in_other_workspace (in another one; workspace names it if you may open it). If the workspace is archived meanwhile, reason is workspace_archived; nothing is registered.

2. Create DPPs

Once a GTIN is registered (directly or via Company Prefix), you can create DPPs:

curl -X POST https://qr3.app/v1/dpp \
  -H "Authorization: Bearer qr3_sk_..." \
  -H "Content-Type: application/json" \
  -d '{"gtin": "04012345678901", "product_name": "EcoMax Battery", ...}'

3. Ownership Check

qr3.app verifies GTIN ownership on every DPP creation:

Direct registration — The GTIN is registered as identifier_type: "gtin"
Prefix match — The GTIN starts with a registered Company Prefix (positions 2..N of GTIN-14)

Without a matching registration, you’ll receive a 422 error asking you to register the GTIN first.

The same check applies to POST /v1/dpp/batch and POST /v1/dpp/import, synchronous and as a queued job: one GTIN without a registration refuses the whole request with 422 (title GTIN Not Registered, the refused GTINs in gtins, their number in total); nothing is created or queued. Existing passports are not affected. Submitting a passport to the EU registry (POST /v1/dpp/:id/register) additionally requires that the organization of the passport holds the GTIN (see section 4); otherwise the answer is 409 (title GTIN Held by Another Organization).

4. Verification

A registration through the API or the dashboard is a self-declaration (verified_by: "self", verified_at: null). A verified identifier carries verified_at (verified_by: "gs1_registry" or "admin"); qr3 sets it after checking a request with a proof (see below). A verified GTIN or Company Prefix:

binds the public GS1 resolver for these GTINs to your organization, even if another organization created a passport earlier;
blocks every other organization: creating a DPP for such a GTIN, also by batch or import, returns 409 (errors/conflict, title GTIN Verified by Another Organization, the refused GTINs in gtins). Batch and import are refused as a whole.

Without verification, a GTIN belongs to the organization that has held it the longest without a break (details: GS1 Resolver). If your GTIN resolves to another organization’s passport, request its verification.

Requesting verification

In the dashboard under GS1, section Request verification: enter the type (GTIN or Company Prefix) and the value, upload a proof and submit the request. The proof shows that your organization holds the GTIN or Company Prefix from GS1, for example the license confirmation from your GS1 organization (PDF, PNG, JPEG or WebP). It is stored privately; only your organization and the qr3 team can see it. There is no automatic lookup at GS1.

The qr3 team checks the proof and approves the request or declines it with a reason. Once approved, the identifier is verified (verified_by: "admin") and takes effect as described above. You get an email about every decision, sent to your organization’s notification address, or otherwise to the owner’s address.

Who: organization admins only (org_admin or the owner). Other roles and direct API keys get 403. qr3 support cannot submit a request in your name either.
Status: pending (in review), approved, rejected, withdrawn (withdrawn by you) or revoked (verification revoked later). You can withdraw a request that is in review.
409: reason is request_pending (your organization already has a request for this identifier), already_verified or verified_elsewhere (another organization has verified it; it is not named). If your organization holds the GS1 license for it, write to [email protected]: qr3 checks both sides and can revoke a verification. If the proof changes while the request is being filed, reason is proof_changed; file the request again.
Other workspace: with request_pending, workspace (id, name) and request_id name the open request if you may open its workspace; withdraw it there. Otherwise both are null. If the workspace is archived while you file the request, reason is workspace_archived; nothing is filed.
Archiving: when a workspace is archived, its requests under review are withdrawn (withdrawn, in the audit log with the reason workspace archived). The proof is free again, and you can request the identifier again from another workspace.
Proof: while the request is under review or approved, the file can be neither replaced nor deleted (409, reason: "gs1_verification_proof"). Once the request is rejected, withdrawn or revoked, it is free again.
Removing: a verified identifier cannot be removed (409, reason: "verified"). Only qr3 gives up the verification, by revoking it.

When do I need both?

Task	GS1	qr3.app
Obtain your own GTINs/GLNs	✅ Membership required	—
Validate GTIN check digits	—	✅ API + Dashboard
Generate QR code for product	—	✅
Create DPP per EU regulation	—	✅
Resolve GS1 Digital Links	—	✅ Resolver + `/.well-known/gs1resolver`
Register in EU Registry	Planned (Q4 2026)	Planned (Phase 4c)

API Reference

POST /v1/gs1/identifiers — Register
GET /v1/gs1/identifiers — List
DELETE /v1/gs1/identifiers/:id — Remove
POST /v1/gs1/validate — Validate (no registration, no auth required)
POST /v1/gs1/verifications — Request verification (organization admins)
GET /v1/gs1/verifications — List requests
GET /v1/gs1/verifications/:id — Get a request
POST /v1/gs1/verifications/:id/withdraw — Withdraw a request

See the API documentation for details.