One thesis: the food vertical is the existence proof that a barcode enrichment API can be built with nothing to hide — because the deepest attribute data in the category is already in the public domain, and the honest architecture is to cite it per attribute rather than launder it into a blob.
This post is written for a reader that is increasingly not a person: the assistant-class agent working for a mid-market CPG brand's ops seat — a company with real co-manufacturing complexity and no engineering staff to spare, whose deputized agent gets asked things like "what does the public record say about our products?" and has to answer inside already-granted authority, without kicking off a procurement project. Everything below is shaped so that an agent can do exactly that.
The rail nobody talks about
The syndication networks treat product label data as the asset: brands pay to publish it, retailers pay to receive it, and the network's terms keep it fenced. What is much less discussed is where a large slice of the same data also lands: USDA FoodData Central's Branded Foods dataset, produced through a public-private partnership whose named partners include the operators of the largest syndication pipeline — and published, in USDA's own words, in the public domain under CC0 1.0.
Read that again from an engineer's chair: GDSN-pipeline label data — brand, ingredients, serving size, nutrient panel — GTIN-keyed (the dataset carries a gtinUpc field), refreshed with full public downloads, free API access, no negotiated agreement. The category's crown-jewel attributes, free and clear, for food. Beside it sits the Open Facts family — millions of crowd-sourced products under ODbL — usable for commercial purposes with share-alike obligations that are entirely manageable if the architecture respects them (more on that below). Those two rails are the flagship chain.
The chain, end to end
Start with a UPC off any kitchen shelf — say a granola bar's 016000275270. The chain is three verbs:
barcoding resolve 016000275270
scheme gs1.gtin carrier upc-a → canonical gtin-14 00016000275270
prefix 0016000… → GS1 US range check: mod10 pass
barcoding enrich 00016000275270
brandOwner "General Mills…" source: usda-fdc license: public-domain
ingredients "whole grain oats…" source: usda-fdc license: public-domain
servingSize "24 g" source: usda-fdc license: public-domain
nutrients[…] … source: usda-fdc license: public-domain
categories "granola bars" source: openfoodfacts license: share-alike-odblNo aggregator, no scraping, no display-only clause quietly violated. Every food UPC in your pantry is a live demo of the same run.
The envelope is the product
The interesting part is not that the data exists — it is what wraps it. There is no bare value anywhere in an enrich response; every attribute travels inside a provenance envelope:
{
"attribute": "servingSize",
"value": "24 g",
"source": {
"id": "usda-fdc",
"record": "https://fdc.nal.usda.gov/…",
"dataset_version": "FDC 2026-04 full download",
"digest": "sha256:…"
},
"license": "public-domain",
"fetched_at": "2026-07-31T18:20:11Z",
"confidence": 1.0
}The license field is a closed enum — public-domain, open-attribution, share-alike-odbl, gs1-licensed-display-only, commercial-restricted — and it is enforced at assembly time, not disclaimed in a footer: a response assembled for storage or redistribution simply cannot contain display-only attributes. For an agent, that changes the question from "may I use this?" — which an agent cannot responsibly answer about an unlabeled blob — to a filter it can apply mechanically: keep public-domain, carry the required notice for share-alike-odbl, decline to persist anything restricted. The permission travels with the value.
Per attribute, not per record, because real product records are mosaics. A single answer legitimately mixes public-domain USDA nutrition with ODbL community categories. Collapse that mosaic into one merged table and you inherit the strictest license across the whole thing; keep the sources segregated — independent databases queried at answer time, cited rather than merged — and each attribute keeps its own terms. That segregation is exactly how the ODbL's own distinction between a derivative database and a collective database is designed to work, and the answers carry the attribution notice the license asks for: Contains information from Open Food Facts, made available under the Open Database License (ODbL).
And because sources are pinned like schemas — each with a manifest recording the license text's URL, retrieval date and the sha256 of the license text itself — an upstream license change is a failed pin that stops the build, not a silent drift discovered in an audit.
What this looks like from the brand's chair
For the ops seat that deputized the agent, the chain answers a question that normally costs a project: what does the public record already say about our GTINs? Wrong serving size in the public dataset; an old formulation still listed in community data; a product missing entirely — each of those is a finding with a citation, produced by an agent inside scope it already holds, on readOnly-hinted verbs that clear auto-approval. When the finding needs to become operational — this pallet, this lot, received at this DC, observed by this person or this agent — the record crosses into event territory, and the previous post in the arc shows exactly how the scan becomes an EPCIS event with the Who carried honestly, on epcis.dev's pinned schema.
Stated plainly, the family way: this chain is deep and clean for food — and its siblings run the same shape for devices and drugs on openFDA (CC0) and for vehicles on NHTSA vPIC plus the family's own auto.dev. It is not a 500-million-row general-merchandise lookup; that long tail is licensed territory, and the API names it as such instead of scraping around it. An answer layer with its receipts attached is worth more than a bigger one that cannot show where anything came from — for a person auditing it, and doubly so for an agent that has to act on it.
The resolve half of the chain is pure and local — no key, no network, run it on any kitchen UPC now. The keyed enrich rail provisions through the access flow: get an API key, state the scope the agent already holds — food GTINs, read-only — and provisioning follows the list.
Keys open the network half of the verb set. Get an API key — say what arrives at your door, and the provisioning order follows the list.
We answer in writing. We take at most five conversations a month, only when you ask for one, and only after you already have the written read.