What is CARO? #
About this document #
What are identifiers & credentials in CARO? #
Identifiers & credentials are stored in your CARO digital wallet. They provide the basis for all of CARO’s services to you.
You may have one or more Enterprise Identifiers. These are, in fact, so-called decentralized identifiers (DID). Each is unique and assigned to a specific enterprise of yours that has registered with CARO. Each identifier holds its own set of credentials, more specifically, these are so-called verifiable credentials that enable automated information exchange between you and your counterparty, i.e. the trading partner with whom you are in business.
To satisfy DSCSA ATP requirements, you require two credentials:
- The Identity Credential identifies your enterprise (not you as a person!).
- The DSCSA ATP Credential represents your enterprise’s ATP status as defined by DSCSA.
Download a brief overview of the information needed to obtain these credentials.
So, what does my CARO Enterprise Account do for me? #
Your CARO Enterprise Account is your gateway to pass credential details to your VRS provider. Your VRS will then present these details to your counterparty for verification. All this happens behind the scenes without any need for you to intervene. CARO’s system is based on the concept of the trust triangle.
For example, imagine you want to find out whether you can sell a returned box of drugs. This means you will need to enquire with the manufacturer whether the box has really been produced by them. To do so, you must prove to the manufacturer that you are allowed to trade pharmaceuticals, that is, you must demonstrate your valid ATP status as defined by DSCSA. CARO, in collaboration with your VRS, allows you to do this in a fully automated manner once registered with us. The manufacturer, in turn, will need to prove to you that they are indeed a legitimate manufacturer. They use the same mechanism as you to do so by sending their valid ATP status through their VRS to you.
What are VRS Events in CARO? #
- you transmitting PI information to your VRS (for example through a product scanning app);
- your VRS sending this PI information in combination with your ATP status (as recorded in CARO) to the manufacturer’s VRS;
- the manufacturer transmitting the response to their VRS essentially confirming or denying that the product stems from them;
- the manufacturer’s VRS sending this response in combination with their ATP status (as recorded in CARO or another compatible service) to your VRS
- you receiving the PI verification response
The illustration above roughly depicts this flow.
It is important to understand that in this information exchange CARO is solely involved in providing the ATP status. Thus, what we call VRS Events in CARO refers only to the success or failure of the credential processing between CARO and your VRS, not the entire VRS messaging roundtrip.
What do the VRS Event statuses mean? #
|VRS Event Type||Your Status||Meaning|
|Outgoing||✅ success||Your VRS has successfully retrieved your ATP credential from your CARO Enterprise Account.|
|Outgoing||🔴 fail||There was an issue with the ATP credential in your Enterprise Account.|
|Incoming||✅ success||CARO has verified your counterparty’s ATP credential and found it to be valid.|
|Incoming||🔴 fail||CARO has deemed your counterparty’s ATP credential invalid.|
Note that this overview focuses on the status of the VRS Events in your own CARO Enterprise Account. See below for explanations of the counterparty status.
|VRS Event Type||Counterparty Status||Meaning|
|Outgoing||✅ success||The other trading partner has received your ATP credential and found it to be valid.|
|Outgoing||🔴 fail||The other trading partner has received your ATP credential and deemed it invalid.|
|Outgoing||⚫ unavailable||If your own outgoing event status is a fail, the other party may not have received your ATP credential. It may also be that the counterparty is not a CARO user. Thus, CARO cannot access the status information.|
What are VRS Reports in CARO? #
We bundle CARO’s VRS Events to VRS Reports. This is possible because VRS Events that belong to the same messaging roundtrip are assigned the same unique identifier, a so-called correlation UUID. Thus, CARO VRS Reports make it easier for you to trace all interactions of your CARO Enterprise Account with your VRS that belong to a specific product enquiry.
What do the VRS Report statuses mean? #
|VRS Report Status||Meaning|
|✅ success||The full VRS roundtrip has taken place and passed all checks. Your VRS has successfully retrieved your ATP credential from your Enterprise Account and CARO has verified your counterparty’s ATP credential as valid.|
|🔶 incomplete||Only half of a VRS roundtrip has taken place due to some issues along the way. If you are the sender of a product enquiry, for example, your VRS may have successfully retrieved your ATP credential from your Enterprise Account, but your counterparty has deemed your ATP credential invalid. This prevented any further interaction with your Enterprise Account.|
|🔴 fail||The full VRS roundtrip has taken place and failed critical checks. Most likely, your VRS has successfully retrieved your valid ATP credential from your Enterprise Account but CARO deemed your counterparty’s ATP credential invalid.|