Customer

The account this credential belongs to, plus the companies it reaches. restricted is true for a credential confined to particular companies; such a credential reads the account's id, name and status only, because the remaining fields describe the account holder's own corporate identity and billing rather than anything about the companies under it.

Response Body

Owner only. Starts building a zip of everything the account holds: companies, participants, document metadata and payloads, and the audit trail. Returns {export: {id, status}}; poll GET .../export/{exportId} until it carries a download link. Large accounts take a while.

Response Body

Owner only. {export: {id, status, downloadUrl?, expiresAt?, error?}}. downloadUrl is present only once status is DONE and within its 24h TTL.

Path Parameters

Response Body

Owner or company admin; an ordinary member is refused. Each key carries permissions: an array of read/send/receive/manage. A company admin sees only the keys confined to its own companies, never the account-wide ones. ?companyId narrows to one company; a key confined to no company reaches the whole account and stays in view whichever company is asked for.

Response Body

Owner or company admin. companyId confines the key to one company; leaving it out produces a key that reaches every company under the account, which only an owner may create. permissions is an array of read/send/receive/manage; omitted or empty means all four. Calling a route the key lacks the permission for is 403 PERMISSION_DENIED. The key itself is in the response and is never shown again.

Response Body

Owner or company admin, the latter only for a key confined to one of its own companies. Revoking is immediate and cannot be undone.

Path Parameters

Response Body

{email}. Always 204, whether or not the address belongs to a user, so that the response cannot be used to discover who has an account.

Response Body

Response Body

Response Body

Signs in with an OIDC token from the account's identity provider. 401 SSO_NOT_LINKED — distinct from the generic UNAUTHORIZED — means the token is valid but no user here is linked to it yet; link the identity after signing in with a password.

Response Body

Unauthenticated. Returns {publicKey}, the options the browser passes to navigator.credentials.get(), with the challenge and every credential id base64url-encoded. The challenge is single-use and lives five minutes. allowCredentials is empty by design: passkeys here are discoverable, so the authenticator names the account and this route reveals nothing about who has one.

Response Body

Unauthenticated: {id, authenticatorData, clientDataJSON, signature, userHandle}, all base64url. Returns the same {token, expiresAt, user} a password login does. Every verification failure is one 401 UNAUTHORIZED, except 401 PASSKEY_CLONE_DETECTED — the authenticator's signature counter went backwards, and the passkey should be removed rather than retried.

Response Body

{token, password}. A token that is unknown, expired, already used, or whose user can no longer sign in is 400 RESET_TOKEN_INVALID — its own code, so a client can offer a fresh link without reading the message.

Response Body

Creates an account (the contract party), its first company (the account's own legal entity unless a company object says otherwise) and the first owner: {account:{name?,legalName,countryCode,registrationNumber?,vatNumber?}, company?:{name?,identifier?,countryCode?,registrationNumber?,vatNumber?}, owner:{name?,email,password}, bootstrapToken?}.

Response Body

What the account's companies cost, per month. Answers the owner, a user holding the billing.view grant (PATCH /v1/users/{id}) and a desk session; everyone else, every API key included, gets 403 FORBIDDEN. A user confined to some companies sees only those companies, and every month, line and total is summed over them alone (scope: "companies"). ?companyId narrows the report further to the companies named — repeated (?companyId=a&companyId=b) or comma-separated (?companyId=a,b) — and every month, line and total (yearToDate and sinceStart included) is then summed over those alone, with scope: "companies" and companyIds echoing the selection; an empty ?companyId= is no filter. It only narrows what the caller already sees: a company outside the caller's scope, or one that does not exist, is 404 NOT_FOUND, as on every customer route that takes a companyId. ?period=2026-09 or 2026-Q3, or ?from=2026-01&to=2026-09 (at most 120 months); with none of them, the year to date. months[] has one entry per month with state locked (frozen when the basis was taken out), draft (ended and measured, not yet locked), running (this month, counted live), unmeasured (ended before anything measured it: no numbers) or future, and companyMonths, participantMonths, messages, outboundMessages, inboundMessages, amountMinor, pricedAmountMinor and priceMissing. companies[] gives the same per company and per company and month; lines[] the period's price lines, unit price × quantity = amount. totals has period, yearToDate and sinceStart (from the first measured month), each with its from and to. Amounts are integer minor units of currency. A month without a price keeps its counts and has priceMissing: true with amountMinor null — never 0 — and so does every sum that includes it; pricedAmountMinor is the priced part. outboundMessages and inboundMessages are null where the split is not known (the metering rows behind an old month may have been archived), and always in the yearToDate and sinceStart totals. Sandbox companies are free and appear nowhere. ?format=csv gives one row per month and company: month,state,companyId,company,companyMonths,participantMonths,messages,outboundMessages,inboundMessages,amountMinor,amount,priceMissing,currency.

Query Parameters

Response Body

?q matches name, identifier, id, registration number and VAT number, case-insensitively. Without ?limit or ?cursor the whole matching list comes back at once; pass either and cursor pagination applies, with nextCursor set while more remains.

Query Parameters

Response Body

Owner, or an account-wide API key with manage. Adds a legal entity under the account. Empty countryCode inherits the account's; an omitted identifier is derived from the name. When the account is expected to do KYC the response carries onboarding: {url, expiresAt}, a hosted onboarding link to hand the company — see POST /v1/companies/{id}/kyc/onboarding-link. Participants under a company that has not completed KYC wait for operator approval. sandbox: true makes a sandbox company: its participants are local only (never on the Peppol network) and are created READY without operator approval, it gets no KYC onboarding link, and POST /v1/companies/{id}/test-inbound may simulate documents arriving at it; only an operator changes the flag afterwards.

Response Body

Path Parameters

Response Body

Owner, or an account-wide API key with manage. name, identifier (409 IDENTIFIER_TAKEN on collision), countryCode, registrationNumber, vatNumber. A company verified through KYC refuses a new registrationNumber or countryCode with 409 KYC_LOCKED. sandbox cannot be changed here.

Path Parameters

Response Body

Owner, or an account-wide API key with manage — the same callers as POST and PATCH. Allowed once every participant of the company is DEACTIVATED (deactivate them with DELETE /v1/participants/{id} first), and always for a company that has none; otherwise 409 COMPANY_NOT_DEREGISTERED. The company is closed (queued outbound dropped, as on close), its DEACTIVATED participants are deleted with it, API keys confined to it are revoked and SFTP logins confined to it disabled, and it frees its identifier for a new company. It then disappears from GET /v1/companies and every other list, and GET /v1/companies/{id} answers 404 — as does a second DELETE. The deletion is soft: documents, usage and billing keep naming the company, and audit records COMPANY_DELETED plus PARTICIPANT_DELETED per participant. 204 No Content.

Path Parameters

Response Body

The company's latest KYC case: {kyc: {id, status, method, source, orgNumber, legalName, persons, signatoryRule, signatures, requiresReview, companyVerified, ...}}. status is NOT_STARTED, PENDING_SIGNATURES, MANUAL_REVIEW, VERIFIED, REJECTED, EXPIRED or WITHDRAWN; a company that never started has only companyId, status, method, countryCode, required and companyVerified. required is false when the account is exempt from KYC: offer it as optional rather than as a step to finish. Nothing is blocked either way. method is "register" where a register extract is uploaded (Sweden: a Bolagsverket registreringsbevis) and "manual" elsewhere. companyVerified stays true while a newer case is in progress. 501 KYC_NOT_CONFIGURED when the deployment has no KYC.

Path Parameters

Response Body

Owner session only; an API key gets 403 KYC_USE_ONBOARDING_LINK. {objectKey} for a country with a register (method "register"), or {manual: {orgNumber, legalName, address?, signatoryText?}} for any other. A Swedish extract must be the PDF Bolagsverket issued, sealed by Bolagsverket over every byte and sealed within the last 90 days: 400 KYC_DOCUMENT_NOT_SEALED (no seal, or the file was changed after sealing — a scan or a re-saved copy), KYC_DOCUMENT_NOT_FROM_REGISTER, KYC_DOCUMENT_TOO_OLD, and KYC_ORG_NUMBER_MISMATCH when it is for another registration number than the company's. An authentic extract whose firmateckning cannot be read with confidence is accepted with requiresReview true. Starting a case ends any case still open; a verified company stays verified until the new case is. 400 KYC_MANUAL_REQUIRED for objectKey in a country without a register.

Path Parameters

Response Body

Owner, or an account-wide API key with manage. kind is agreement (the version the signatories were sent) or signed-agreement (that agreement followed by the signature appendix: who signed, when, from which address). From the case that verified the company, or else its latest case; 404 until there is one. The PDF comes back as an attachment with its SHA-256 in X-Content-SHA256, and the read is audited as KYC_DOCUMENT_READ.

Path Parameters

Response Body

Owner, or an account-wide API key with manage. Returns {onboarding: {url, expiresAt}}: a link, valid 30 days, that lets whoever holds it do the company's KYC on our hosted page — upload the registreringsbevis (or enter a foreign company), choose who signs — without an account here. Issuing one ends the previous link for the company. This is how a platform integrating through an API key gets its customers through KYC: the key itself is refused on the KYC routes with 403 KYC_USE_ONBOARDING_LINK.

Path Parameters

Response Body

Owner session only (an API key gets 403 KYC_USE_ONBOARDING_LINK), on a case in PENDING_SIGNATURES. With a signatory rule: {alternative, signers: [{personId, email}]}, where alternative indexes signatoryRule.alternatives (clauses naming individuals are listed in signatoryRule.notOffered and cannot be chosen) and the chosen persons must bind the company under it (400 KYC_SIGNATORIES_INSUFFICIENT otherwise). Without one (requiresReview): {signers: [{name, role?, email}]}. Every signer needs their own email address. Each gets a personal link valid 14 days; calling again replaces the earlier choice and ends its unsigned links, and someone who already signed is not asked again. 409 KYC_NO_AGREEMENT when no agreement version is published. When mail cannot be sent, unsentLinks carries the links to pass on another way.

Path Parameters

Response Body

Owner session only; an API key gets 403 KYC_USE_ONBOARDING_LINK. {size} in bytes, at most 5 MiB. Returns {objectKey, uploadUrl, expiresAt, headers}: PUT the PDF to uploadUrl with exactly the headers in headers (Content-Type: application/pdf) and a body of exactly size bytes (the URL is signed over both), then pass objectKey to POST /v1/companies/{id}/kyc. An upload not submitted within a day is deleted, and so is one that is refused; an accepted one is filed with the case.

Path Parameters

Response Body

Owner, or an account-wide API key with manage. For a company created with sandbox: true only (409 NOT_SANDBOX otherwise), in production as well. {receiver, sender?, type | documentTypeId+processId, payload, as4MessageId?}: the document runs the real inbound path — validation, storage, webhooks, pull — as a test injection (TEST_INBOUND_INJECTED). receiver must be one of this company's participants; a sandbox company's participants are always local, so a simulated document never shares a mailbox with a real one. Sender, receiver and type may be left out when the payload is an SBD that carries them. Rate limited per account.

Path Parameters

Response Body

Unauthenticated: a single-use handoff token is itself the credential. A reused or expired token is 401 UNAUTHORIZED.

Response Body

Every file uploaded to out/ over SFTP for the companies this credential reaches, newest first, and what became of it — including the ones that were refused and so never became a message. Returns {files: [{id, accountId, companyId, companyName?, accountName?, path, fileName, sizeBytes, sha256, status, reason?, detail?, documentId?, attempts, createdAt, updatedAt}], nextCursor?}. status is queued (waiting, possibly after a transient failure that reason names), processing, sent (became a message and was filed under out/sent/; the message's own status says how far it got) or failed (filed under out/failed/). A failed file carries reason and detail, the same two things written to its .error.json; when it became a message that will not be sent — it failed validation — documentId names it too. path is relative to the account's SFTP root and is where the file was uploaded, not where it was moved. Filter with ?status (one of the four; anything else is 400 VALIDATION_FAILED), ?companyId, ?from and ?to (on createdAt); page with ?cursor and ?limit (default 50, at most 100).

Query Parameters

Response Body

One entry of GET /v1/files. A file of a company this credential does not reach is 404, like an id that does not exist.

Path Parameters

Response Body

Unauthenticated: {token, alternative?, signers}. Same as POST /v1/companies/{id}/kyc/signatories.

Response Body

Unauthenticated: {token, objectKey} or {token, manual: {…}}. Same validation and responses as POST /v1/companies/{id}/kyc.

Response Body

Unauthenticated: {token, size}. Same as POST /v1/companies/{id}/kyc/uploads for the link's company.

Response Body

Unauthenticated: {token} from a hosted onboarding link is the credential, for the one company it was issued for. Returns {company: {name, countryCode, registrationNumber}, kyc: …}, the same kyc object as GET /v1/companies/{id}/kyc. An unknown, replaced or expired link is 400 KYC_ONBOARDING_LINK_INVALID.

Response Body

Unauthenticated: {token}. The case stays open; the company's owner can choose other signatories. 204.

Response Body

Unauthenticated: {token, typedName, accept: true}. Records the signature with the time, the client address and user agent, and the agreement's SHA-256, consuming the token. When the signatures on the case bind the company under its firmateckning the case becomes VERIFIED; a case without a readable firmateckning goes to MANUAL_REVIEW once everyone asked has signed. Returns {status}, the case status afterwards. 400 KYC_SIGNING_LINK_INVALID as for view.

Response Body

Unauthenticated: {token} from the mailed link is the credential, sent in the body so it never reaches an access log. Returns the company, the signer's name and role, the agreement version with its SHA-256, and a short-lived download url for the exact PDF being signed. An unknown, used, declined or expired token, or one whose case is no longer waiting for signatures, is 400 KYC_SIGNING_LINK_INVALID.

Response Body

The signed-in user. session reports {authMethod: "password"|"sso", issuer, provider}, describing how they signed in; it is absent for an API key. Reachable even while user.mustChangePassword is true, when every other route is refused — so a client can tell why it is being refused. canViewBilling says whether GET /v1/billing will answer this caller: true for an owner, a user holding the billing.view grant, and a desk session; false for every API key.

Response Body

Documents belonging to the companies this credential reaches; ?companyId narrows to one. ?q matches the sender and receiver participant from the start of the value, case-sensitively, or the document id exactly — never a substring in the middle. ?counts=true without an explicit ?from covers the last 30 days rather than the account's whole history. ?type is an alias from the register (invoice, credit-note, …), which names a document type and process together, or a raw documentTypeId. ?outcome is one of the statistics outcomes and stands for a set of statuses: delivered (AS4_ACCEPTED, CUSTOMER_DELIVERED), failed (SEND_FAILED, DISCOVERY_FAILED, REJECTED, VALIDATION_UNAVAILABLE, VALIDATION_ERROR, CUSTOMER_DELIVERY_FAILED), invalid (VALIDATION_FAILED, BUSINESS_INVALID), pending (every other status) and parked, which matches no document: a parked payload never became one. ?status still applies inside ?outcome. ?source is network or test. ?sandbox is exclude (leave sandbox companies' documents out), only (just theirs) or include (both, the default when it is absent). All four narrow ?counts=true and format=csv as well, so with the same from/to days, scope, type, outcome and source, and sandbox=exclude unless the statistics were asked with includeSandbox=true, its per-status counts add up to the statistics' count. An unknown outcome, source or sandbox value is 400 VALIDATION_FAILED.

Query Parameters

Response Body

202 with status QUEUED_VALIDATION is the usual answer: the document is checked against the Peppol rules after this request returns, not inside it, so the verdict is on a later GET rather than here: VALID moves on to sending; VALIDATION_FAILED raises message.outbound.failed on the account's webhooks and is mailed to the company's notification contacts, with the findings on GET /v1/messages/{id}. A document type with no rules to check, sent under a capability that allows unvalidated documents, skips that step and is 201 with status QUEUED. A replayed Idempotency-Key is 200 with the current status. A payload that is a whole Standard Business Document is accepted: the envelope is taken off and the business document inside is what is stored and sent, under the platform's own SBDH. The envelope's sender, receiver, document type and process must then match the request's, or the request is 400 VALIDATION_FAILED. type is a document type alias from the register (invoice, credit-note, order, …); pint-aunz-invoice and pint-aunz-credit-note are Peppol PINT A-NZ, the billing format for Australian and New Zealand receivers, whose documentTypeId is under the peppol-doctype-wildcard scheme rather than busdox-docid-qns. The business document must be what it is sent as: its root element and namespace, its cbc:CustomizationID (exactly) and, when present, its cbc:ProfileID must be the ones documentTypeId and processId name, or the request is 400 VALIDATION_FAILED before anything is stored — a BIS Billing 3.0 invoice sent as pint-aunz-invoice, a PINT invoice sent as invoice, a credit note sent as invoice. A documentTypeId ending in the wildcard indicator * matches no document (BR-PDW-02: * belongs in SMP registrations only). A document that states no CustomizationID among the root's children (CII, non-UBL) is not checked on that point.

Response Body

Body {bytes, companyId?}. Answers {payloadObjectKey, uploadUrl, expiresAt, headers}. The uploadUrl is signed over Content-Type and Content-Length: PUT the document with exactly the headers in headers (Content-Type: application/xml) and a body of exactly bytes long, or the object store answers 403 SignatureDoesNotMatch. Then send the key with POST /v1/messages or check it with POST /v1/validate.

Response Body

deliveryUnconfirmed is true on an outbound SEND_FAILED message whose send outcome the platform could not learn: the receiver may already have it, and it is never resent. Show it as unconfirmed rather than failed, and do not resend it either. mlsEvents lists the Peppol Message Level Status trail, oldest first. An entry with direction INBOUND and status RECEIVED is an MLS the receiving Service Provider sent about this outbound message: responseCode is AP (delivered with confirmation), AB (delivered without) or RE (rejected); description is its text; issues is its line responses [{location, reasonCode, description}] with reasonCode SV, BV, BW or FD, and reasons their distinct codes; receivedAt, mlsId and sender (the SP's 0242 participant) identify it. A message's own status does not change on an MLS. Entries with direction OUTBOUND (PENDING/SENT/FAILED/SKIPPED) are history from before 2026-10-08 and carry none of these fields. The message.mls webhook carries mlsEventId, responseCode, reasons and issues for the entry it announces. recipientStatus, on an outbound message once the receiving Service Provider's MLS has arrived, is that status in one word: CONFIRMED (AP, delivered with confirmation), DELIVERED (AB, delivered without) or REJECTED (RE), with recipientStatusReasons the distinct reason codes of a rejection. Outbound documents ask for a status on every send (MLS_TYPE=ALWAYS_SEND), but a receiving Service Provider that does not support MLS sends none, so an absent recipientStatus means no answer, not a failure.

Path Parameters

Response Body

Path Parameters

Response Body

Path Parameters

Response Body

{companyId?, ids: ["scheme:value", ...]}, at most 100 ids (400 VALIDATION_FAILED naming the cap above that, or on an empty list). Looked up concurrently, capped at 8 against SMP. Returns {results: [{id, status: OK|INVALID|ERROR, canonicalId?, exists?, smpUrl?, capabilities?, error?}]}, one entry per id in the same order, even when some ids fail: INVALID is a malformed id (no SMP call made), ERROR is a failed SMP call, and OK carries exists (false is a normal, common answer, not an error).

Response Body

?q is either a full Peppol id, looked up exactly (response mode "id"), or free text tried as a national registration number against every scheme we know a format rule for and, where the Peppol Directory is available, as a name or number query against it (mode "search"). Search results are confirmed hits only: a candidate that does not parse, is not registered, or returns no Directory match all give zero rows rather than a not-found entry — unlike "id" mode, whose exists:false is definitive, a search miss only means this route did not find them. directoryConfigured says whether the Directory was consulted, so an empty result can be explained as "they may simply never have published a business card".

Response Body

Path Parameters

Response Body

Path Parameters

Response Body

Every participant under the companies the principal reaches; ?companyId narrows to one of them. ?status and ?q (scheme:value, canonicalId, name, identifier) filter in memory like the admin list. ?counts=true adds a status breakdown for the account (scoped by companyId when given).

Query Parameters

Response Body

Optional capabilities: an array of {documentTypeId, processId, direction, allowUnvalidated}, the same element shape as POST /v1/participants/{id}/capabilities, document type aliases included ({"type": "invoice"} or {"documentTypeId": "invoice"}). Created in the same transaction as the participant. Omitted = no capabilities, matching pre-existing behaviour. A Peppol id another live participant holds, on any account, is 409 CONFLICT; one whose participant is DEACTIVATED is free to register again (DEACTIVATING still holds it until the SMP entry is gone).

Response Body

Path Parameters

Response Body

Path Parameters

Response Body

On any status but DEACTIVATED it deactivates and returns the participant: one with anything in SMP becomes DEACTIVATING and stays published for the unpublish grace, anything else becomes DEACTIVATED. On a participant already DEACTIVATED it deletes it instead and answers 204 No Content: the participant leaves every list and count, GET /v1/participants/{id} answers 404, and its identifier is free again in its company. Calling DELETE until it answers 204 therefore takes a participant all the way off. The deletion is soft — documents, usage and billing keep pointing at it — and is audited as PARTICIPANT_DELETED. Participant responses carry deletedAt, always null on the customer API.

Path Parameters

Response Body

Filter with ?eventType, ?q (substring over actor and metadata), ?from/?to. Each row carries actorName and, where the event has one, targetType/targetId/targetName/targetSub (A8) — no targetHref, since this surface has no admin pages to link a company/account/login target to.

Path Parameters

Query Parameters

Response Body

The business card published to the Peppol Directory for this participant: {participantId, custom, entities: [{names: [{name, language?}], countryCode, geographicalInformation?, identifiers: [{scheme, value}], websites: [url], contacts: [{type?, name?, phoneNumber?, email?}], additionalInformation?, registrationDate?}]}. custom is false when no card has been set and entities is the default built from the company's name and country — what is published until a card is PUT.

Path Parameters

Response Body