Overview
A reseller uses the Admin API to manage tenants. A tenant is a company that a reseller manages. With the Admin API you can:- create, read, update and delete tenants
- issue, read, rename and revoke the API keys of a tenant
- register a tenant on the Peppol network, or keep the tenant send-only
- put a test document in the inbox of a test-mode tenant
Endpoint overview
All paths are on the hosthttps://api.e-invoice.be.
Authentication
Send the organisation API key as a bearer token. A tenant API key does not give access to the Admin API.E_INVOICE_ORG_API_KEY. Samples that use a tenant API key read it from E_INVOICE_API_KEY.
An organisation API key gives access only to the tenants of that organisation. A request for a tenant of a different organisation returns 404 Not Found.
Only approved resellers get an organisation API key. Send an email to support@e-invoice.be to apply for the reseller programme.
Health check
GET /api/admin/ping shows that the Admin API is available. This request needs no authentication.
Tenant management
List tenants
Get the tenants of your organisation, newest first. Deleted tenants are not in the list.integer
default:"0"
Number of tenants to skip.
integer
default:"100"
Maximum number of tenants to return.
total is the number of tenants that are not deleted, not the number of tenants in this page.
Create a tenant
string
required
Name of the tenant. The name must be unique in your organisation. A name that a tenant of your organisation already has gives
409 Conflict.string
Free text that describes the tenant.
string[]
The Peppol ID of the tenant in the form
scheme:identifier. The tenant cannot send documents without it. The field is an array, but the platform uses one Peppol ID for each tenant.string
Company registration number from the national business register. For Belgium this is the CBE number, for example
1018265814.string
VAT or tax number with the country prefix, for example
BE1018265814.string[]
IBANs of the tenant. No default.
string
default:"enterprise"
Plan of the tenant:
starter, pro or enterprise. See Plans and credits.integer
default:"999999999"
Credit balance of the tenant. See Plans and credits.
company_name, company_address, company_zip, company_city, company_country and company_email. All of them are optional strings.
The response has the status 201 Created:
Tenant response fields
Each tenant operation returns the request fields above and these fields:string
Identifier of the tenant. Use it as
tenant_id in the paths.string
Date and time when the tenant was created.
string
Date and time of the last change.
string | null
Date and time of the registration on the SMP.
string | null
Email address of the tenant at
outbox.email.e-invoice.be. The create and get operations fill this field.string
Activation state of the tenant for its destination network:
not_required, not_enrolled, pending, enrolled or failed. A tenant that sends through Peppol has not_required and can send immediately.string | null
The reason when
enrollment_state is failed.string | null
null when the tenant uses the default delivery route for its country.Company number and tax ID
company_numberis the registration number from the national business register (Belgium: CBE number, Netherlands: KvK number).company_tax_idis the VAT or tax number with the country prefix (BE1018265814,NL123456789B01).
0208: plus the CBE number:
For the schemes of other countries, see Look up Peppol participants and Supported schemes.
Why you set the Peppol ID when you create the tenant
The API uses the Peppol ID inpeppol_ids for three functions:
- Sending. The API accepts a send request only when the sender Peppol ID is in the
peppol_idsof the tenant. The comparison ignores letter case and spaces at the start and the end. - Receiving. Documents for the Peppol ID go to the tenant, after the ID is registered.
- Registration. Register on Peppol publishes the ID on the SMP and in the Peppol Directory.
Tenant create and tenant update do not write to the SMP or the SML (Service Metadata Locator). Registration is a separate step. Do it when the tenant must receive documents, or do not do it for a send-only tenant.
Get a tenant
Update a tenant
Send only the fields that you want to change. The API keeps the value of each field that is not in the request body. The request accepts the same fields as Create a tenant;name is optional here.
200 OK and contains the full tenant:
name that a different tenant of your organisation already has gives 409 Conflict.
Delete a tenant
This operation marks the tenant as deleted. It does not remove the data of the tenant.204 No Content and no body:
Plans and credits
You set the plan and the credit balance of a tenant with the fieldsplan and credit_balance of Create a tenant and Update a tenant. These two fields are the only plan and billing functions in the Admin API.
GET /api/me/. GET /api/stats with the API key of the tenant returns the usage of the tenant and uses credit_balance to calculate budget_estimation_days. See Usage statistics and credits.
API key management
Create an API key
string
required
Name of the API key. The name must be unique among the active API keys of the tenant; a name that is in use gives
409 Conflict.string
Free text, for example the purpose of the key.
201 Created:
List API keys
Get the active API keys of a tenant, newest first. Revoked keys are not in the list.integer
default:"0"
Number of API keys to skip.
integer
default:"100"
Maximum number of API keys to return.
Get the latest API key
Get the active API key of a tenant that was created last.404 Not Found:
Get one API key
Get one API key by its ID. Use this operation to see if a key is active or revoked: unlike the list operation, it also returns a revoked key, withis_deleted: true.
404 Not Found:
Update an API key
Change the name or the description of an API key. Theid (the bearer token) does not change.
string
New name. A name that a different active key of the tenant has gives
409 Conflict.string
New description.
Revoke an API key
204 No Content and no body:
is_deleted: true.
Rotate an API key
1
Create a new API key
Call Create an API key with a new name. Keep the returned
id.2
Give the new key to your customer
Send the key through a secure channel, or change the configuration that you keep for the customer.
3
Revoke the old key
When the customer uses the new key, call Revoke an API key for the old key. The two keys are valid together until this step, so there is no downtime.
Peppol registration
Peppol registration publishes the Peppol ID of a tenant on the SMP of e-invoice.be, so that the tenant can receive documents through e-invoice.be. A tenant that only sends documents does not need a registration; see Send-only tenants.Check the registration status
boolean
default:"false"
Set to
true to do a live check on the network. See Verify a registration.string
e-invoice: the Peppol ID is on the SMP of e-invoice.be. other: the Peppol ID is found on the network, but not on the SMP of e-invoice.be. not_registered: the Peppol ID is not found. A tenant with other or not_registered can send documents.object
The service group, the business card and the document types on the SMP of e-invoice.be. The three fields are
null when the Peppol ID is not on this SMP.boolean
true when this request did a live check (verify=true).object[]
One entry for each Peppol ID of the tenant.
state is not_published, pending or published and comes from the last recorded event for the ID. latest_event, source, detail and observed_at describe that event; they are null when the ID has no events.400 Bad Request:
Verify a registration
Withoutverify, the publications field comes from the events that the API recorded before (for example at registration). With verify=true, the API first does a live DNS lookup for each Peppol ID of the tenant, records the result as a new event, and then returns the status.
verified is true, and each publication shows the result of the live check (the smp object is shortened here):
state: "not_published" and latest_event: "not_found_on_smp".
A request with
verify=true adds events to the registration history of the tenant. Use it after a registration or when you examine a problem, not for frequent polling.Register on Peppol
string
required
Peppol ID to register, in the form
scheme:identifier. The scheme must be one of the supported schemes. The API changes the ID to lower case and removes spaces at the start and the end.- It checks the scheme and the format of the identifier.
- It looks for the Peppol ID on the network. An ID that is active at a different access point gives
409 Conflict. - It creates the service group on the SMP.
- It adds the six default document types: invoice, credit note, self-billing invoice, self-billing credit note, invoice response and message level response.
- It adds a business card. For a Belgian Peppol ID, the company data comes from the KBO (Crossroads Bank for Enterprises).
200 OK:
company_data also contains the KBO fields status, juridical_situation, type_of_enterprise, juridical_form, start_date and address_type. For other countries, company_data contains only company_number; the other fields are null.
The operation is idempotent. If the Peppol ID is already on the SMP of e-invoice.be, registration.method is already_exists and the API makes no new service group.
Dry run
With"dry_run": true, the API does the checks of a registration (scheme, identifier format, lookup on the network, KBO lookup for Belgium) and makes no change on the SMP. Use it to find an incorrect or already registered Peppol ID before the real registration.
In a dry run,
registration.registered is true although nothing is registered. Read business_card.dry_run and document_endpoints.dry_run to identify a dry-run response. A dry run does not add events to publications.dry_run. Update the business card and Unregister from Peppol return {"success": true} for a test-mode tenant and make no change on the SMP.
Supported schemes
Registration accepts a Peppol ID only when its scheme is in this list. The list is smaller than the list of schemes that you can send to.
Schemes of other countries (for example Germany, Austria, Italy and Luxembourg) and the Belgian VAT scheme
9925 are not accepted. French schemes need a separate enrolment; send an email to support@e-invoice.be. A scheme that is not supported gives 400 Bad Request:
Update the business card
Change the company name on the business card of a registered Peppol ID. The name is the only field that you can change.string
required
Peppol ID of the business card. It must be in the
peppol_ids of the tenant; if not, the response is 403 Forbidden.string
New company name. Include the company type, for example
BV or NV.400 Bad Request:
Unregister from Peppol
Remove the document types, the business card and the service group of a Peppol ID from the SMP of e-invoice.be. The tenant can then not receive documents through e-invoice.be. It can continue to send documents as a send-only tenant.string
required
Peppol ID to unregister. It must be in the
peppol_ids of the tenant; if not, the response is 403 Forbidden.Send-only tenants
A tenant can send documents through Peppol without a registration on the SMP and the SML. Use a send-only tenant when the company receives its documents through a different access point, or does not want to receive documents at this time. There is nosend_only field. A tenant is send-only because Register on Peppol was not called for it.
Create a send-only tenant
1
Create the tenant
Call Create a tenant and put the Peppol ID in
peppol_ids.2
Create an API key
Call Create an API key for the tenant. The returned
id is the bearer token of the tenant.3
Send documents with the tenant API key
Create a document with The response has the status
POST /api/documents/ and send it. See Create e-invoices. Do not call the register operation.200 OK and contains the document. This example shows the first fields:A French send-only tenant must be enrolled, but it can have zero publications. Send an email to support@e-invoice.be for the enrolment procedure.
What a send-only tenant can do
If the sender Peppol ID (for self-billing documents: the receiver Peppol ID) is not in the
peppol_ids of the tenant, the send request fails with 409 Conflict:
Status of a send-only tenant
Check the registration status shows the Peppol ID of a send-only tenant as not published:state is other when the Peppol ID is registered at a different access point.
Become a receiver later
Call Register on Peppol when the tenant is ready to receive documents. No tenant change is necessary.Testing
Use the organisation API key of a test-mode organisation to test your integration. Each tenant that you create with this key is a test-mode tenant: its sends go to email, and no Peppol traffic occurs. See Test mode and sandbox companies.Simulate an inbound document
Put a UBL document in the inbox of a test-mode tenant, as if it was received through Peppol. The API creates the document in theRECEIVED state and sends the document.received webhook event to the webhooks of the tenant.
file
required
UBL invoice or credit note as an XML file. The request is
multipart/form-data; a raw XML request body is not accepted. The maximum size is 25 MB.201 Created:
The API reads the sender and receiver Peppol IDs, the document type and the line items from the UBL. Read the result with
GET /api/documents/{document_id} and the tenant API key.
For the procedure in the app and for the tenant-side view, see Testing received documents and Receive documents.
Onboarding example
The script below creates a tenant, creates an API key and registers the tenant on Peppol. Remove the registration step for a send-only tenant.Complete onboarding script (Node.js and Python)
Complete onboarding script (Node.js and Python)
Errors
The Admin API returns errors as JSON with adetail field. For the general error model, see Errors and troubleshooting.
Example of a
422 response:
Best practices
Keep keys secure
Keep keys secure
- The
idof an API key is the bearer token. Keep it secret from the moment that you receive it. - Do not write organisation API keys or tenant API keys to logs.
- Store tenant API keys encrypted.
- Give keys to customers only through a secure channel.
- Rotate keys at regular intervals. See Rotate an API key.
Use a naming convention for tenants
Use a naming convention for tenants
Use tenant names that you can calculate from your own data, for example
cust-<your customer ID> or a slug of the company name. The API refuses a second active tenant with the same name (409 Conflict), which helps you to prevent duplicates.Make onboarding safe to repeat
Make onboarding safe to repeat
If Create a tenant returns
409 Conflict, the tenant exists. Get it from List tenants and continue with the next step. Register on Peppol and Unregister from Peppol are idempotent, so you can repeat them after a network error.Keep an audit log
Keep an audit log
Record each admin operation in your system: the operation, the tenant ID, the user and the time. Do not record API keys.
Check before you register
Check before you register
Validate the Peppol ID in your system, then call Register on Peppol with
"dry_run": true. Do the real registration only when the dry run is successful.Rate limits
Rate limits apply to each API key on write and validation endpoints. See Errors and troubleshooting. When you exceed a limit, the API returns429 Too Many Requests with a Retry-After header. Obey Retry-After and use exponential backoff when you do operations for many tenants.
Support
For access to the Admin API or for technical questions, send an email to support@e-invoice.be.Next Steps
Reseller programme
Learn how to become a reseller and get an organisation API key.
Create e-invoices
Send documents with the API key of a tenant.
Test mode and sandbox companies
Test mode, sandbox companies and simulated inbound documents.
Usage statistics and credits
Read the usage of a tenant with its API key.