e-invoice home Tools For developers
Developer portal

API documentation for e-invoice

Documentation for integrations covering lookup, validation, sending, receiving, webhooks and audit output. Describes the recommended deployment approach, security rules and integration scenarios.

REST API Sandbox-ready Idempotency-first Webhook events Evidence-friendly

Interface availability

Available endpoints may differ by environment and deployment type. Production keys belong on the server, not in the browser. The public frontend must not call private production routes directly.

Auth

Bearer + idempotency

Private API keys belong on the server, not in browser JS. Sending and retries should use an Idempotency-Key.

Authorization · Idempotency-Key
Lifecycle

Send + receive + process

Endpoints account not only for sending, but also receiving, approvals, response codes, evidence packs and the archive flow.

Send · Receive · Evidence
DX

Sandbox and quickstarts

An integrator needs a short quickstart, payload examples, retry rules, webhooks and a clear distinction between test and prod mode.

Docs · Samples · Webhooks

Enterprise integration profile

For enterprise clients, a fully automated flow matters: the system accepts a feed, validates it, converts it, sends it, and returns the final artifacts back into the archive or ERP.

M2M integration REST API Webhook return

Feed, formats and ICD

Integration accounts for a JSON/XML feed, batch processing and secure channels like SFTP. The Interface Control Document can take the form of an OpenAPI/Swagger spec supplemented with mapping and retry rules.

JSON / XML Batch / SFTP ICD / OpenAPI

Fail flow and retry

On error, the system should return a detailed reason, rule ID, XML node and a recommended fix. The source system remains the fix source, and Slovak e-Invoicing Centre returns the result via webhook.

rule_id + detail Retry workflow Audit trail

Final artifacts and portal

Enterprise clients often need to get back the final XML and PDF, have a portal to review processed invoices, and prepare their own branded PDF template.

PDF template Final XML/PDF return Portal / viewer
ICD

ICD & OpenAPI

Contract for the feed, mapping, error catalog, versioning and checklist for enterprise teams.

Open ICD →
Events

Webhook Contract

Delivery lifecycle, callback payloads, signature model, retries and event ordering.

Open webhooks →
Artifacts

Artifact Return & PDF

Return of the final XML/PDF, custom template bundle and archive handoff into the client's internal system.

Open artifact layer →
Env

Sandbox vs Production

Promotion checklist, test payloads, idempotency guardrails and cutover rules before going live.

Open modes →
Rules

Error Catalog

Rule IDs, severity, XML path, remediation hints and an owner model for enterprise triage.

Open error catalog →
Batch

SFTP & Batch Onboarding

Naming conventions, manifests, ACK files, partial retry and traceability for corporate feeds.

Open batch onboarding →
Trust

Security & Trust Center

EU data residency, audit logs, retention and the enterprise operating model for technical review.

Open trust center →
Identity

Enterprise Identity

SSO, lifecycle and role governance for corporate tenants and integration teams.

Open identity layer →
Pricing

API & Enterprise Pricing

Pay-as-you-go API, plans for accountants, and enterprise middleware in one commercial model.

Open pricing →
RBAC

Access Control

Separation of admin, accountant and developer permissions, including API keys and audit roles.

Open RBAC →
Connectors

Integrations

Priority list of systems for the Slovak market with compatibility status. Import already works with POHODA XML, KROS exports, Money/MRP CSV and ISDOC; more direct connectors are added over time.

Open integrations →
Security

Security Baseline

Technical baseline for edge headers, CORS, payload controls, auth and enterprise hardening.

Open security baseline →
Ops

Status & Observability

Status page, webhook delivery log, correlation IDs and incident reporting for enterprise support.

Open observability →
Audit

Audit Export

e-Discovery bundle for clients who need an XML/PDF/log export for a given period.

Open audit export →
Automation

Automation Suite

Rules, PO matching, disputes and smart intake for more advanced automation scenarios.

Open automation suite →
Network

Global Network

Factur-X, clearance and roaming as a multi-country direction for further integrations.

Open network layer →
GET /api/peppol-lookup/:participantId

Partner lookup in the form 0245:2020123456. Output: registration, name, supported documents, readiness status and recommended channel.

Live API / verificationPartner onboarding
POST /api/validate

XML validation returns rule_id, the severity of the issue, and a fix recommendation. In a local overview it should always be clearly marked that this is not a production result.

ValidationLocal overview kept separate
POST /api/convert

Excel, CSV or prepared exports as input, and a ZIP with ready XML or a batch report as output. Suitable for a gradual transition without a new ERP.

ConversionReview required for uncertain input
POST /api/send

Preparation and sending of a document via a connected certified partner, with emphasis on Idempotency-Key, transmission ID, evidence and subsequent response events.

Via a connected certified partnerAfter connection activation
GET /api/messages/:invoiceId

Overview of ACK, NACK, rejection and other events, including their business meaning and a processing timeline.

Event timelineLocal overview possible
GET /api/evidence/:invoiceId

Bundle for audit or internal review: payload, validation summary, response events, rule version and processing timeline.

Audit / exportAuxiliary local export

Quickstart

The examples below serve as a sandbox or server-side integration pattern. The production URL, authorization and available endpoints depend on the chosen deployment.

curl -X POST /api/validate \ -H "Authorization: Bearer $API_KEY" \ -F "files[]=@invoice001.xml"
const res = await fetch("https://api.verifyeu.com/api/peppol-lookup/0245:2020123456", { headers: { Authorization: "Bearer " + process.env.API_KEY } });
requests.post( "https://api.verifyeu.com/api/send", headers={ "Authorization": "Bearer " + API_KEY, "Idempotency-Key": "invoice-2026-001" }, files={"xml_file": open("invoice.xml", "rb")} )

Auth, sandbox and retry rules

Topic
Rule
Impact
API keys
The key belongs in the server-side environment. The frontend should call your own backend or proxy, not public browser JS.
Security
Availability
Before integrating, confirm which routes are available in production and which are for testing or local overview only.
Trust
Sandbox
First integrations should use a demo/mock provider, test payloads and logging separated from production.
Lower risk
Idempotency
Every attempt to prepare a send via a connected certified partner should have a stable Idempotency-Key. Retries must not create duplicate invoices.
Operations
Validation gate
The validator should run before /api/send, and on errors the document should stop in the remediation flow.
Compliance
Evidence
Store the rule version, transmission ID, response timeline and approval metadata for the audit trail.
Audit

What to add for enterprise inquiries

Requirement
Recommended product answer
Layer
Invoice feed
REST API as the primary channel, plus batch or SFTP for large corporate exports.
M2M
Formats
JSON/XML as input, conversion to PEPPOL BIS 3.0 or SK CIUS inside the middleware layer.
Convert
ICD
OpenAPI/Swagger + mapping notes + error catalog + retry rules + webhook contract.
DX
Error handling
Return rule ID, severity, node/path and explainable remediation; the source system fixes the data and resends.
Validator
Final PDF/XML
After validation and sending, be able to return the final XML and PDF back to the client's archive via API or webhook.
Archive
Portal
Combine viewer, inbox and audit trail into a proper portal for finance and operations users.
Portal

Webhook events

The transport layer confirmed delivery to the network or recipient.

Transport or business rejection. Typically opens the remediation flow.

Conditional acceptance, timeout, or a workflow data conflict.

The document was closed out and marked for archiving with an evidence pack.

The final XML and PDF are ready to be returned to the client's internal archive or billing system.

Developer guardrails

Low-trust input should go through human review, not autonomous sending.

Peppol ID, tax ID, IBAN and partner identifiers need to be validated before a batch.

An ACK does not mean business acceptance. The workflow should wait for the next response event.

For a partner who isn't ready, return a recommended channel, not just a "partner not found" message.