PACT is the WBCSD Partnership for Carbon Transparency: a common format and a common way of exchanging product carbon footprints between companies, so a buyer's system can read a supplier's numbers without spreadsheets. Sustained is a PACT Conformant host on Technical Specifications v3. This article covers both sides: connecting to Sustained as a buyer who has been sent a share, and sharing your footprints as a Sustained customer.
If you were sent a share
You received an email saying that a company has shared its product carbon footprints with you through Sustained. The email carries everything a PACT-conformant system needs except one value, the client secret, which is behind a one-time link.
- Open the link in the email. The page shows the base URL, the token URL, the scope, the client ID and the client secret. Copy the secret straight away: the page is shown once and cannot be reopened. If you leave without copying it, or the link has expired (links last seven days), ask the company that shared with you to send a new link. A new link comes with a new client ID and secret, and the old ones stop working.
- In your system, add a PACT data source (some systems call this a supplier connection or a PACT endpoint) with the values from the page:
- Base URL: the address your system reads footprints from, for example `https://api.sustained.com/impact/pact`.
- Token URL: where your system exchanges the client ID and secret for an access token, the base URL followed by `/auth/token`.
- Scope: `pact/read`.
- Client ID and client secret: the credentials of your connection.
- Your system authenticates with the OAuth2 client credentials flow (the client ID and secret as HTTP Basic credentials against the token URL, `grant_type=client_credentials`), then lists footprints at `/3/footprints` under the base URL and reads one at `/3/footprints/{id}`. Every footprint the company has published is visible to you; there is no per-product selection on a share.
If you are connecting by hand rather than through a PACT system, the same three calls work from any HTTP client. Sustained also supports the PACT action events (RequestCreated and the fulfilled and rejected replies) at `/3/events`.
The company that shared with you can revoke the share at any time, after which the client ID stops authenticating.
If you are sharing your footprints
Sharing needs the GHG Protocol add-on on your account, and the person sharing must be a Global admin or have "PACT sharing" switched on for them under Settings, then Company, then Users.
Publish first. A share gives the buyer every footprint you have published, so publish the products they should see. On a product's GHG Protocol report, the PACT section shows the draft footprint and any gaps; Publish to PACT freezes it. On the Sold products list, select products (or set a filter and select nothing) and choose Publish to PACT to publish them in one go: products with a blocking gap are skipped and listed with the reason, products whose footprint has not changed since the last publish are left as they are. Publishing a product again deprecates its previous footprint and links the two, as the PACT specification asks. Recalculating a product never publishes on its own.
Then share. Go to Settings, then Company, then PACT sharing.
- Share with a buyer: enter the buyer's email address and organisation. Sustained creates a connection for that buyer and emails them the connection details with a one-time link to the secret. You never see or handle the secret.
- The list shows each share with its status: *Invited* until the buyer opens the link, *Active* once they have, *Revoked* after you revoke it.
- Send a new link rotates the connection: a new client ID and secret, a new email to the buyer, and the old credentials stop working at once. Use it when a buyer lost the secret, the link expired, or you want to reset their access.
- Revoke removes the buyer's access. The row stays in the list for the record.
A share created for you by the Sustained team (before self-serve sharing existed, or on your behalf) appears in the list too, marked as set up by Sustained.