Overview
One connection to the Peppol network, for platforms and for the businesses they serve.
Business Gateway is a Peppol access point. You send a document to us and we deliver it to the recipient's access point; documents addressed to you arrive here and we hand them over. The Peppol side — discovery, signing, AS4, the SMP registration that makes an address reachable — is ours.
The API is at https://api.businessgateway.se. JSON, UTF-8. Times are RFC 3339 in UTC. Ids are UUIDs. Peppol ids are written scheme:value, for example 0007:5561234567.
Two ways to read this
For platforms
You connect your own customers. Onboard a business, register its Peppol address, send and receive on its behalf.
For businesses
You were given credentials by your software vendor or by us. Exchange documents over the API or over SFTP.
The two are the same API. What differs is how much of it you use: a platform creates and administers the businesses underneath it, a business works inside one of them.
How the pieces fit
An account is who holds the contract with us. It owns one or more companies, and a company is the isolation boundary: documents, credentials and file directories all belong to exactly one. Each company owns the Peppol participants — the addresses other businesses send to.
That shape covers both cases without changing.
| You are | Your account is | Its companies are |
|---|---|---|
| A software platform, bureau or group | One account, yours | Each business you serve |
| A single business | One account, yours | Usually just the one |
A platform holds one account with many companies under it and administers them all. A business it serves works inside one company and cannot see the others — the same API, a credential that reaches less of it.
What a document does here
Outbound, you submit a document and get an id back immediately. Validation against the Peppol rules runs after that, not inside your request, so a submission is accepted before the verdict exists. The verdict reaches you on a webhook or on a later read.
Inbound, a document arrives from the network, is validated, and is then held for you until you take it — over the API, over SFTP, or by acting on the webhook that announced it. Nothing is deleted because you were slow to collect it.
Documents are addressed to Peppol participants, never to companies or accounts. A participant has to be registered and active before anything can be sent from it or delivered to it, and registration is not instant — see Registering a Peppol address.