Customer

The account this credential belongs to, plus the companies it reaches. restricted is true for a credential confined to particular companies; such a credential reads the account's id, name and status only, because the remaining fields describe the account holder's own corporate identity and billing rather than anything about the companies under it.

Response Body

Owner only. Starts building a zip of everything the account holds: companies, participants, document metadata and payloads, and the audit trail. Returns {export: {id, status}}; poll GET .../export/{exportId} until it carries a download link. Large accounts take a while.

Response Body

Owner only. {export: {id, status, downloadUrl?, expiresAt?, error?}}. downloadUrl is present only once status is DONE and within its 24h TTL.

Path Parameters

Response Body

Owner or company admin; an ordinary member is refused. Each key carries permissions: an array of read/send/receive/manage. A company admin sees only the keys confined to its own companies, never the account-wide ones. ?companyId narrows to one company; a key confined to no company reaches the whole account and stays in view whichever company is asked for.

Response Body

Owner or company admin. companyId confines the key to one company; leaving it out produces a key that reaches every company under the account, which only an owner may create. permissions is an array of read/send/receive/manage; omitted or empty means all four. Calling a route the key lacks the permission for is 403 PERMISSION_DENIED. The key itself is in the response and is never shown again.

Response Body

Owner or company admin, the latter only for a key confined to one of its own companies. Revoking is immediate and cannot be undone.

Path Parameters

Response Body

{email}. Always 204, whether or not the address belongs to a user, so that the response cannot be used to discover who has an account.

Response Body

Response Body

Response Body

Signs in with an OIDC token from the account's identity provider. 401 SSO_NOT_LINKED — distinct from the generic UNAUTHORIZED — means the token is valid but no user here is linked to it yet; link the identity after signing in with a password.

Response Body

Unauthenticated. Returns {publicKey}, the options the browser passes to navigator.credentials.get(), with the challenge and every credential id base64url-encoded. The challenge is single-use and lives five minutes. allowCredentials is empty by design: passkeys here are discoverable, so the authenticator names the account and this route reveals nothing about who has one.

Response Body

Unauthenticated: {id, authenticatorData, clientDataJSON, signature, userHandle}, all base64url. Returns the same {token, expiresAt, user} a password login does. Every verification failure is one 401 UNAUTHORIZED, except 401 PASSKEY_CLONE_DETECTED — the authenticator's signature counter went backwards, and the passkey should be removed rather than retried.

Response Body

{token, password}. A token that is unknown, expired, already used, or whose user can no longer sign in is 400 RESET_TOKEN_INVALID — its own code, so a client can offer a fresh link without reading the message.

Response Body

Creates an account (the contract party), its first company (the account's own legal entity unless a company object says otherwise) and the first owner: {account:{name?,legalName,countryCode,registrationNumber?,vatNumber?}, company?:{name?,identifier?,countryCode?,registrationNumber?,vatNumber?}, owner:{name?,email,password}, bootstrapToken?}.

Response Body

?q matches name, identifier, id, registration number and VAT number, case-insensitively. Without ?limit or ?cursor the whole matching list comes back at once; pass either and cursor pagination applies, with nextCursor set while more remains.

Query Parameters

Response Body

Owner only. Adds a legal entity under the account; participants under it still need operator approval. Empty countryCode inherits the account's; an omitted identifier is derived from the name.

Response Body

Path Parameters

Response Body

Owner only. name, identifier (409 IDENTIFIER_TAKEN on collision), countryCode, registrationNumber, vatNumber.

Path Parameters

Response Body

Unauthenticated: a single-use handoff token is itself the credential. A reused or expired token is 401 UNAUTHORIZED.

Response Body

The signed-in user. session reports {authMethod: "password"|"sso", issuer, provider}, describing how they signed in; it is absent for an API key. Reachable even while user.mustChangePassword is true, when every other route is refused — so a client can tell why it is being refused.

Response Body

Documents belonging to the companies this credential reaches; ?companyId narrows to one. ?q matches the sender and receiver participant from the start of the value, case-sensitively, or the document id exactly — never a substring in the middle. ?counts=true without an explicit ?from covers the last 30 days rather than the account's whole history.

Query Parameters

Response Body

202 with status QUEUED_VALIDATION is the usual answer: the document is checked against the Peppol rules after this request returns, not inside it, so the verdict arrives on a webhook or a later GET rather than here. A document type with no rules to check, sent under a capability that allows unvalidated documents, skips that step and is 201 with status QUEUED. A replayed Idempotency-Key is 200 with the current status.

Response Body

Response Body

Path Parameters

Response Body

Path Parameters

Response Body

Path Parameters

Response Body

{companyId?, ids: ["scheme:value", ...]}, at most 100 ids (400 VALIDATION_FAILED naming the cap above that, or on an empty list). Looked up concurrently, capped at discovery.Parallel (8) against SMP. Returns {results: [{id, status: OK|INVALID|ERROR, canonicalId?, exists?, smpUrl?, capabilities?, error?}]}, one entry per id in the same order, even when some ids fail: INVALID is a malformed id (no SMP call made), ERROR is a failed SMP call, and OK carries exists (false is a normal, common answer, not an error).

Response Body

?q is either a full Peppol id, looked up exactly (response mode "id"), or free text tried as a national registration number against every scheme we know a format rule for and, where the Peppol Directory is available, as a name or number query against it (mode "search"). Search results are confirmed hits only: a candidate that does not parse, is not registered, or returns no Directory match all give zero rows rather than a not-found entry — unlike "id" mode, whose exists:false is definitive, a search miss only means this route did not find them. directoryConfigured says whether the Directory was consulted, so an empty result can be explained as "they may simply never have published a business card".

Response Body

Path Parameters

Response Body

Path Parameters

Response Body

Every participant under the companies the principal reaches; ?companyId narrows to one of them. ?status and ?q (scheme:value, canonicalId, name, identifier) filter in memory like the admin list. ?counts=true adds a status breakdown for the account (scoped by companyId when given).

Query Parameters

Response Body

Optional capabilities: an array of {documentTypeId, processId, direction, allowUnvalidated}, the same element shape as POST /v1/participants/{id}/capabilities. Created in the same transaction as the participant. Omitted = no capabilities, matching pre-existing behaviour.

Response Body

Path Parameters

Response Body

Path Parameters

Response Body

Path Parameters

Response Body

Filter with ?eventType, ?q (substring over actor and metadata), ?from/?to. Each row carries actorName and, where the event has one, targetType/targetId/targetName/targetSub (A8) — no targetHref, since this surface has no admin pages to link a company/account/login target to.

Path Parameters

Query Parameters

Response Body

Path Parameters

Response Body

Path Parameters

Response Body

Path Parameters

Response Body

Path Parameters

Response Body

{passkeys:[{id, name, aaguid, transports, createdAt, lastUsedAt}]} for the signed-in user. An API key has no passkeys and gets 403: a passkey belongs to a person, not to an account.

Response Body

{name, id, attestationObject, clientDataJSON, transports}, the binary members base64url. The challenge must be one issued to this same user, and must not have been used already.

Response Body

Returns {publicKey}: PublicKeyCredentialCreationOptions for the signed-in user, with their existing credentials in excludeCredentials so one authenticator cannot hold two passkeys for the same account.

Response Body

Removing the last one is allowed and needs no confirmation: every user always has a password, so a passkey is an alternative sign-in method rather than the only one.

Path Parameters

Response Body

Response Body

A credential confined to particular companies sees only the logins belonging to them; a login with no company reaches the whole account and is visible only to credentials that do too. ?companyId narrows to one company; an account-wide login stays in view whichever company is asked for.

Response Body

{resetPassword: true} and nothing else: the new password is in the response, once. Changing the authentication method, disabling a login, setting a password directly or moving it between companies is 400 OPERATOR_MANAGED — ask us instead. Owner or company admin, the latter only for a login belonging to one of its own companies.

Path Parameters

Response Body

Response Body

Session principal or API key. For a session, the token's email must match the caller's own account email or the request is refused with 400 SSO_EMAIL_MISMATCH — an API key has no user to match against and keeps the unrestricted automation path.

Response Body

An owner may remove any identity in the account; any other signed-in user only one whose email is their own (403 FORBIDDEN otherwise); an API key keeps the account-wide automation path.

Path Parameters

Response Body

Unauthenticated: {configured, provider, issuer, passkeysEnabled}, so a sign-in page can show or hide the single sign-on button, and label it with the right provider name, before anyone has signed in.

Response Body

Response Body

Response Body

Metered events for the caller's account in [from, to) (default: the last 24 hours): totals per kind and the same per company, for re-billing. ?companyId narrows to one company the principal reaches; format=csv exports accountId,companyId,kind,count.

Response Body

Owner or company admin. An owner sees every user under the account; a company admin sees only the users whose companies lie entirely inside its own, plus itself. ?companyId narrows to the users who reach that company; a user with no confinement reaches every company and stays in view. Every user carries status ("active" | "inactive"); a deactivated one also carries disabledAt, and erasableAt once it can be erased. Only active users are listed unless ?include=inactive; any other value is 400 VALIDATION_FAILED.

Response Body

Owner or company admin. role is one of owner, company_admin, member. companyIds confines the user to those companies; from an owner, empty means every company, an owner can never be confined, and a company admin must name at least one. A company admin may create only a member or another company admin, only within its own companies, and an omitted companyIds then means its own companies rather than the whole account. Leave password out: a random one is generated, the user is flagged mustChangePassword, and a one-time set-password link is emailed. If mail is not available, temporaryPassword comes back once instead, for you to hand over another way.

Response Body

Changing your own password requires currentPassword: wrong is 400 CURRENT_PASSWORD_INVALID, missing is 400 CURRENT_PASSWORD_REQUIRED. It is not required when an owner resets somebody else's. Setting your own password while signed in through single sign-on is refused with 403 PASSWORD_CHANGE_NOT_ALLOWED_FOR_SSO_SESSION. On your own id this is one of the two routes still reachable while mustChangePassword is true, and setting a real password clears the flag without a fresh sign-in. role and companyIds need an owner, or a company admin acting on someone else — never on your own row, so nobody widens their own access. companyIds replaces the user's confinement; omitted leaves it alone, and from an owner, empty means every company. Promoting someone to owner always clears it. A change takes effect on the user's next request. resendInvite is the sibling of resetPassword for a user who never set a password: it mails a 48-hour invitation link rather than the one-hour reset link.

Path Parameters

Response Body

Owner or company admin, the latter only for a user inside its own companies. The first call deactivates: sign-in is refused, sessions and passkeys are deleted, and status becomes "inactive". The last active owner cannot be deactivated (409 LAST_OWNER), nor can you deactivate yourself (400 VALIDATION_FAILED). After the user has stayed deactivated for the grace period — 30 days — a second call erases them permanently instead; 409 USER_NOT_DISABLED, ERASURE_TOO_SOON and ERASURE_NOT_CONFIGURED name the cases where it will not. POST /v1/users/{id}/enable reverses a deactivation.

Path Parameters