Please note that this specification is suitable for pre-production pilot implementations.
Buying and Supplying
Overview
Every organisation in a value chain, other than the end consumer, buys from the actors upstream of it and supplies the actors downstream. A manufacturer receives credentials from its own suppliers and issues credentials to its customers, and a brand does the same on the way to the consumer. Buying and supplying are functions that many roles perform, not roles in their own right. This page describes each function once, and the guidance for individual roles refers to it.
The two functions depend on each other. What one organisation supplies is what the next one buys, and what a buyer can verify upstream limits what it can credibly pass on. Consumers buy but do not supply; their guidance is in Implementation Plans.
Buying function
Request credentials
A buyer asks suppliers to conform to UNTP, whatever software they use, so that no traceability platform is imposed on the supply chain. The request should name the credentials needed: product passports, facility records, traceability events and conformity credentials, together with any industry extension carried on the community's entry in the CAP register. A buyer that already uses a global identifier scheme can keep using it through the UNTP identifier scheme binding.
Receive and verify
Verification covers three things. The credential must be intact and signed by the stated issuer. The issuer's identity should link to a Digital Identity Anchor, such as a business registration or trademark ownership credential, so the buyer knows who the issuer is. And the software that issued the credential and the scheme it references can be checked against the registers: SWI entries carry observed conformance results, and conformity credentials reference schemes from the CVC register. Where a certificate comes from an accredited assessor, the accreditation credential completes the chain.
Use the results for due diligence
Credentials can be discovered through identity resolvers and assembled into a transparency graph that follows the evidence across several tiers. A due diligence assessment works from that graph. Constraints can be run against it, as described in Graph Validation; the examples there are informative. A buyer should keep exact signed copies of the upstream evidence its own claims rely on, with the material needed to verify it later, as described in Durable Storage. Where a supplier shares a role-specific version of a credential, Variant-Based Disclosure explains what the buyer will and will not see.
When suppliers cannot yet issue
A buyer does not have to wait for suppliers to be ready. Existing PDFs and certificates can be turned into graph-compatible data with AI and flagged as unverified, and suppliers can publish their existing documents behind an identity resolver so that they are discoverable and can be refreshed. Different Digital Maturities describes both. Where many suppliers face the same constraints, a Community Activation Program spreads the cost across the community. A trusted intermediary can also issue on a supplier's behalf, although the trust chain mechanics for delegated issuance are still being developed. A buyer that cannot issue credentials itself can still receive and verify them. Low Digital Maturity Organisations covers these entry points.
Supplying function
A supplier issues credentials about what it makes and where. A product passport describes the goods, a facility record the place that produced them, and traceability events the movements and transformations in between, with conformity credentials from third-party assessors linked to the passport. Linking all of these to the product and facility identifiers lets any buyer discover them through an identity resolver without a prior relationship or specific software, as described in Digital Wallets.
A supplier often cannot know which market a product will reach, or which buyer will ask for evidence. Publishing once in UNTP form and serving every buyer from the same credentials avoids answering each request separately. Jurisdictional Extension explains why this matters at market entry.
The issuer should link its own identity to a strong credential, such as a business registration or trademark ownership, and use the UNTP anti-counterfeiting mechanism, so that buyers can tell its credentials from forgeries. UNTP confidentiality measures let a supplier redact upstream credentials before passing them on. Variant-Based Disclosure serves different parts of a credential to different roles, and a trusted auditor can attest to mass balance without exposing production data (Chain of Custody and Mass Balance).
Small and medium suppliers will typically issue through commercial software that already implements UNTP, chosen from the SWI register, rather than building their own.
Where the two functions meet
A manufacturer's outgoing passport is only as good as the credentials it received. The upstream emissions and provenance figures it passes on come from what it verified as a buyer, and the mass balance it attests to depends on the input shipments it recorded. A brand issuing a consumer-facing passport is in the same position.
The Community Activation Program uses the same split when it maps, for each member, where buying and supplying take place in the organisation.