--- title: "OpenEPCIS Overview | OpenEPCIS Docs | OpenEPCIS - an open-core, GS1-compliant EPCIS implementation." canonical_url: "https://openepcis.io/de/docs/platform-overview" last_updated: "2026-06-28T23:26:21.724Z" meta: author: "benelog GmbH & Co. KG" description: "A GS1-conformant supply-chain data platform — Resolver, Masterdata, EPCIS Events — in open source and business editions." "og:description": "A GS1-conformant supply-chain data platform — Resolver, Masterdata, EPCIS Events — in open source and business editions." "og:title": "OpenEPCIS Overview" "twitter:description": "A GS1-conformant supply-chain data platform — Resolver, Masterdata, EPCIS Events — in open source and business editions." "twitter:title": "OpenEPCIS Overview" --- Home `` # **OpenEPCIS Overview** A GS1-conformant supply-chain data platform — Resolver, Masterdata, EPCIS Events — in open source and business editions.5 min read # **OpenEPCIS** OpenEPCIS is a GS1-conformant supply-chain data platform. It exposes a **GS1 Digital Link Resolver**, hosts **GS1 Web Vocabulary masterdata**, and lets that masterdata be driven by **EPCIS Events**. Three pillars, one platform: | **Pillar** | **What it does** | | --- | --- | | **Resolver** | Resolves any GS1 Digital Link URI (GTIN, GLN, SSCC, …) to product information, masterdata, EPCIS endpoints and a dozen more GS1-standard link types. The deployment is self-describing too — a downstream registry can find it and read what it offers without being hand-configured. | | **Masterdata** | Stores GS1 Web Vocabulary descriptions of products, organisations and places. Masterdata reaches the platform via REST (`**POST /organizations**`, `**/products**`, `**/places**`), never embedded inside EPCIS documents. | | **Events** | Captures, queries and streams EPCIS 2.0 events. Identifiers are stored in GS1 Digital Link canonical form. Subscriptions match events as they are indexed — no polling. | ## Editions OpenEPCIS ships in two layers: - **Open source** ([github.com/openepcis](https://github.com/openepcis)) — the standards-conformant building blocks. Maven BOM, EPCIS models, format converters, validators, identifier translator (EPC URN ↔ Digital Link), barcode renderer, event hash generator, test data generator. Anyone can build on these. (The GS1 Conformant Resolver itself is business-only — there is no open-source resolver today.) - **[Business edition](https://openepcis.io/docs/platform-overview/feature-matrix)** — the multi-tenant runtime that productionises the OSS stack: OpenSearch-backed event store with native Document-Level Security, Keycloak-based identity (OIDC + API-key), GS1 Germany Activate Plus / GEPIR integration, Azure/AWS storage backends, AI assistant, Terraform/Ansible deployment. Thirteen Quarkus container images assembled from `**openepcis-build/**`. ## What sets OpenEPCIS apart ### 1. Tenant isolation by design — not by application-layer filters Most multi-tenant systems rewrite every database query to inject a tenant filter. OpenEPCIS doesn't. The application forwards the authenticated user's identity into the OpenSearch transport layer, and the **OpenSearch Security plugin's native Document-Level Security (DLS)** enforces isolation at the data layer. If the application code is wrong, the data layer is still right. See [Architecture → DLS](https://openepcis.io/docs/platform-overview/architecture). ### 2. Live subscriptions without polling EPCIS streaming subscriptions are **matched the moment an event is indexed**, in the same engine that holds the events. Matches are delivered via webhook or WebSocket immediately. Scheduled (cron-based) subscriptions sit alongside streaming for clients that want polling semantics — nightly digests, periodic compliance pulls — and clients opt into them explicitly. See [Modules → EPCIS Events](https://openepcis.io/docs/platform-overview/modules/epcis-events). ### 3. A real participant in the GS1 trust graph Full "Verified by GS1" integration with GS1 Germany services — and it goes both ways. Inbound, the platform verifies GTIN / GLN identifiers against GS1 DE's registry (Activate Plus / GEPIR) and enriches the local record with authoritative attributes. **Outbound, the brand owner's masterdata held in the deployment is published back through GS1 DE and propagates up to the GS1 Global Office resolver — the customer's deployment is the source-of-truth, and the global GS1 network reflects what's in it.** A real node in the GS1 trust graph. ### 4. GS1 conformance, with a self-describing deployment A deployment is **discoverable by other systems out of the box** — it publishes the self-describing document the GS1 Conformant Resolver standard expects, so the GS1 Global Office resolver and partner registries can find and validate it automatically rather than being hand-configured (the URL is `**/.well-known/gs1resolver**`). A dozen GS1-standard link types — `**gs1:pip**`, `**gs1:productSustainabilityInfo**`, `**gs1:recallStatus**`, `**gs1:certificationInfo**`, `**gs1:productImage**`, `**gs1:safetyInfo**`, `**gs1:instructions**`, `**gs1:serviceInfo**`, `**gs1:nutritionalInfo**` and more — are auto-derived from the masterdata's referenced files when a product, organisation or place is saved. Identifiers at rest are GS1 Digital Link, not EPC URN. See [Modules → Resolver](https://openepcis.io/docs/platform-overview/modules/resolver). ### 5. Wallet-agnostic Verifiable Credentials Keycloak sits at the core of every business deployment, and Keycloak's native **OID4VCI** (OpenID for Verifiable Credential Issuance), **OID4VP** (Presentation) and **SIOPv2** support turns each tenant realm into a Verifiable Credential Issuer in its own right. Credentials come out as `**sd-jwt-vc**` (selective disclosure first), `**jwt_vc_json**`, `**ldp_vc**` or ISO mDoc — the holder picks the format their wallet understands. Because the surface is open OpenID Foundation protocol rather than a proprietary wallet stack, the same issuer interoperates with every OID4VC-compliant wallet already in production or in pilot — EU Digital Identity Wallet, Catena-X Managed Identity Wallet, enterprise wallets, mobile holder apps, sector-specific wallets. We didn't pick a wallet camp; we picked the protocol. The Keycloak / OID4VC layer ships today; named EPCIS / DPP credential schemas and the capture-to-issuance pipeline land next on the [roadmap](https://openepcis.io/docs/platform-overview/roadmap), with UNTP Digital Conformity Credential compatibility as a first-class target. --- ## Developer summary ### How the modules layer![Maven/Quarkus build topology from BOM anchor to container images](https://openepcis.io/diagrams/platform-build-topology-light.svg)![Maven/Quarkus build topology from BOM anchor to container images](https://openepcis.io/diagrams/platform-build-topology-dark.svg) The Maven BOM is the only version that matters; everything else inherits. ### How OSS feeds the business edition`**openepcis-build/**` is the assembly point. It consumes the OSS modules in two ways: 1. **As Maven dependencies** for the libraries (models, BOM, document-converter, dl-translator, event-hash-generator, epcis-constants, test-resources, S3 utils). 2. **As git submodules** for the modules that need source-level integration (resolver, REST/SOAP Quarkus apps document-converter-sax, keycloak-api-key). Business-only modules live under `**openepcis-build/modules/openepcis-core/**` and are bundled by Quarkus profiles in `**quarkus-dist/**` into the deployable containers. The same set of OSS jars sits underneath every business container; the business modules add the multi-tenant runtime, storage backends, and operational concerns. ### The GS1 conformance loop (today and tomorrow)![EPCIS capture feeding repository, query/subscriptions and resolver linksets](https://openepcis.io/diagrams/platform-data-flow-light.svg)![EPCIS capture feeding repository, query/subscriptions and resolver linksets](https://openepcis.io/diagrams/platform-data-flow-dark.svg) The plumbing for event-driven masterdata sync is present in the resolver (`**MasterDataDomainEvent**`, `**MasterDataSyncEventExecutor**`); what is not yet wired is the bridge from `**/capture**` into that domain bus. It's a named milestone — see [Roadmap](https://openepcis.io/docs/platform-overview/roadmap). ### Where to read next - [Architecture](https://openepcis.io/docs/platform-overview/architecture) — auth, DLS, the reactive pipeline, the GS1 conformance contract. Cite-heavy. - [Feature matrix](https://openepcis.io/docs/platform-overview/feature-matrix) — every capability × edition, with the module that provides it. - [Roadmap](https://openepcis.io/docs/platform-overview/roadmap) — Now, Next, Later. - Module groups: [Resolver](https://openepcis.io/docs/platform-overview/modules/resolver) · [Masterdata](https://openepcis.io/docs/platform-overview/modules/masterdata) · [EPCIS Events](https://openepcis.io/docs/platform-overview/modules/epcis-events) · [Formats](https://openepcis.io/docs/platform-overview/modules/formats) · [Integration](https://openepcis.io/docs/platform-overview/modules/integration) · [Testdata](https://openepcis.io/docs/platform-overview/modules/testdata) · [Platform](https://openepcis.io/docs/platform-overview/modules/platform).