GS1 · VIN · ISBN · UDI · NDC · SSCC — one registry, one door

Scan it. Name it.
Prove where the answer came from.

barcoding.dev answers the question every scanner asks and no neutral API answers: what is this, and how do you know?

resolve and verify run pure and local on every identifier family — no network, no account, no key. enrich answers from license-clean rails only, and every attribute ships inside a provenance envelope: source, license class, fetch time, digest. There is no bare value anywhere in the API.

get an API key read the blog

We answer in writing. We take at most five conversations a month, only when you ask for one, and only after you already have the written read.

barcoding resolve '(01)09506000134352(17)261231(10)ABC123(21)1234'

scheme      gs1.element-string
gtin        09506000134352            check: mod10 pass
ai.17       2026-12-31 (expiry)
ai.10       ABC123 (lot)
ai.21       1234 (serial)
identity    sgtin: urn:epc:id:sgtin:9506000.013435.1234
digital-link https://barcoding.dev/01/09506000134352/21/1234

One parser for both 2D label forms — GS1 element strings and Digital Link URIs — normalized to the same canonical identity and AI map. The same run works on a VIN, an ISBN, a UDI, an SSCC, a tracking number.

the scan line is applied from outside and is part of no barthe run is cropped by the frame on both sides — the shelf never ends

The closed verb set.

Nine verbs, declared in AGENTS.md, shipped in the tarball, exposed over MCP. --json on every verb; typed errors on stderr; exit codes 0 ok / 1 negative domain verdict / 2 usage. The same engine behind npx barcoding.dev and the hosted doors on this origin.

verb	what it does	network	exit-1 verdict
resolve	any identifier-bearing string — what a scanner read, bare GTIN-8/12/13/14, EPC URN, GS1 element string, GS1 Digital Link URI, VIN, ISBN, SSCC, tracking number — to canonical identity: scheme, canonical form, parsed AIs and fields	pure · local	unrecognized / unparseable
verify	check digit + structure + prefix legitimacy (GS1 prefix ranges → issuing MO; WMI → manufacturer; ISBN group), from pinned tables	pure · local	fails validation
enrich	canonical id → attributes, every attribute inside the provenance envelope: source, license class, fetched-at, source digest	network	no record in any licensed source
bridge	SKU / ASIN / vendor code / free text → GTIN candidates with confidence, plus the evidence for each candidate	network	no candidate above floor
hierarchy	GTIN → packaging-level graph (each / inner / case / pallet); inference is always labeled as inference	mixed	no hierarchy derivable
party	GLN / GS1 company prefix → party: licensee name, issuing MO, address grain where licensed	network	unknown prefix / GLN
generate	the write-side twin of resolve: id + AI map → element string, Digital Link URI, rendered symbol (QR / DataMatrix / GS1-128 / ITF-14). resolve(generate(x)) === x is the round-trip law	pure · local	unencodable input
pins	print the pinned artifact and data-source-manifest digests	pure · local	—
mcp	the agent door: the same verbs as MCP tools, readOnly-hinted where they are pure	—	—

The provenance envelope.

Per attribute, not per record — because real records are mosaics: nutrition may be public-domain USDA while the category is ODbL Open Facts. The license class travels with the value, so a downstream agent can filter by what it is allowed to do with each field.

{
  "attribute": "servingSize",
  "value": "30 g",
  "source": {
    "id": "usda-fdc",
    "record": "https://fdc.nal.usda.gov/…",
    "dataset_version": "FDC 2026-04 full download",
    "digest": "sha256:…"
  },
  "license": "public-domain",
  "fetched_at": "2026-07-31T18:20:11Z",
  "confidence": 1.0
}

The license enum is closed — public-domain · open-attribution · share-alike-odbl · gs1-licensed-display-only · commercial-restricted — and enforced at assembly time, not disclaimed in a footer.

The barcode registry. GS1 is the largest family in it, not the boundary.

One pinned registry file per identifier family: grammar, check-digit algorithm, canonicalization, barcode-type bindings, enrichment sources with license class, and the join rule into events and transactions where one exists. AccessGUDID proved the pattern at government scale — one endpoint, three issuing agencies' grammars; this registry generalizes it.

scheme	validation rail	enrichment rail	license class
GTIN / GLN / SSCC	GS1 GenSpecs mod-10, prefix ranges	food: USDA FDC (CC0) + Open Facts (ODbL, segregated)	public-domain · share-alike-odbl
VIN	49 CFR 565.15 — transliteration, weights, mod-11	NHTSA vPIC (public domain); auto.dev as the owned rail	public-domain · first-party
UDI (GS1 / HIBCC / ICCBBA)	FDA UDI formats doc	AccessGUDID / openFDA (CC0; GMDN fields stripped)	public-domain
NDC	structural (no check digit)	openFDA drug/ndc, updated daily (CC0)	public-domain
ISBN (978/979 — a valid GTIN-13)	free ISBN Users' Manual	routed to book enrichment	open · confirm-before-redistribution
USPS IMpb	Pub 199 MOD10, worked example public	identity open; tracking status per-caller	identity: open · status: per-caller
DL/ID PDF417 (AAMVA)	parse and verify ONLY	none — statutory	no_retention, hard flag

Seven laws, not seven features.

The parts that cannot be renegotiated later. The incumbents in this category were walled, dead, shallow, or unlicensed; every law below is the structural answer to one of those four failure modes.

01
No bare value anywhere.
Every attribute an enrich response carries travels inside a provenance envelope: source, license class, fetched-at, source digest. The license class is a closed enum and it is enforced, not descriptive — a response assembled for storage cannot contain display-only attributes.
02
Identity is free. It stays free.
resolve, verify and generate are pure and local — no network, no account, no key. The validation layer of the physical world is public regulation and royalty-free standards, and this door keeps it that way.
03
License-clean rails only.
The enrichment corpus is built exclusively on rails whose licenses permit it: USDA FoodData Central (CC0), openFDA (CC0), NHTSA vPIC (public domain), the Open Facts family (ODbL, as a segregated source layer). No scraped aggregator, ever — their upstream rights are unverifiable and their downstream rights are contractually zero.
04
Sources are pinned like schemas.
Each source has a manifest recording the license text URL, retrieval date and the sha256 of the license text itself — an upstream license change is a failed pin, not a silent drift. pins prints the digests.
05
Conformant to the standard; explicit about everything beyond it.
For GS1 keys the /01/* door serves the GS1-Conformant Resolver 1.2.0 surface — RFC 9264 linksets, the description file at /.well-known/gs1resolver — and it is a delegating door: resolution itself is id.org.ai's, served here. For every other identifier family it is the same contract extended, and labeled as such.
06
One door for people and for agents.
The same closed verb set over MCP; resolve and verify ship readOnlyHint: true with complete tool descriptions, so an agent's first value moment fires inside already-granted authority. Refusals are honest tool errors, never fabricated answers.
07
Joined, not adjacent.
A serialized 2D scan constructs a valid EPCIS 2.0 ObjectEvent, validated against epcis.dev's pinned schema before it leaves the function; its bizTransactionList carries the PO/ASN context via transactions.dev; the attested observer rides in id.org.ai terms. Identity → event → transaction, one scan wide.

What enrich is, stated plainly.

Deep and clean in four verticals — food, medical devices, drugs, vehicles — and identity-grade everywhere: resolve, verify and generate work on every GTIN on earth, because the standards layer is royalty-free and the check-digit universe is public regulation.

It is not a 500-million-row general-merchandise lookup. The general-merchandise long tail is licensed territory — display-scoped and membership-gated — and this API names it as such instead of papering over it with scraped data. That honesty is the moat: everything served is free and clear by construction, and everything gated is labeled gated.

The two flagship chains: UPC → nutrition facts on wholly public rails, and VIN → vehicle, with live listing chain on the family's own auto.dev. One per family; both worked examples on the blog.

Every scan is about to carry more than a price lookup.

GS1's Sunrise 2027 programme has retail point-of-sale scanning 2D by the end of 2027. A 2D symbol carries GTIN plus lot, expiry and serial — which makes every scan a potential EPCIS event, and every scanner a capture device.

The moment you write that event down, the question the standard leaves open arrives: five dimensions — what, when, where, why, how — and no performer. How the Who gets onto every scan, conformantly, is the family's whole argument.

The explainer arc runs on the blog: barcodes → Sunrise 2027 → what 2D means for EPCIS → how the Who gets onto every scan.

start the arc →

Get an API key.

Keys open the network half — enrich, bridge, hierarchy and party. Say what arrives at your door and the provisioning order follows the list.

get an API key

Access is provisioned from this list, in order. One email when yours is ready — one, not a drip campaign; no newsletter, no sequence. If we stop working on this, you get one message saying so and your address is deleted. Either way it is one message.