Developer Program

Build on Peppol.
Free sandbox access.

Get a 14-day developer sandbox with test API credentials, a registered Peppol participant ID, and full access to UBL validation, Schematron checks, and AS4 message exchange.

No credit card required
Provisioned within 24 hours
Full API documentation
Apply for Access

What's in the Sandbox

API Key

Prefixed sk_test_ key with read/write/send scopes and rate limiting (30 req/min).

Simulated AS4 Delivery

Four deterministic 9999:test-* receivers simulate success, timeout, validation failure, and recipient-not-found flows end-to-end.

Full Validation

UBL 2.1 XSD, EN16931 Schematron, Peppol BIS 3.0 rules, and eDEC code list checks.

API Docs

Complete OpenAPI documentation, Postman collection, and quickstart guide at docs.goroute.ai.

From sandbox to certified Peppol Access Point in four steps

Build and test your integration against the same compliance gate and AS4 stack we run in production. Flip one switch to go live on the real Peppol network with an SML-registered participant ID and a G3 certificate.

1

Apply for sandbox access

Submit the form below with a business email. Approved developers get a sk_test_ API key within 24 hours on business days.

2

Validate UBL against EN16931 & PINT

Run any invoice or credit note through our full compliance gate — UBL 2.1 XSD, CEN EN16931, Peppol BIS 3.0, PINT Oman / A-NZ / EU / SG / MY / JP, and XRechnung.

3

Send to simulated receivers

Exercise every code path — success, timeout, validation failure, recipient-not-found — against four deterministic 9999:test-* receivers with full webhook lifecycle events.

4

Upgrade & go live

Upgrade your plan and GoRoute issues a Peppol G3 certificate, registers your participant ID in the production SML, and unlocks real AS4 send and receive — no code change required.

Request Developer Access

Fill out the form below. We review requests manually and typically provision accounts within 24 hours on business days.

Must be a company or organization email. Free providers (Gmail, Yahoo, Hotmail) are not accepted.

We review applications within 24 hours on business days. You'll receive an email with your API key and test participant ID.

Every Peppol document type, every PINT jurisdiction

One API validates and routes invoices, credit notes, self-billing documents, and Tax Data Documents across the global Peppol network and every active PINT jurisdiction — no extra SDKs, no per-country plumbing.

Peppol BIS Billing 3.0

Full CEN EN16931 + Peppol BIS 3.0 Schematron validation for invoice and credit note — the baseline used across the EU and all non-PINT Peppol authorities.

PINT Oman (OM)

Official OpenPeppol PINT OM validation for billing and self-billing, plus Oman Tax Data Document (TDD) generation for CTC tax reporting to the Oman Tax Authority.

PINT A-NZ (Australia / New Zealand)

PINT Australia–New Zealand invoice, credit note, and self-billing variants — including ATO Digital Partnership Office conformance testing support for Australian eInvoicing.

PINT Singapore / Malaysia / Japan

PINT SG (IRAS InvoiceNow), PINT MY (LHDN MyInvois), and PINT JP jurisdiction packs — auto-detected from your CustomizationID with no extra configuration.

National CIUS — XRechnung & more

Country-specific CIUS packs such as XRechnung (Germany) apply conditionally per receiver, layered on top of the baseline EN16931 gate. The response reports exactly which packs matched.

Self-billing & Credit notes

Full support for self-billing invoice and credit-note profiles in every jurisdiction pack — same REST endpoint, automatic profile detection from UBL.

What developers build on the GoRoute Peppol API

A single REST interface for UBL validation, AS4 exchange, SMP lookup, webhooks, and multi-tenant isolation — enough to ship any e-invoicing product that needs to talk to Peppol.

ERP & accounting connectors

Embed Peppol-ready invoicing in SAP, Oracle, Microsoft Dynamics 365, Odoo, NetSuite, Sage, Zoho, Xero, QuickBooks, or Tally without running your own AS4 stack or Schematron engine.

SaaS billing platforms

Bolt EU, A-NZ, Singapore, Malaysia, and Oman e-invoicing compliance onto Stripe, Chargebee, Recurly, or Zuora-style products with a single vendor for 40+ jurisdictions.

Multi-tenant service providers

Become a white-label Peppol AP + SMP for your own customers with per-tenant API keys, isolated Peppol participant IDs, and delegated certificate management.

Government & CTC portals

Country-specific Continuous Transaction Control workflows — e.g. Oman TDD submission to the Oman Tax Authority, or IRAS InvoiceNow for Singapore GST — all behind one API.

Marketplace & platform payouts

Issue compliant self-billing invoices to suppliers, sellers, or gig-economy providers and receive their responses via Peppol — automated, auditable, and EN16931-valid.

Audit & compliance tooling

Run bulk /validate calls over historic invoice archives to confirm EN16931 / PINT compliance before regulator audits or Peppol certification reviews.

Four deterministic sandbox test receivers

Point your integration tests at these 9999:test-* receivers to exercise every code path. Each returns a predictable outcome end-to-end, including webhook lifecycle events.

Test case Receiver ID Simulated outcome
Success 9999:test-success Moves queued → sending → sent; fires document.sent webhook
Timeout 9999:test-timeout Automatic retry then fails with error_code=TIMEOUT
Validation failure 9999:test-validation-failure Simulated receiver rejection; fails with VALIDATION_ERROR
Recipient not found 9999:test-recipient-not-found Simulated SMP lookup miss; fails with RECIPIENT_NOT_FOUND

Developer FAQ

How long does sandbox provisioning take?

We manually review every application and typically provision sandbox accounts within 24 hours on business days. You receive an email with your API key, sandbox base URL, and test receiver identifiers.

What happens when my sandbox API key expires?

Your sandbox key stops working at the expiry date. Email admin@goroute.ai before expiry to extend it, or upgrade to a paid production plan with an SML-registered Peppol participant ID and a G3 certificate.

What are the sandbox rate limits?

Developer sandbox keys are limited to 30 requests per minute and 1,000 requests per day — enough for integration testing and CI pipelines. Production plans have substantially higher limits with burst allowances.

Can I send real Peppol invoices from the sandbox?

No. The sandbox only delivers to four deterministic 9999:test-* receivers hosted by GoRoute — test-success, test-timeout, test-validation-failure, and test-recipient-not-found. Production AS4 delivery to real Peppol participants is enabled when you upgrade to a paid plan.

Why do I need a business email to apply?

We require a business email to verify applicants represent a legitimate organization. This prevents abuse and keeps sandbox resources available for real integration projects.

Does the sandbox run full EN16931 and Peppol BIS 3.0 Schematron validation?

Yes. Every invoice and credit note passes through the same five-layer compliance gate as production: UBL 2.1 XSD, business rules, eDEC code lists, baseline CEN EN16931 + Peppol BIS 3.0 Schematron, and any applicable PINT or national CIUS pack. Sandbox results are identical to production outcomes.

Which PINT jurisdictions does the API support?

GoRoute validates PINT Oman (OM), PINT Australia–New Zealand (A-NZ), PINT EU, PINT Singapore, PINT Malaysia, and PINT Japan — for both billing and self-billing, invoice and credit note. The correct pack is auto-selected from your CustomizationID.

Does GoRoute validate XRechnung and other national CIUS packs?

Yes. XRechnung (Germany) and other national CIUS packs are applied conditionally per receiver on top of the baseline EN16931 gate. The API reports which CIUS packs were matched in the validation response.

How do I send an AS4 message to a sandbox test receiver?

POST your UBL XML to /api/v1/send with a receiver of 9999:test-success (or any of the four simulated receivers). GoRoute runs the full compliance gate and then simulates AS4 delivery, emitting document.sent, document.failed, and related webhook events exactly as production would.

How do I receive invoices and handle lifecycle webhooks?

Configure a webhook URL in your tenant dashboard. GoRoute POSTs document.received, document.validated, document.sent, document.failed, and document.delivered events with HMAC-signed payloads, retries with exponential backoff, and dead-letter logging.

Can I perform Peppol SMP lookups through the API?

/api/v1/smp/lookup accepts any ISO 6523 participant identifier and returns the document types and processes the receiver supports, along with the receiving AP endpoint. In sandbox, lookups against 9999:test-* receivers return deterministic simulated metadata.

Is there a Postman collection, OpenAPI spec, and code samples?

Yes. Full OpenAPI 3.1 specification, Postman collection, and Python / Node.js / cURL code samples are published at docs.goroute.ai and linked from your sandbox welcome email.

What changes when I upgrade from sandbox to production?

Your API key switches from sk_test_ to sk_live_, GoRoute issues a Peppol G3 certificate for your organization, registers your real participant ID in the production SML, and unlocks AS4 send and receive against the live Peppol network. The API surface is identical — no code change required.

How is multi-tenant data isolation enforced?

Every request is scoped to your org_id via the X-API-Key header, and every database query is filtered by tenant. Certificates, keystores, participant IDs, webhooks, and audit trails are isolated per tenant. GoRoute is ISO 27001 certified with a public Statement of Applicability.

Ready to Get Started?

Book a demo with our team to see how GoRoute can simplify your e-invoicing compliance.