Overview

You have one account with us. Every business you connect becomes a company under it, and you administer them all with one credential.

That means you never provision infrastructure per customer. Onboarding a business is four API calls, and from then on you either exchange documents on its behalf or hand it its own credentials and let it talk to us directly.

Your credential

An API key created without companyId reaches every company under your account. Only an account owner can create one, and it is the key your integration uses.

curl -sS -X POST https://api.businessgateway.se/v1/api-keys \
  -H "X-API-Key: $KEY" -H 'Content-Type: application/json' \
  -d '{"name":"platform integration"}'

The key is shown once, in the create response. Keys start with pap_ and go in X-API-Key.

Because that key reaches several companies, every request about one company has to say which — companyId in the body or the query string. Leave it out and you get 400 COMPANY_REQUIRED rather than a guess. The exception is sending: a document is submitted from a participant, and the participant already determines the company.

What you do

Onboarding a business

Create the company, register its Peppol address, declare what it can exchange, issue its credentials.

Sending

Submit documents on behalf of any company under your account.

Receiving

Take delivery of inbound documents, one webhook per company or one for everything.

Giving a business its own access

You do not have to broker every document. A company under your account can be given credentials confined to itself:

An API key with companyId reaches that company and nothing else. Wrong-company ids answer 404, the same as ids that do not exist — a scoped key cannot map out what else your account holds.
An SFTP login confined to a company, for businesses whose systems write files rather than call APIs.
A user with the company_admin role, who signs in to the console and sees only their own company.

What they get is the For businesses half of these docs. Your account-wide keys, logins and webhooks stay invisible to them.

Decide this per customer, not once. A large ERP customer may want its own API key and never touch you for document exchange; a small one may be happier if you keep brokering. Both work at the same time under the same account.