# Send and receive e-invoices over Peppol

> Atta sends purchase orders as Peppol Orders, receives supplier e-invoices, and links each one to the purchase its PO number names. Setup is done by an operator.

Updated 2026-11-06. Source: https://atta.sh/integrations/peppol

Atta sends purchase orders to suppliers over Peppol and receives their invoices through an access point. A received invoice links to your purchase by the order reference it carries. The access point account and Peppol identity are assigned by the operator with a script, since they authorize sending as a company.

## What goes over Peppol

- **Purchase orders out.** Atta sends a Peppol Order from an inbound shipment, with the PO number as the order number. Suppliers repeat that number on their invoice.
- **Invoices in.** Supplier invoices arrive from the access point by webhook. The document is fetched with Atta's own credentials, because a webhook is only a hint.
- **Answers out.** A person can accept, query, reject or mark an invoice paid, and Atta sends a Peppol Invoice Response when the invoice came over Peppol.
- **Sales invoices out.** An invoice for a sale outbound is numbered from its own sequence.

Other formats and channels go through the same model. See [e-invoicing](https://atta.sh/e-invoicing) for the list.

## What happens to an incoming invoice

The payload is stored exactly as received, then a `received` event is recorded. Atta finds the workspace by access point account, then by the receiver's verified endpoint. If it can't attribute the document, it logs that and leaves it unread at the access point.

Matching uses the order reference (BT-13), then BT-10, against request PO numbers and inbound numbers. A supplier's endpoint or VAT number is recorded but never links a purchase alone.

| Invoice names | Result |
| --- | --- |
| PO-2026-0412, one match | Becomes that request's invoice row |
| A PO that doesn't exist | Goes to the inbox |
| No PO, only the supplier | Goes to the inbox, supplier recorded |
| Two possible matches | Goes to the inbox |

A person links an inbox invoice by hand and it's recorded as matched by a person. Notifications are `einvoice_received` and `einvoice_unmatched`.

A response from a counterparty moves a document only when its sender is that document's own counterparty, by endpoint or VAT.

## Is this supplier on Peppol?

A lookup asks the access point's SMP, then the public Peppol directory, whether a supplier is registered and which documents they accept. Peppol ids are checked for scheme and check digits (Belgian mod 97, GLN, Norwegian, Swedish and Australian numbers). The supplier's country, VAT, registration and Peppol id are kept on the supplier record.

## Setting it up

The identity steps need an operator because the access point key belongs to the platform. A company id is authority to send as that company, and a Peppol id is public, so neither can be claimed from a form.

1. **Operator: configure a transport.** Set the access point credentials for Recommand (`RECOMMAND_API_KEY` and `RECOMMAND_API_SECRET`). With no transport configured, nothing sends, and `EINVOICE_TRANSPORT=console` is for development only.
2. **Workspace: fill in the identity.** In Settings, then E-invoicing, enter the legal entity, VAT number, registration, Peppol id, address, payment details and route preference.
3. **Operator: assign the access point account and verify the endpoint:**

   ```sh
   bun --env-file=.env.local scripts/einvoice-identity.ts <workspaceId> \
     --account <company id> --verify-endpoint
   ```

   Until it's verified, the endpoint receives nothing. An endpoint has one holder, so `--clear-endpoint` frees an id another workspace typed in first.
4. **Operator: point the access point's webhook** at `/api/webhooks/einvoice/<transport>`.

Changing the endpoint clears its verification.

## Who can do what

Sending and answering are `checkout` Server Actions. The agent only reads, through `findInvoices`. A mandate that calls for a channel with no transport refuses the send, and doesn't send by email instead.

## Questions

### Do I need my own Peppol access point?

No. Atta sends and receives through an access point service. The operator assigns the access point account to your workspace and verifies your endpoint.

### Why can't I enter my Peppol id myself?

A Peppol id is public, and the account behind it can send as that company. So it can only be set by the operator, and an endpoint receives mail only once verified.

### How are invoices matched to purchases?

By the PO number on the invoice, first the order reference and then BT-10. A supplier match alone never links a purchase.

### Can the agent send invoices?

No. It can look up invoices and their match status. Sending and answering are actions for people with the checkout capability.