Send and receive e-invoices over Peppol
Atta sends purchase orders to suppliers over Peppol and receives their invoices through an access point. A received invoice links to your purchase by the order reference it carries. The access point account and Peppol identity are assigned by the operator with a script, since they authorize sending as a company.
What goes over Peppol
- Purchase orders out. Atta sends a Peppol Order from an inbound shipment, with the PO number as the order number. Suppliers repeat that number on their invoice.
- Invoices in. Supplier invoices arrive from the access point by webhook. The document is fetched with Atta's own credentials, because a webhook is only a hint.
- Answers out. A person can accept, query, reject or mark an invoice paid, and Atta sends a Peppol Invoice Response when the invoice came over Peppol.
- Sales invoices out. An invoice for a sale outbound is numbered from its own sequence.
Other formats and channels go through the same model. See e-invoicing for the list.
What happens to an incoming invoice
The payload is stored exactly as received, then a received event is recorded. Atta finds the workspace by access point account, then by the receiver's verified endpoint. If it can't attribute the document, it logs that and leaves it unread at the access point.
Matching uses the order reference (BT-13), then BT-10, against request PO numbers and inbound numbers. A supplier's endpoint or VAT number is recorded but never links a purchase alone.
| Invoice names | Result |
|---|---|
| PO-2026-0412, one match | Becomes that request's invoice row |
| A PO that doesn't exist | Goes to the inbox |
| No PO, only the supplier | Goes to the inbox, supplier recorded |
| Two possible matches | Goes to the inbox |
A person links an inbox invoice by hand and it's recorded as matched by a person. Notifications are einvoice_received and einvoice_unmatched.
A response from a counterparty moves a document only when its sender is that document's own counterparty, by endpoint or VAT.
Is this supplier on Peppol?
A lookup asks the access point's SMP, then the public Peppol directory, whether a supplier is registered and which documents they accept. Peppol ids are checked for scheme and check digits (Belgian mod 97, GLN, Norwegian, Swedish and Australian numbers). The supplier's country, VAT, registration and Peppol id are kept on the supplier record.
Setting it up
The identity steps need an operator because the access point key belongs to the platform. A company id is authority to send as that company, and a Peppol id is public, so neither can be claimed from a form.
Operator: configure a transport. Set the access point credentials for Recommand (
RECOMMAND_API_KEYandRECOMMAND_API_SECRET). With no transport configured, nothing sends, andEINVOICE_TRANSPORT=consoleis for development only.Workspace: fill in the identity. In Settings, then E-invoicing, enter the legal entity, VAT number, registration, Peppol id, address, payment details and route preference.
Operator: assign the access point account and verify the endpoint:
bun --env-file=.env.local scripts/einvoice-identity.ts <workspaceId> \ --account <company id> --verify-endpointUntil it's verified, the endpoint receives nothing. An endpoint has one holder, so
--clear-endpointfrees an id another workspace typed in first.Operator: point the access point's webhook at
/api/webhooks/einvoice/<transport>.
Changing the endpoint clears its verification.
Who can do what
Sending and answering are checkout Server Actions. The agent only reads, through findInvoices. A mandate that calls for a channel with no transport refuses the send, and doesn't send by email instead.
Questions
Do I need my own Peppol access point?
No. Atta sends and receives through an access point service. The operator assigns the access point account to your workspace and verifies your endpoint.
Why can't I enter my Peppol id myself?
A Peppol id is public, and the account behind it can send as that company. So it can only be set by the operator, and an endpoint receives mail only once verified.
How are invoices matched to purchases?
By the PO number on the invoice, first the order reference and then BT-10. A supplier match alone never links a purchase.
Can the agent send invoices?
No. It can look up invoices and their match status. Sending and answering are actions for people with the checkout capability.
Related
- E-invoicing for purchases: Peppol, XRechnung and Factur-XAtta sends purchase orders over Peppol, receives e-invoices in EN 16931 formats like XRechnung and Factur-X, and links each one to the purchase it names.
- Procure to pay softwareProcure to pay in one flow: a request, sourcing, approval, a PO, a capped card, receipt and invoice match. Here's each step and what Atta does in it.
- Purchase order softwareEach approved request gets a PO number, the order carries it, receipts are recorded per line, and an invoice that names the PO attaches to the request.
- Buy from your Shopify store with an AI agentConnect a Shopify store to Atta. The agent searches its catalog, builds the cart, hands off Shopify checkout, and settles the budget from the store's webhooks.