Skip to main content
The Admin API is available only to resellers that have an organisation API key. For invoice operations with a tenant API key, see Create e-invoices.

Overview

A reseller uses the Admin API to manage tenants. A tenant is a company that a reseller manages. With the Admin API you can:
  • create, read, update and delete tenants
  • issue, read, rename and revoke the API keys of a tenant
  • register a tenant on the Peppol network, or keep the tenant send-only
  • put a test document in the inbox of a test-mode tenant
The admin operations are not in the OpenAPI specification, so the generated API reference has no pages for them. This page is the reference.

Endpoint overview

All paths are on the host https://api.e-invoice.be.

Authentication

Send the organisation API key as a bearer token. A tenant API key does not give access to the Admin API.
The samples on this page read the organisation API key from the environment variable E_INVOICE_ORG_API_KEY. Samples that use a tenant API key read it from E_INVOICE_API_KEY. An organisation API key gives access only to the tenants of that organisation. A request for a tenant of a different organisation returns 404 Not Found.
Only approved resellers get an organisation API key. Send an email to support@e-invoice.be to apply for the reseller programme.

Health check

GET /api/admin/ping shows that the Admin API is available. This request needs no authentication.

Tenant management

List tenants

Get the tenants of your organisation, newest first. Deleted tenants are not in the list.
integer
default:"0"
Number of tenants to skip.
integer
default:"100"
Maximum number of tenants to return.
total is the number of tenants that are not deleted, not the number of tenants in this page.

Create a tenant

string
required
Name of the tenant. The name must be unique in your organisation. A name that a tenant of your organisation already has gives 409 Conflict.
string
Free text that describes the tenant.
string[]
The Peppol ID of the tenant in the form scheme:identifier. The tenant cannot send documents without it. The field is an array, but the platform uses one Peppol ID for each tenant.
string
Company registration number from the national business register. For Belgium this is the CBE number, for example 1018265814.
string
VAT or tax number with the country prefix, for example BE1018265814.
string[]
IBANs of the tenant. No default.
string
default:"enterprise"
Plan of the tenant: starter, pro or enterprise. See Plans and credits.
integer
default:"999999999"
Credit balance of the tenant. See Plans and credits.
The request also accepts the company fields company_name, company_address, company_zip, company_city, company_country and company_email. All of them are optional strings. The response has the status 201 Created:
You must find and set the correct Peppol ID for each tenant. The API does not validate peppol_ids when you create or update a tenant. Creating a tenant does not register the Peppol ID on the Peppol network; see Register on Peppol.
A tenant that you create with the organisation API key of a test-mode organisation is a test-mode tenant. You cannot change the test mode of a tenant after you create it. See Test mode and sandbox companies.

Tenant response fields

Each tenant operation returns the request fields above and these fields:
string
Identifier of the tenant. Use it as tenant_id in the paths.
string
Date and time when the tenant was created.
string
Date and time of the last change.
boolean
Whether the tenant is registered on the SMP (Service Metadata Publisher) of e-invoice.be.
string | null
Date and time of the registration on the SMP.
string | null
Email address of the tenant at outbox.email.e-invoice.be. The create and get operations fill this field.
string
Activation state of the tenant for its destination network: not_required, not_enrolled, pending, enrolled or failed. A tenant that sends through Peppol has not_required and can send immediately.
string | null
The reason when enrollment_state is failed.
string | null
null when the tenant uses the default delivery route for its country.

Company number and tax ID

  • company_number is the registration number from the national business register (Belgium: CBE number, Netherlands: KvK number).
  • company_tax_id is the VAT or tax number with the country prefix (BE1018265814, NL123456789B01).
For a Belgian company, the Peppol ID is 0208: plus the CBE number: For the schemes of other countries, see Look up Peppol participants and Supported schemes.

Why you set the Peppol ID when you create the tenant

The API uses the Peppol ID in peppol_ids for three functions:
  • Sending. The API accepts a send request only when the sender Peppol ID is in the peppol_ids of the tenant. The comparison ignores letter case and spaces at the start and the end.
  • Receiving. Documents for the Peppol ID go to the tenant, after the ID is registered.
  • Registration. Register on Peppol publishes the ID on the SMP and in the Peppol Directory.
Tenant create and tenant update do not write to the SMP or the SML (Service Metadata Locator). Registration is a separate step. Do it when the tenant must receive documents, or do not do it for a send-only tenant.

Get a tenant

The response has the same shape as the response of Create a tenant. This operation also returns a tenant that is deleted.

Update a tenant

Send only the fields that you want to change. The API keeps the value of each field that is not in the request body. The request accepts the same fields as Create a tenant; name is optional here.
The response has the status 200 OK and contains the full tenant:
A new name that a different tenant of your organisation already has gives 409 Conflict.

Delete a tenant

This operation marks the tenant as deleted. It does not remove the data of the tenant.
The response has the status 204 No Content and no body:
Delete does not unregister the tenant from Peppol. Call Unregister from Peppol first when the tenant is registered.

Plans and credits

You set the plan and the credit balance of a tenant with the fields plan and credit_balance of Create a tenant and Update a tenant. These two fields are the only plan and billing functions in the Admin API.
The response is the full tenant with the new values (shortened here):
The tenant sees these values in GET /api/me/. GET /api/stats with the API key of the tenant returns the usage of the tenant and uses credit_balance to calculate budget_estimation_days. See Usage statistics and credits.

API key management

Create an API key

string
required
Name of the API key. The name must be unique among the active API keys of the tenant; a name that is in use gives 409 Conflict.
string
Free text, for example the purpose of the key.
The response has the status 201 Created:
The id field is the API key. There is no separate key field. Your customer sends the value of id as the bearer token:
Keep the id secret. Store it encrypted and give it to your customer through a secure channel. Do not write it to logs, to version control or to client-side code.

List API keys

Get the active API keys of a tenant, newest first. Revoked keys are not in the list.
integer
default:"0"
Number of API keys to skip.
integer
default:"100"
Maximum number of API keys to return.
The id is the bearer token, so the operations that read API keys return live credentials. Limit who can call them, do not write the response body to logs, and do not show it to end users.

Get the latest API key

Get the active API key of a tenant that was created last.
If the tenant has no active API key, the response is 404 Not Found:

Get one API key

Get one API key by its ID. Use this operation to see if a key is active or revoked: unlike the list operation, it also returns a revoked key, with is_deleted: true.
Response for an active key:
Response for a revoked key:
If the key does not exist for this tenant, the response is 404 Not Found:

Update an API key

Change the name or the description of an API key. The id (the bearer token) does not change.
string
New name. A name that a different active key of the tenant has gives 409 Conflict.
string
New description.

Revoke an API key

The response has the status 204 No Content and no body:
After this call, Get one API key returns the key with is_deleted: true.

Rotate an API key

1

Create a new API key

Call Create an API key with a new name. Keep the returned id.
2

Give the new key to your customer

Send the key through a secure channel, or change the configuration that you keep for the customer.
3

Revoke the old key

When the customer uses the new key, call Revoke an API key for the old key. The two keys are valid together until this step, so there is no downtime.

Peppol registration

Peppol registration publishes the Peppol ID of a tenant on the SMP of e-invoice.be, so that the tenant can receive documents through e-invoice.be. A tenant that only sends documents does not need a registration; see Send-only tenants.
The Peppol operations are not available with the organisation API key of a test-mode organisation. The four operations in this section then return 403 Forbidden:

Check the registration status

boolean
default:"false"
Set to true to do a live check on the network. See Verify a registration.
string
e-invoice: the Peppol ID is on the SMP of e-invoice.be. other: the Peppol ID is found on the network, but not on the SMP of e-invoice.be. not_registered: the Peppol ID is not found. A tenant with other or not_registered can send documents.
object
The service group, the business card and the document types on the SMP of e-invoice.be. The three fields are null when the Peppol ID is not on this SMP.
boolean
true when this request did a live check (verify=true).
object[]
One entry for each Peppol ID of the tenant. state is not_published, pending or published and comes from the last recorded event for the ID. latest_event, source, detail and observed_at describe that event; they are null when the ID has no events.
If the tenant has no Peppol ID, the response is 400 Bad Request:

Verify a registration

Without verify, the publications field comes from the events that the API recorded before (for example at registration). With verify=true, the API first does a live DNS lookup for each Peppol ID of the tenant, records the result as a new event, and then returns the status.
The response has the same shape as Check the registration status. verified is true, and each publication shows the result of the live check (the smp object is shortened here):
When the live check does not find the Peppol ID on the SMP of e-invoice.be, the publication has state: "not_published" and latest_event: "not_found_on_smp".
A request with verify=true adds events to the registration history of the tenant. Use it after a registration or when you examine a problem, not for frequent polling.

Register on Peppol

string
required
Peppol ID to register, in the form scheme:identifier. The scheme must be one of the supported schemes. The API changes the ID to lower case and removes spaces at the start and the end.
boolean
default:"false"
Set to true to do all checks and make no change on the SMP. See Dry run.
The API does these steps:
  1. It checks the scheme and the format of the identifier.
  2. It looks for the Peppol ID on the network. An ID that is active at a different access point gives 409 Conflict.
  3. It creates the service group on the SMP.
  4. It adds the six default document types: invoice, credit note, self-billing invoice, self-billing credit note, invoice response and message level response.
  5. It adds a business card. For a Belgian Peppol ID, the company data comes from the KBO (Crossroads Bank for Enterprises).
The response has the status 200 OK:
For a Belgian Peppol ID, company_data also contains the KBO fields status, juridical_situation, type_of_enterprise, juridical_form, start_date and address_type. For other countries, company_data contains only company_number; the other fields are null. The operation is idempotent. If the Peppol ID is already on the SMP of e-invoice.be, registration.method is already_exists and the API makes no new service group.

Dry run

With "dry_run": true, the API does the checks of a registration (scheme, identifier format, lookup on the network, KBO lookup for Belgium) and makes no change on the SMP. Use it to find an incorrect or already registered Peppol ID before the real registration.
In a dry run, registration.registered is true although nothing is registered. Read business_card.dry_run and document_endpoints.dry_run to identify a dry-run response. A dry run does not add events to publications.
For a test-mode tenant, the API always does a dry run, whatever the value of dry_run. Update the business card and Unregister from Peppol return {"success": true} for a test-mode tenant and make no change on the SMP.

Supported schemes

Registration accepts a Peppol ID only when its scheme is in this list. The list is smaller than the list of schemes that you can send to. Schemes of other countries (for example Germany, Austria, Italy and Luxembourg) and the Belgian VAT scheme 9925 are not accepted. French schemes need a separate enrolment; send an email to support@e-invoice.be. A scheme that is not supported gives 400 Bad Request:
The company data lookup (KBO) is for Belgium only. For a Peppol ID of a different country, the API has no company name, so the business card gets only the country of the scheme. The register request has no field for the company name. Set the name with Update the business card after the registration. The scheme codes are from the Peppol participant identifier scheme code list, version 9.1. This is the version that the API uses. For the table of the most frequent schemes that you can send to, see Look up Peppol participants.

Update the business card

Change the company name on the business card of a registered Peppol ID. The name is the only field that you can change.
string
required
Peppol ID of the business card. It must be in the peppol_ids of the tenant; if not, the response is 403 Forbidden.
string
New company name. Include the company type, for example BV or NV.
If the Peppol ID has no business card on the SMP, the response is 400 Bad Request:

Unregister from Peppol

Remove the document types, the business card and the service group of a Peppol ID from the SMP of e-invoice.be. The tenant can then not receive documents through e-invoice.be. It can continue to send documents as a send-only tenant.
string
required
Peppol ID to unregister. It must be in the peppol_ids of the tenant; if not, the response is 403 Forbidden.
The operation is idempotent. If the Peppol ID was already removed, the response is:

Send-only tenants

A tenant can send documents through Peppol without a registration on the SMP and the SML. Use a send-only tenant when the company receives its documents through a different access point, or does not want to receive documents at this time. There is no send_only field. A tenant is send-only because Register on Peppol was not called for it.

Create a send-only tenant

1

Create the tenant

Call Create a tenant and put the Peppol ID in peppol_ids.
2

Create an API key

Call Create an API key for the tenant. The returned id is the bearer token of the tenant.
3

Send documents with the tenant API key

Create a document with POST /api/documents/ and send it. See Create e-invoices. Do not call the register operation.
The response has the status 200 OK and contains the document. This example shows the first fields:
The API does not validate peppol_ids when you create or update a tenant. It accepts an incorrect Peppol ID, for example a 0208 number with 9 digits or with an incorrect check digit. The register operation is the only step that validates the ID, and you do not call it for a send-only tenant. Validate the Peppol ID in your system before you create the tenant.
A French send-only tenant must be enrolled, but it can have zero publications. Send an email to support@e-invoice.be for the enrolment procedure.

What a send-only tenant can do

If the sender Peppol ID (for self-billing documents: the receiver Peppol ID) is not in the peppol_ids of the tenant, the send request fails with 409 Conflict:

Status of a send-only tenant

Check the registration status shows the Peppol ID of a send-only tenant as not published:
state is other when the Peppol ID is registered at a different access point.

Become a receiver later

Call Register on Peppol when the tenant is ready to receive documents. No tenant change is necessary.

Testing

Use the organisation API key of a test-mode organisation to test your integration. Each tenant that you create with this key is a test-mode tenant: its sends go to email, and no Peppol traffic occurs. See Test mode and sandbox companies.

Simulate an inbound document

Put a UBL document in the inbox of a test-mode tenant, as if it was received through Peppol. The API creates the document in the RECEIVED state and sends the document.received webhook event to the webhooks of the tenant.
file
required
UBL invoice or credit note as an XML file. The request is multipart/form-data; a raw XML request body is not accepted. The maximum size is 25 MB.
The response has the status 201 Created:
The API reads the sender and receiver Peppol IDs, the document type and the line items from the UBL. Read the result with GET /api/documents/{document_id} and the tenant API key. For the procedure in the app and for the tenant-side view, see Testing received documents and Receive documents.

Onboarding example

The script below creates a tenant, creates an API key and registers the tenant on Peppol. Remove the registration step for a send-only tenant.

Errors

The Admin API returns errors as JSON with a detail field. For the general error model, see Errors and troubleshooting. Example of a 422 response:

Best practices

  • The id of an API key is the bearer token. Keep it secret from the moment that you receive it.
  • Do not write organisation API keys or tenant API keys to logs.
  • Store tenant API keys encrypted.
  • Give keys to customers only through a secure channel.
  • Rotate keys at regular intervals. See Rotate an API key.
Use tenant names that you can calculate from your own data, for example cust-<your customer ID> or a slug of the company name. The API refuses a second active tenant with the same name (409 Conflict), which helps you to prevent duplicates.
If Create a tenant returns 409 Conflict, the tenant exists. Get it from List tenants and continue with the next step. Register on Peppol and Unregister from Peppol are idempotent, so you can repeat them after a network error.
Record each admin operation in your system: the operation, the tenant ID, the user and the time. Do not record API keys.
Validate the Peppol ID in your system, then call Register on Peppol with "dry_run": true. Do the real registration only when the dry run is successful.

Rate limits

Rate limits apply to each API key on write and validation endpoints. See Errors and troubleshooting. When you exceed a limit, the API returns 429 Too Many Requests with a Retry-After header. Obey Retry-After and use exponential backoff when you do operations for many tenants.

Support

For access to the Admin API or for technical questions, send an email to support@e-invoice.be.

Next Steps

Reseller programme

Learn how to become a reseller and get an organisation API key.

Create e-invoices

Send documents with the API key of a tenant.

Test mode and sandbox companies

Test mode, sandbox companies and simulated inbound documents.

Usage statistics and credits

Read the usage of a tenant with its API key.