Peppol identifier verification

Before an account can send invoices in production, each Peppol identifier is verified against a public business registry. This page explains what that means, why we do it, and what to do if verification fails.

Why we verify

The Peppol network assumes senders are who they say they are. Our Integrator agreement with OpenPeppol requires us to make a reasonable effort to prevent invoices from being sent on behalf of entities unrelated to the sender. Verification is how we do that.

What we check

  • That your identifier (e.g. a French SIREN or a Belgian enterprise number) exists in the relevant public registry.
  • That the legal name you declared is a close match to the registered name.

We verify against VIES, INSEE (France), KBO/CBE (Belgium) and Bolagsverket (Sweden). The United Kingdom is the exception: the only UK identifier the Peppol network routes is the VAT number, and we do not yet check it against HMRC automatically — a UK registration is reviewed by hand before it can send. Companies House verifies a company registration number, which Peppol does not route.

What happens at registration

  1. You add a production Peppol identifier in the dashboard, including the declared company name and the attestation checkbox.
  2. We begin verification immediately. Most checks complete in under a minute.
  3. Until verification succeeds, invoice sending is paused for that identifier.
  4. We email you when the outcome is resolved.

Verification states

The API returns a verificationState field on every Peppol identifier. The dashboard surfaces a human-readable badge for each.

API valueDashboard badgeMeaning
sandbox_autoSandbox auto-approvedSandbox only — auto-approved without registry lookup.
unverifiedQueued…Waiting for verification to start.
verifyingVerifying…Currently checking against the registry.
verified✓ VerifiedMatched. Invoice sending is unlocked for this identifier.
mismatch⚠ Needs reviewIdentifier exists but the declared name doesn't match closely enough.
not_found⚠ Not foundThe identity could not be established. Either the registry has no entry for the identifier; or it has one but doesn't consider the entity active (struck off, in liquidation, or not yet active); or our team reviewed the identity and declined it.
api_errorTemporarily unavailableRegistry is down. The cron retries automatically every 5 minutes.
manually_approved✓ Approved (reviewed)Manually approved by our team after review.

If verification fails

Reply to the notification email with proof of authorisation (for example your Articles of Incorporation or an extract from the public registry showing your entity), or email us at hello@getpeppr.dev. Our team typically responds within one business day.

Sandbox accounts

Standard sandbox onboarding auto-registers a Storecove test identifier and marks it sandbox_auto. Platform customer Legal Entities are different: their requested identifiers still go through the sub-tenant verification and network-registration flow, so fake or unsupported numbers can fail even in sandbox.

If you do not have real customer numbers yet, register your test customers under scheme 9915, which the published Peppol code list annotates with the usage note “No entity behind id”. No company stands behind such an identifier, so there is no registry to query, and none is consulted. The sub-tenant is still published on the Peppol test network and can send, so the whole platform flow stays exercisable without registering a number that belongs to somebody else.

Values follow the published format [A-Z][A-Z0-9]* — upper-case letters and digits, starting with a letter, for example 9915:ACMETEST01. The resulting status is no_registry, never verified: it says the identifier is registered and routable on the test network, and says nothing about a company existing or about your right to act for it. Registering this scheme with a production key is refused.

The Peppol test network has a public directory. Everything you register there — the identifier value, the company name and the address you declare — becomes visible to anyone, and the identifier namespace is shared with every other tester. So: use synthetic company details, never a real customer’s name or address, and pick a value that is distinctly yours (9915:ACMETEST01, not 9915:TEST) — a value somebody else already registered comes back as a registration failure.