Swissmedic Publishes swissdamed Machine-to-Machine REST API Documentation (Version 1.0)
Swissmedic has published the technical document “swissdamed Machine-to-Machine REST API Documentation” (Identification number BW630_40_810, Version 1.0, valid from 20 February 2026) .
The document provides guidance on the implementation of Machine-to-Machine (M2M) registration, update and market state management of devices in swissdamed using a REST API .
Availability of the REST API
According to Swissmedic:
The REST API for Machine-to-Machine device management will be available in the swissdamed playground environment by the end of March 2026 .
In the production environment, Machine-to-Machine device management will be available before the registration obligation of devices in swissdamed enters into force .
Users must set up Machine-to-Machine management in the playground environment prior to using this feature in the production environment .
This is relevant for manufacturers preparing automated UDI submissions in Switzerland.
Scope of the Machine-to-Machine Interface
The REST API contains endpoints enabling the following actions in swissdamed:
Submit UdiDi
Used for submitting a UdiDi (including associated PackageUdiDis) with its related BasicUdi
(POST endpoint under /m2m/udi/data/*)GET Status
Used for checking the status of one Submit UdiDi operation
(POST endpoint under /m2m/udi/data/udi-di-request-status)Set Market Status
Used for setting the market status of a UdiDi and/or PackageUdiDis
(POST endpoint under /m2m/udi/data/market-status)Get UdiDi
Used for obtaining the data of a UdiDi (including associated PackageUdiDis) and its related BasicUdi, and the current market status
(GET /m2m/udi/data/*)
Job Stories Covered in the Document
The document defines six job stories describing how manufacturers can use the API:
Register and set market status of a new UdiDi (with or without PackageUdiDi)
Update a BasicUdi
Update a UdiDi
Add new PackageUdiDis to an existing UdiDi
Perform bulk market status changes
Compare UdiDi and/or PackageUdiDi data with the user’s system
For update scenarios, Swissmedic specifies that the entire BasicUdi and/or UdiDi must be submitted, including unchanged data, depending on the case .
Onboarding and Testing Requirements
Swissmedic states that:
Testing of the Machine-to-Machine functionality must be performed in the playground environment before implementation in production .
There is no formal onboarding approval provided by Swissmedic.
It is the responsibility of the user to determine readiness before using the Machine-to-Machine functionality in production .
The test plan should consider:
The job stories described in the document
Applicable swissdamed actor types
Applicable devices or device variations .
Authentication and Credential Management
The swissdamed API uses OAuth2 Client-Credential-Flow .
Key elements include:
A separate client-ID and client-secret is required for each actor and/or mandate.
Client credentials differ between playground and production environments.
Client-secrets expire after two years and must be regenerated.
Issuing a new client-secret invalidates the previous one.
Swissmedic recommends that the API be used by one user per actor/mandate to avoid overwriting of data .
Versioning, Backwards Compatibility and Rate Limiting
The API follows a URI versioning approach .
If breaking changes become necessary:
A new version will be published.
The existing version will remain accepted and backwards compatible until a publicly announced deprecation date .
Users must allow:
Addition of new optional fields.
Optional fields to be absent or null where declared optional .
Swissmedic may implement general or client-specific rate limits and may temporarily block clients generating excess traffic. Users must implement a backoff strategy .
Disclaimer
Swissmedic notes that:
Specifications may change after publication for the playground and before deployment in production.
Availability of the Machine-to-Machine interface may be interrupted due to maintenance.
Processing times for UDI-DIs may vary .
Read the full document below.
