Organization and workspace settings — defaults, numbering, sign-in policy, approval checkpoints, mail house defaults and more — as typed keys on a ladder (workspace over organization over the organization above, over the default). GET /organization/settings/catalog lists every key with its type; GET /organization/settings/resolve answers the effective value and where it came from. Also: sharing a resource (such as a dunning policy) with the organizations below yours, and e-invoicing channels and their credentials.
List the stored e-invoicing channel credentials
Names the credentials on file and what each is called. The secrets themselves are NEVER returned by this or any other endpoint — the asymmetry is deliberate: an operator must always be able to see WHICH credential a channel uses, and never needs to read it back. Rotation is writing a new value over the old one. From 2026-11-30 this list answers {data: [...], pagination}: the credentials move from data.credentials to data.
Required scope: org.read (Read organization profile).
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
List the stored e-invoicing channel credentials › Responses
OK
Store or replace an e-invoicing channel credential
Stores the secret a channel's credentials_ref names, sealed at rest under the organization's own key. Writing the same reference again replaces the value, which is how rotation works. Keyed by reference and not by channel, because one access-point contract commonly serves several countries and a per-channel copy is a rotation somebody will do three quarters of. Returns 503 when the deployment has no secret keyring — refusing is the only honest answer, since the alternative is storing a credential in plaintext.
Required scope: org.update (Update organization profile).
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Store or replace an e-invoicing channel credential › Request Body
refThe locator to store it under — the same string a channel's credentials_ref names.
secretThe credential itself. Sealed at rest under the organization's own key and never returned by any endpoint; writing again replaces it, which is how rotation works.
labelOperator-facing name for this credential.
Store or replace an e-invoicing channel credential › Responses
OK
Remove an e-invoicing channel credential
Deletes the stored secret. A channel that still names it then resolves to nothing, which is the loud state and not a silent empty one: the adapter reports the reference as unresolvable rather than sending unauthenticated.
Required scope: org.update (Update organization profile).
path Parameters
refHeaders
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Remove an e-invoicing channel credential › Responses
No Content
List the transports a channel can deliver through
The closed set of networks and authorities this server can deliver e-invoices through, as one page. The set changes with a release, so a picker reads it here instead of holding a copy.
Required scope: org.read (Read organization profile).
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
List the transports a channel can deliver through › Responses
OK
List the organization's e-invoicing delivery channels
Returns the channels this organization has configured — which access point or authority a document goes to for a given seller country, under which credentials reference, in test or live mode — and the organization's Peppol ID. available_kinds (now GET /organization/einvoicing/channel-kinds) and peppol_id (now the PEPPOL identifier of GET /organization/identifiers) are deprecated, as is is_enabled (read status). credentials_ref is returned unmasked: it NAMES a secret in the secret store and is never the secret. From 2026-11-30 this list answers {data: [...], pagination}: the channels move from data.channels to data.
Required scope: org.read (Read organization profile).
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
List the organization's e-invoicing delivery channels › Responses
OK
Configure an e-invoicing delivery channel
Creates one channel for a seller country (optionally narrowed to a region). The country is the SELLER's, because a channel is bought, paid for and credentialled by the seller. A second channel for the same country and region is refused with 409 — the unique index cannot catch it, because a nullable region makes two country-wide rows distinct in Postgres.
Required scope: org.update (Update organization profile).
Headers
Idempotency-KeyUnique key that makes this POST safe to retry: repeats with the same key replay the first response instead of re-executing. Replays are scoped to the retrying principal (same API key / user) and kept for 24 hours. Required on every POST.
Client-generated idempotency key (e.g. a UUID).
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Configure an e-invoicing delivery channel › Request Body
channelPEPPOL, PDP, SDI, KSEF, AEAT or AT.
countryThe SELLER's country, ISO 3166-1 alpha-2. A channel is bought, paid for and credentialled by the seller, so it is keyed on the seller's country and not the buyer's.
credentials_refNAMES a secret in the secret store, for example vault://peppol/be. It is logged by the adapter and returned unmasked by this API, so it must never be the credential itself.
endpoint_urlThe provider's base URL. Empty means the adapter's default.
modetest or live. Absent means test: the other default would have a first save send real invoices to a real authority under credentials nobody has confirmed.
participant_idThe seller's own address on a network that is not Peppol.
participant_schemeThe seller's own address on a network that is not Peppol (the SdI transmitter). A pair with participant_id: state both or neither. Refused on a PEPPOL row: its sender is the organisation's Peppol ID.
regionNarrows the row below the country (the Basque and Navarrese territories run TicketBAI rather than Verifactu). Empty means the whole country.
statusactive or disabled. Absent means disabled, unless the deprecated is_enabled says true.
is_enabledWhether documents go out through this channel. Deprecated: use status instead. Removed on 2026-11-30.
Configure an e-invoicing delivery channel › Responses
Created
Replace an e-invoicing delivery channel
Replaces every field of one channel. A full replace and not a patch, because the endpoint, its credentials reference and the participant identifier addressed under them are one decision: a partial update that changed the endpoint and kept the old credentials reference would produce a channel that authenticates against nothing.
Required scope: org.update (Update organization profile).
path Parameters
idHeaders
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Replace an e-invoicing delivery channel › Request Body
channelPEPPOL, PDP, SDI, KSEF, AEAT or AT.
countryThe SELLER's country, ISO 3166-1 alpha-2. A channel is bought, paid for and credentialled by the seller, so it is keyed on the seller's country and not the buyer's.
credentials_refNAMES a secret in the secret store, for example vault://peppol/be. It is logged by the adapter and returned unmasked by this API, so it must never be the credential itself.
endpoint_urlThe provider's base URL. Empty means the adapter's default.
modetest or live. Absent means test: the other default would have a first save send real invoices to a real authority under credentials nobody has confirmed.
participant_idThe seller's own address on a network that is not Peppol.
participant_schemeThe seller's own address on a network that is not Peppol (the SdI transmitter). A pair with participant_id: state both or neither. Refused on a PEPPOL row: its sender is the organisation's Peppol ID.
regionNarrows the row below the country (the Basque and Navarrese territories run TicketBAI rather than Verifactu). Empty means the whole country.
statusactive or disabled. Absent means disabled, unless the deprecated is_enabled says true.
is_enabledWhether documents go out through this channel. Deprecated: use status instead. Removed on 2026-11-30.
Replace an e-invoicing delivery channel › Responses
OK
Remove an e-invoicing delivery channel
Deletes the row. Submissions already made through it are untouched: they are the record of what happened and are not the tenant's to erase. To stop using a channel without losing its settings, set is_enabled to false instead.
Required scope: org.update (Update organization profile).
path Parameters
idHeaders
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Remove an e-invoicing delivery channel › Responses
No Content
List organization settings
Returns every setting in force for the current organization and workspace, ordered by key. Paged with limit and cursor; the default page (200) holds every setting, so a call without limit reads the whole list. include=provenance adds where each value comes from (source_level, policy, bound, locked_at, bounded_at, inherited, granted_by_parent); it is sent without being asked until 2026-11-30, after that only with include=provenance.
Required scope: org.read (Read organization profile).
query Parameters
includeExtra data to add to the response: provenance. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400. provenance is sent without being asked until 2026-11-30; after that date it is sent only when named here.
limitPage size (default 200, max 200).
cursorOpaque continuation token from the previous response's pagination.cursor. Omit for the first page. Cursors are stateless and do not expire, but are only valid for the list and filters that produced them.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
List organization settings › Responses
OK
Create or update organization settings
Deprecated: use PATCH /organization/settings instead. Removed on 2026-11-30.
Validates settings against the catalog and writes the named keys; a key the request does not name is left alone. Returns the organization's settings after the write in the shape GET /organization/settings answers: every setting, on one page. include=provenance adds where each value comes from (source_level, policy, bound, locked_at, bounded_at, inherited, granted_by_parent); it is sent without being asked until 2026-11-30, after that only with include=provenance.
Required scope: org.update (Update organization profile).
query Parameters
includeExtra data to add to the response: provenance. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400. provenance is sent without being asked until 2026-11-30; after that date it is sent only when named here.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Create or update organization settings › Request Body
Money settings, by key.
confirm_empty_descendantsSave even though a narrowed allow-list (allowed identity providers, allowed email domains) leaves an organization below allowing nothing. Without it such a save is refused with SETTING_ALLOWS_NOTHING_BELOW, which names those organizations.
levelThe rung these values land on. Omitted from a live workspace, each key lands on its own highest rung — the organization — so the value inherits down the tree and into every workspace. Omitted from a sandbox, it lands on that sandbox: an experiment never changes the live workspace. State 'workspace' for an override that governs only the workspace you are in; 'organization' is refused from a sandbox.
List settings, by key. An empty array sets the empty list, which is a value — to stop deciding a key here, DELETE it instead.
String, int and bool settings, by key, each in its wire spelling.
Create or update organization settings › Responses
OK
Update organization settings
Validates settings against the catalog and writes the named keys; a key the request does not name is left alone. Returns the organization's settings after the write in the shape GET /organization/settings answers: every setting, on one page. include=provenance adds where each value comes from (source_level, policy, bound, locked_at, bounded_at, inherited, granted_by_parent); it is sent without being asked until 2026-11-30, after that only with include=provenance.
Required scope: org.update (Update organization profile).
query Parameters
includeExtra data to add to the response: provenance. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400. provenance is sent without being asked until 2026-11-30; after that date it is sent only when named here.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Update organization settings › Request Body
Money settings, by key.
confirm_empty_descendantsSave even though a narrowed allow-list (allowed identity providers, allowed email domains) leaves an organization below allowing nothing. Without it such a save is refused with SETTING_ALLOWS_NOTHING_BELOW, which names those organizations.
levelThe rung these values land on. Omitted from a live workspace, each key lands on its own highest rung — the organization — so the value inherits down the tree and into every workspace. Omitted from a sandbox, it lands on that sandbox: an experiment never changes the live workspace. State 'workspace' for an override that governs only the workspace you are in; 'organization' is refused from a sandbox.
List settings, by key. An empty array sets the empty list, which is a value — to stop deciding a key here, DELETE it instead.
String, int and bool settings, by key, each in its wire spelling.
Update organization settings › Responses
OK
Get settings catalog
Returns the full catalog of available settings with types, defaults, and descriptions. Paged with limit and cursor; the default page (200) holds every setting, so a call without limit reads the whole list.
Required scope: org.read (Read organization profile).
query Parameters
limitPage size (default 200, max 200).
cursorOpaque continuation token from the previous response's pagination.cursor. Omit for the first page. Cursors are stateless and do not expire, but are only valid for the list and filters that produced them.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Get settings catalog › Responses
OK
Resolve settings for one entity
Returns every setting resolved down the ladder for one entity: the organization, the workspace, then the entity tail named by entity (e.g. customer:
Required scope: org.read (Read organization profile).
query Parameters
includeExtra data to add to the response: provenance. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400. provenance is sent without being asked until 2026-11-30; after that date it is sent only when named here.
entityAn entity tail appended to the workspace path, as
limitPage size (default 200, max 200).
cursorOpaque continuation token from the previous response's pagination.cursor. Omit for the first page. Cursors are stateless and do not expire, but are only valid for the list and filters that produced them.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Resolve settings for one entity › Responses
OK
Stop deciding one setting here
Removes this organization's own value for one setting, so it follows the organization above again, or the platform default when there is none above. Idempotent: a setting this level never set is already unset. Refused while an organization above has the setting locked, exactly as a save is.
Required scope: org.update (Update organization profile).
path Parameters
keyThe setting to stop deciding here, e.g. marketplace.completion_window_days.
query Parameters
levelThe rung the row is removed from. Omitted, it is the same rung a save with no stated level would have written: the key's own highest rung from a live workspace, and the sandbox's own workspace from a sandbox.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Stop deciding one setting here › Responses
No Content
List the resources this organization shares
Returns the brand profiles, document templates and dunning policies this organization offers to its subtree, with the policy each carries.
Required scope: org.children.manage (Manage the organization's subtree).
query Parameters
includeExtra data to add to the response: display. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400. display is sent without being asked until 2026-11-30; after that date it is sent only when named here. names is deprecated: it is the old name of display, accepted until 2026-11-30.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
List the resources this organization shares › Responses
OK
Share a resource with the organizations below
Offers one brand profile, document template or dunning policy to this organization's subtree. A default share lets a descendant keep its own row; a locked share refuses one, and is itself refused when descendants already hold their own.
Required scope: org.children.manage (Manage the organization's subtree).
query Parameters
includeExtra data to add to the response: display. Send a comma-separated list or repeat the parameter. An unknown name is refused with 400. display is sent without being asked until 2026-11-30; after that date it is sent only when named here. names is deprecated: it is the old name of display, accepted until 2026-11-30.
Headers
Idempotency-KeyUnique key that makes this POST safe to retry: repeats with the same key replay the first response instead of re-executing. Replays are scoped to the retrying principal (same API key / user) and kept for 24 hours. Required on every POST.
Client-generated idempotency key (e.g. a UUID).
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Share a resource with the organizations below › Request Body
resource_idThe row being offered.
resource_kindThe kind of row being offered.
policydefault lets a descendant keep its own row; locked refuses one. A share is never bounded.
Share a resource with the organizations below › Responses
Created
Stop sharing a resource
Deprecated: use POST /organization/shares/{id}/revoke instead. Removed on 2026-11-30.
Revokes one share. The share stays listed for the audit trail and the resource may be offered again. It does not delete anything: use POST /organization/shares/{id}/revoke.
Required scope: org.children.manage (Manage the organization's subtree).
path Parameters
idHeaders
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Stop sharing a resource › Responses
No Content
Stop sharing a resource
Revokes one share. The share stays listed for the audit trail and the resource may be offered again.
Required scope: org.children.manage (Manage the organization's subtree).
path Parameters
idHeaders
Idempotency-KeyUnique key that makes this POST safe to retry: repeats with the same key replay the first response instead of re-executing. Replays are scoped to the retrying principal (same API key / user) and kept for 24 hours. Required on every POST.
Client-generated idempotency key (e.g. a UUID).
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
Stop sharing a resource › Responses
No Content
List the settings organizations below hold their own value for
Returns, per setting, the open organizations at any depth below this one that set a value of their own at the organization level, with their names and values. Workspace, sandbox and entity rows inside them are not counted; closed organizations are left out. Ordered by key. Paged with limit and cursor; the default page (200) holds every setting, so a call without limit reads the whole list. count is deprecated: it is the length of organizations.
Required scope: org.children.read (Read the organization's subtree).
query Parameters
limitPage size (default 200, max 200).
cursorOpaque continuation token from the previous response's pagination.cursor. Omit for the first page. Cursors are stateless and do not expire, but are only valid for the list and filters that produced them.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
List the settings organizations below hold their own value for › Responses
OK
List the settings this organization set itself
Returns every setting set AT this organization — not resolved down a workspace — with the policy and bound it carries for the organizations below, ordered by key. Paged with limit and cursor; the default page (200) holds every setting, so a call without limit reads the whole list.
Required scope: org.children.read (Read the organization's subtree).
query Parameters
limitPage size (default 200, max 200).
cursorOpaque continuation token from the previous response's pagination.cursor. Omit for the first page. Cursors are stateless and do not expire, but are only valid for the list and filters that produced them.
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
List the settings this organization set itself › Responses
OK
The Verifactu producer's declaración responsable
Returns the declaration RD 1007/2023 art. 13 obliges the producer of a Spanish sistema informático de facturación to issue «por escrito y de modo visible en el propio sistema informático en cada una de sus versiones»: who the producer is, which version of the system this is, the provisions the system declares compliance with, its tipología/composición/funcionalidades, and the limitations it declares. There is no state certification in Spain — it is self-declaration, and a false one is an LGT art. 201 bis infringement — so the limitations are part of the document rather than a footnote to it. The version is read from the running binary, because art. 13 makes the declaration per-version. The text is Spanish in every locale: it is a statement to a Spanish authority under a Spanish regulation, and a translated one is a different document.
Required scope: org.read (Read organization profile).
Headers
X-Workspace-IdSelects the workspace this request operates in, by workspace UUID or slug (e.g. a sandbox workspace for test integrations). Omitted: the organization's default live workspace. Unknown workspace: 404; workspace outside your organization: 403. Discover workspaces via GET /workspaces.
Workspace UUID or slug.
The Verifactu producer's declaración responsable › Responses
OK
capabilitiesArt. 13's «tipología, composición y funcionalidades» of the system. Spanish.
generated_atWhen this declaration was produced.
limitationsWhat this system does NOT do, stated in the declaration itself. Omitting them would make the declaration a false one, which LGT art. 201 bis fines at EUR 150,000 per system per financial year.
producer_nameThe producer's name (nombre o razón social).
producer_tax_idThe producer's tax id (NIF).
provisionsThe provisions the declaration asserts compliance with (LGT art. 29.2.j, RD 1007/2023, Orden HAC/1177/2024). Spanish.
system_versionThe SIF version this declaration is about. Art. 13 makes the declaration per-version, so this is read from the running binary's build info and is never a stored constant.
textThe declaración responsable itself, in Spanish. It is a statement to a Spanish authority under a Spanish regulation; a translated one is a different document, so this string is rendered verbatim whatever the reader's locale.
producer_addressThe producer's address; absent when not configured.
system_built_atWhen the running build was made; absent when the build does not say.
system_nameThe name of the invoicing system; absent when not configured.
system_revisionThe exact build (VCS revision), so that «which version produced this record» has an answer no release process can blur.