Receiving Peppol documents in the Netherlands for the companies you onboard

This guide walks through everything needed to exchange Peppol documents for a company registered in the Netherlands, assuming you are integrating Recommand into your own product and onboarding Dutch companies as your users, and that the company only receives documents over Peppol. Change any of the three answers at the top of the page to get the guide for a different situation.

What you are building

You are onboarding companies that are not your own: one Recommand team, and a company inside it for every customer you put on the network. Your customers never need a Recommand account — they see your interface, and Recommand stays behind your API calls.

That shape has a few consequences worth knowing before you write code:

• One team, many companies. There is no limit on companies per team, and billing is per team with the document volume of all companies pooled together, so the more companies you onboard the lower your price per document. See pricing per team.
• Every company is registered and verified individually. Peppol identifies companies, not platforms. Each company gets its own Peppol address and its own authorisation record.
• Verification is taken care of. Recommand hands you a URL that the company's authorised representative opens to confirm their identity. You present or forward that link; you never need to handle identity documents yourself. If you prefer to handle verification yourself, reach out to us at support@recommand.eu, we have a few other flows we can set up for you.
• You can run the whole flow under your own brand. The API is designed for white-label use, see can I whitelabel Recommand.

The Recommand dashboard shows the same teams, companies and documents your API calls produce, which is the quickest way to see what a customer is looking at while you are debugging.

Peppol in the Netherlands

The Netherlands sits between Belgium and France in complexity: the network is plain Peppol, but Dutch buyers commonly expect the Dutch specialisation of EN 16931 next to Peppol BIS 3.

What is specific to the Netherlands:

• SI-UBL 2.0 (NLCIUS) alongside Peppol BIS 3. Dutch companies are registered for both, so a sender can reach them with either. Recommand can write and read both formats.
• KVK numbers are the Peppol address. Dutch companies are published under scheme 0106 (Chamber of Commerce), so a Dutch Peppol address looks like 0106:12345678. The VAT number is registered as well, under scheme 9944.
• No general B2B mandate (yet). Unlike Belgium, the Netherlands does not require electronic invoicing between businesses across the board. E-invoicing is required when invoicing Dutch central government, and Peppol is the established channel for it.

No country-specific fields are needed on the documents themselves. A valid EN 16931 invoice is accepted; sending SI-UBL is a matter of selecting that format, not of filling in extra data.

Create your team and API credentials

1. Sign up at app.recommand.eu/signup. The team you get is the container for every company you will onboard.
2. Create an API key on the API keys page. Note the key, the secret and your team ID.
3. Check the credentials with a request that needs no data of its own:

curl -X GET https://app.recommand.eu/api/v1/companies \
  -u key_xxx:secret_xxx

All endpoints in this guide live under https://app.recommand.eu/api/v1 and accept HTTP Basic authentication with the key as username and the secret as password. If you would rather not store a long-lived secret, JWT API keys and OAuth2 with a JWT assertion are available too, see the authentication guide.

Try it safely first

Build the whole flow against a playground team before you touch production. Playgrounds look and behave like production teams, but nothing is delivered over the real Peppol network, there are no SMP registrations, no subscription checks and no billing.

Create one from the team switcher at the top of the dashboard: Add playground, give it a name, and you are switched into it. There is no limit on how many you create.

Everything that follows in this guide is identical there: same endpoints, same validation, same webhooks (triggered by simulated inbound delivery). Register a company in the playground and use it as both sender and recipient to see a document arrive.

Three things worth knowing before you start:

• POST /:companyId/generate takes the same body as the send endpoint and returns the exact XML that sending would produce, fully validated, without transmitting, storing or billing it. It also returns the resolved documentType, doctypeId and processId, which is the quickest way to check that your country-specific fields map to the format and process you expect.
• Failure addresses. In a playground that is not connected to the Peppol Test Network, sending to 404:404 or 0208:1234567894 always fails, so you can exercise your error handling. Any other unregistered recipient is skipped without an error.
• The Peppol Test Network. For genuine end-to-end tests with real counterparties, tick Use Peppol Test Network when you create the playground. It then uses dedicated test access point and SMP endpoints while staying fully separated from production. The setting cannot be changed after creation, so make a second playground if you want both.

More detail in the getting started guide and how do I use the playground environment.

Register the company

Create one company per customer with the create company endpoint. Registration on the Peppol network happens as part of this call: identifiers and document types are set up for you, based on the company's country.

const auth =
  "Basic " + Buffer.from("key_xxx:secret_xxx").toString("base64");

const response = await fetch("https://app.recommand.eu/api/v1/companies", {
  method: "POST",
  headers: { Authorization: auth, "Content-Type": "application/json" },
  body: JSON.stringify(company),
});

const result = await response.json();
if (!result.success) throw new Error(JSON.stringify(result.errors));

const companyId = result.company.id;
const verificationUrl = result.verificationUrl; // hand this to your user

curl -X POST https://app.recommand.eu/api/v1/companies \
  -u key_xxx:secret_xxx \
  -H "Content-Type: application/json" \
  -d @company.json

The response carries a verificationUrl straight away. Keep it: the next step is to put it in front of the company's representative.

The exact identifier fields to send depend on the country, which is what the next section covers. If you would rather create identifiers and document types yourself instead of accepting the country defaults, pass skipDefaultCompanySetup: true and use the company identifiers and company document types endpoints.

Dutch identifiers and Peppol address

{
  "name": "Voorbeeld B.V.",
  "address": "Keizersgracht 1",
  "postalCode": "1015 CJ",
  "city": "Amsterdam",
  "country": "NL",
  "enterpriseNumber": "12345678",
  "enterpriseNumberScheme": "0106",
  "vatNumber": "NL123456789B01"
}

Both are validated against the Dutch formats — an 8-digit KVK number and a VAT number shaped like NL123456789B01 — and rejected if they do not match.

Two Peppol identifiers are registered for the company:

• 0106:12345678 — the KVK number, and the address others will use
• 9944:NL123456789B01 — the VAT number

The company's Peppol address is the first one: 0106: followed by the KVK number.

Registering as a recipient

To receive documents, the company must be published as a recipient on an SMP (Service Metadata Publisher). That is what isSmpRecipient does, and it is the default:

{
  "isSmpRecipient": true
}

What that means:

• The company becomes findable on the Peppol network: any sender can look it up and deliver to it via the Peppol network.
• Recipient registration is exclusive. If the company is already registered for receiving through another Peppol provider, registration fails until it is deregistered there.
• The document types the company accepts are registered along with it, based on its country. Which ones those are is covered further down.
• The company is only published once it is verified.

Moving an existing Dutch registration

Dutch companies are commonly already reachable over Peppol, because e-invoicing towards Dutch central government has been the norm for years and accounting software often registers the company on the sender's behalf.

There is no automatic migration for the Netherlands: the company has to be deregistered at its current provider before it can be registered here. If you do not know who that provider is, look the KVK number up as a recipient — the verify endpoint returns the SMP the company is published on.

Verify the company

A company cannot exchange documents on Peppol until an authorised representative has confirmed their identity. The company object exposes this as isVerified, and it stays false until the check is done.

For Dutch companies the flow is short:

1. Open the verification URL (from the create-company response, the dashboard, or a fresh one from the verify company endpoint).
2. The representative fills in their name and completes the identity check.
3. isVerified flips to true and the company is published on the Peppol network.

In some cases manual verification by our team will be required. If that's the case, isVerified will remain false until this manual verification is completed. The user is informed of this in the verification process.

Building verification into your onboarding

With one company you would click through this once. With many, verification is part of the flow you build: every company you register needs its own, and it is the step most likely to leave a customer stuck halfway.

Show the URL immediately. The create-company response already carries verificationUrl — no extra call needed. Put it in front of the user while they are still in your onboarding.

Ask for a fresh one when the moment has passed. Links get lost, and companies you created earlier never had one shown. The verify company endpoint starts a new verification session:

curl -X POST https://app.recommand.eu/api/v1/companies/{companyId}/verify \
  -u key_xxx:secret_xxx

The company.verification webhook fires when verification reaches a final state: verified, rejected or error. A company that comes back rejected or error and is not surfaced anywhere sits silently unusable. See working with webhooks.

Respect isVerified in your own UI. Do not let a user press send for a company that is not verified yet; this will result in an error. You should inform the user what is missing instead.

Re-verify after identifier changes. Updating a company's vatNumber or enterpriseNumber resets isVerified to false. Check the field after an update and present a new verificationUrl if it flipped.

The full mechanics are in the company verification guide.

Document types registered for you

When you register a Dutch company as a recipient, it is published for four document types, so senders can reach it with either the European or the Dutch flavour of EN 16931:

Whichever of the four a sender picks, you get the same parsed document out of the API — the format difference stays in the XML.

Need more document types, such as self-billing, message level responses, invoice responses? Register the combinations you want with the create company document type endpoint.

Get incoming documents into your product

Recommand receives, validates and stores incoming documents for every company in your team. You pick them up in one of two ways.

Webhooks (recommended)

Register an endpoint once with the create webhook endpoint or through the dashboard and events are pushed to you as they happen, document.received among them:

await fetch("https://app.recommand.eu/api/v1/webhooks", {
  method: "POST",
  headers: { Authorization: auth, "Content-Type": "application/json" },
  body: JSON.stringify(webhook), // the body below
});

curl -X POST https://app.recommand.eu/api/v1/webhooks \
  -u key_xxx:secret_xxx \
  -H "Content-Type: application/json" \
  -d @create-webhook.json

{
  "url": "https://your-app.example/webhooks/recommand",
  "companyId": null,
  "secret": "your_webhook_signing_secret"
}

companyId: null covers every company in the team.

Pass a secret and verify the HMAC SHA-256 signature on every delivery before you trust the payload. Switch on event.eventType, and acknowledge with a 200 before doing the heavy processing. Both are covered in working with webhooks.

Polling the inbox

If you would rather pull, the inbox endpoint lists unread documents:

const inbox = await fetch("https://app.recommand.eu/api/v1/inbox", {
  headers: { Authorization: auth },
}).then((r) => r.json());

Mark each document as read with the mark as read endpoint once your system has it, so it drops off the list.

After you have the document

• Fetch details, the original XML or a rendered PDF from the documents endpoints.
• Route documents to the right customer with labels and suppliers, and automate that routing with rules.
• Let Recommand mail incoming documents on to an address of your choosing when that is easier than an API call, see email delivery and notifications.

For the full picture, including retries and idempotency, see receiving documents.

Going live

Before you switch your first real customer over, walk this list:

• A valid subscription in production. Playgrounds skip the subscription check; production does not.
• Verification handled in your UI. Show the verificationUrl at the right moment, make it forwardable, and handle the company.verification webhook so a company that comes back rejected or error does not sit silently unusable.
• isVerified respected. Do not let a user press send for a company that is not verified yet; explain what is missing instead.
• Webhook endpoint hardened. Signature verification, a fast 200, retries and idempotency on your side.
• Errors surfaced, not swallowed. Validation errors name the field that is wrong; put that in front of the person who can fix it.
• One real document, end to end. Send an invoice between two companies you control on production before letting customers in.

Where to get help

• Troubleshooting. Common rejections, delivery failures and validation errors are collected in the troubleshooting guide.
• Questions. The FAQ covers Peppol, addressing, VAT and billing.
• Email. support@recommand.eu:include the company ID and, for a delivery problem, the document ID.
• Discord. Join the server for release announcements and quick questions.
• Keep track of changes. New endpoints and behaviour are recorded in the changelog.

Other guides for the Netherlands

• Sending Peppol documents in the Netherlands for the companies you onboard
• Sending and receiving Peppol documents in the Netherlands for the companies you onboard
• Sending Peppol documents in the Netherlands for your own company
• Receiving Peppol documents in the Netherlands for your own company
• Sending and receiving Peppol documents in the Netherlands for your own company