Which events does the webhook send?

invoice.received (a received document), invoice.sent (a document handed to the network), invoice.delivered (the recipient's access point confirmed delivery with an MLS receipt), invoice.rejected (rejected by the network or in validation before sending), invoice.undeliverable (a recipient without a record in the Peppol network), invoice.reported (the report to the Financial Administration filed), invoice.report_pending, invoice.report_rejected, company.activated, company.deactivated, company.smp_registered_elsewhere and the test webhook.test. We always announce a new type in advance; the formal schemas are in the webhooks section of our OpenAPI specification.

How do I verify that a notification came from Verteco?

If the company has a secret, every delivery carries the X-Verteco-Signature header in the form sha256=HMAC-SHA256(secret, raw body) and, in parallel, the Standard Webhooks headers: webhook-id (= eventId), webhook-timestamp (unix seconds of the attempt) and webhook-signature = v1,base64(HMAC-SHA256(secret, id + "." + timestamp + "." + body)). Always compute the HMAC over the exact bytes of the body and reject a delivery whose webhook-timestamp is older than 5 minutes. You obtain the secret through POST /companies/{id}/webhook/secret; it is returned once and a rotation generates a new one.

What happens when my server is temporarily unavailable?

The notification is not lost. It is stored in an outbox and on failure we make 12 attempts with exponential spacing from 30 seconds to 8 hours (about 16 hours in total); then it ends as a dead letter with redelivery and an e-mail alert and is visible in the portal's Realtime log. The X-Verteco-Delivery-Id header and the eventId field are the same on every retry, so deduplicate by them.

Do I have to use webhooks, or is polling enough?

Webhooks are a complement, not a requirement. You get the same information through GET /sapi/document/sent and GET /sapi/document/receive with the ?since and ?until parameters; the recommended interval is 1 to 5 minutes. The webhook URL must be public and https:// in production; loopback and local addresses are blocked by the SSRF protection.

When do the webhooks actually start arriving?

Only once the company is active in the Peppol network, that is after selecting Verteco as the provider on the Financial Administration portal, and actually receives or sends documents. The company.activated event announces that moment. You can send yourself the test notification webhook.test at any time with the Test webhook button in the company detail.

How much does it cost?

The connection is free. The service costs from €2/month excl. VAT per company ID (IČO) that sends or has the Data archive switched on; receiving with the archive off is free (up to 1,000 invoices a month). During the voluntary period before the mandate of 1 January 2027 everything is free of charge.

Integrations / For developers / Webhooky

Webhooks

Available

The portal sends a signed event to your URL when an invoice is received, handed over, delivered, rejected or reported to the Financial Administration, so you do not have to poll for the status of e-invoices. Delivery is durable: the event is stored in an outbox and if your server is down we make 12 attempts spaced from 30 seconds to 8 hours (about 16 hours in total), after which it ends in a dead letter that can be redelivered. The webhook is set per company in its detail on the Notifications tab.

Get the plugin in the portal Create a free account

How it works

1In the portal open the company detail and the Notifications tab. Enter the public https:// URL of your system in the Webhook for notifications field and click Save notifications.
2Click Test webhook: the portal sends a signed webhook.test event to the saved URL and shows what it sent and what came back (status, response body, duration).
3Obtain the signing secret through the API: POST /companies/{id}/webhook/secret returns it once. In your system verify the X-Verteco-Signature header (sha256=HMAC-SHA256 over the exact bytes of the body) or the Standard Webhooks headers (webhook-id, webhook-timestamp, webhook-signature).
4Process events idempotently by eventId, reject a delivery whose webhook-timestamp is older than 5 minutes, respond 2xx within 15 seconds and defer heavier processing to your own queue. Respond 2xx to an unknown event type and log it.

What the integration solves

✓Events invoice.received, invoice.sent, invoice.delivered, invoice.rejected, invoice.undeliverable and invoice.reported plus company states (company.activated and others)
✓Two signatures at once: X-Verteco-Signature (HMAC-SHA256) and the headers of the Standard Webhooks specification (webhook-id, webhook-timestamp, webhook-signature)
✓Durable delivery: an outbox, a 15 s timeout, 12 attempts spaced from 30 seconds to 8 hours (about 16 hours in total), then a dead letter with redelivery, an e-mail alert and an entry in the Realtime log
✓eventId and occurredAt in every event: an unambiguous key for deduplication and the time of origin for ordering
✓The times sentAt, deliveredAt, receivedAt and fsReportedAt in the invoice.* events as proof of sending, delivery and the report to the Financial Administration
✓A webhook per company with its own URL and secret; with one API token you set it for every company you own

Frequently asked questions: e-invoices for Webhooky

Which events does the webhook send?: invoice.received (a received document), invoice.sent (a document handed to the network), invoice.delivered (the recipient's access point confirmed delivery with an MLS receipt), invoice.rejected (rejected by the network or in validation before sending), invoice.undeliverable (a recipient without a record in the Peppol network), invoice.reported (the report to the Financial Administration filed), invoice.report_pending, invoice.report_rejected, company.activated, company.deactivated, company.smp_registered_elsewhere and the test webhook.test. We always announce a new type in advance; the formal schemas are in the webhooks section of our OpenAPI specification.
How do I verify that a notification came from Verteco?: If the company has a secret, every delivery carries the X-Verteco-Signature header in the form sha256=HMAC-SHA256(secret, raw body) and, in parallel, the Standard Webhooks headers: webhook-id (= eventId), webhook-timestamp (unix seconds of the attempt) and webhook-signature = v1,base64(HMAC-SHA256(secret, id + "." + timestamp + "." + body)). Always compute the HMAC over the exact bytes of the body and reject a delivery whose webhook-timestamp is older than 5 minutes. You obtain the secret through POST /companies/{id}/webhook/secret; it is returned once and a rotation generates a new one.
What happens when my server is temporarily unavailable?: The notification is not lost. It is stored in an outbox and on failure we make 12 attempts with exponential spacing from 30 seconds to 8 hours (about 16 hours in total); then it ends as a dead letter with redelivery and an e-mail alert and is visible in the portal's Realtime log. The X-Verteco-Delivery-Id header and the eventId field are the same on every retry, so deduplicate by them.
Do I have to use webhooks, or is polling enough?: Webhooks are a complement, not a requirement. You get the same information through GET /sapi/document/sent and GET /sapi/document/receive with the ?since and ?until parameters; the recommended interval is 1 to 5 minutes. The webhook URL must be public and https:// in production; loopback and local addresses are blocked by the SSRF protection.
When do the webhooks actually start arriving?: Only once the company is active in the Peppol network, that is after selecting Verteco as the provider on the Financial Administration portal, and actually receives or sends documents. The company.activated event announces that moment. You can send yourself the test notification webhook.test at any time with the Test webhook button in the company detail.
How much does it cost?: The connection is free. The service costs from €2/month excl. VAT per company ID (IČO) that sends or has the Data archive switched on; receiving with the archive off is free (up to 1,000 invoices a month). During the voluntary period before the mandate of 1 January 2027 everything is free of charge.

Start today: selecting us on the Financial Administration portal is enough

Receiving is free · no lock-in, no hidden feesMeet your 2027 legal obligation in 2 minutes

Choose Verteco on the Financial Administration portal →On the portal, click “Pokračovať” (Continue), sign in (slovensko.sk / eID or your FS portal credentials) and confirm the selection. We handle the rest automaticallyCertified provider of the Financial Administration (EFSK000031) · no commitment · you can change providers at any time

How does the selection work? (3 steps, ~2 minutes)

1Click the button above. The official Financial Administration page “Certified provider selection” opens with Verteco pre-selected. Click “Pokračovať” (Continue).
2Sign in to the Financial Administration portal, via slovensko.sk (eID / ID card with a chip) or with your PFS credentials, and confirm the provider selection.
3Done. A sign-in e-mail arrives. We create your account, company and Peppol network registration automatically. If another provider already holds your receiving record, we do not take it over: you get the migration-code procedure, or you choose in the portal that receiving stays with them and you only send through us.
No eID? You can also sign in to the Financial Administration portal with your PFS identifier and password. Or register here with an e-mail and password, add your company manually and finish the selection later.
Your company is not offered in the “taxpayer selection” step? Only entities you are authorised for on the FS portal appear. Add the authorisation in your Personal Internet Zone (Autorizácie → Pridať autorizovaného používateľa), then finish the selection.
Detailed guide to the FS portal selection (in Slovak) →