DEMONSTRATION LEGAL DATA · Licence XXX-YYY is demonstration data and must be replaced with official evidence before production publication.
Mobile-ID · Digital Trust Platform
ISO/IEC 27001:2022Security policyService policyService status
MOBILE-ID TRUST SERVICES

Developer Portal

Integrate Trusted Delivery through REST API, signed webhooks, OAuth 2.1, mTLS, AS4/eDelivery and structured evidence.

DEVELOPER ONBOARDING

Four steps from sandbox to production

Technical assets in v3 are secure implementation samples and contain no production endpoint, secret or certificate.

01

Request sandbox

Define use case, volume, callback and identity requirements.

02

Configure security

OAuth 2.1 client, mTLS, IP policy and webhook signing key.

03

Test events

Submission, consignment, handover, failure and evidence retrieval.

04

Production review

Security review, SLA, DR, capacity and operating runbook.

API-FIRST ARCHITECTURE

Reference integration architecture

API Gateway and AS4 Gateway connect to the delivery core and Evidence Engine through distinct profiles and controls.

Access channels
PortalWeb / Mobile
REST APIOAuth 2.1 / mTLS
AS4eDelivery
ConnectorsERP / DMS / BPM
WebhookSigned events
Identity layer
Sender IDVNeID / eID / OIDC
Recipient IDPerson / Legal entity
AuthorityRepresentation
PolicyIAL / AAL
ConsentPurpose binding
Delivery core
S-ERDSSubmission
RoutingPolicy engine
R-ERDSConsignment
HandoverPush / Pull
StatusLifecycle events
Evidence layer
Event modelETSI-aligned
Evidence EngineHash / metadata
eSealService signature
TSATrusted time
VaultLong-term archive
Trust infrastructure
HSMKey protection
PKICertificates
OCSP / CRLStatus
AuditTamper-evident logs
BCP / DRContinuity
CODE SAMPLES

API samples with error controls

Samples illustrate validation, timeout, idempotency, bounded retry and avoiding secret logging.

curl --request POST https://sandbox.example/v1/consignments \
  --cert client.crt --key client.key \
  --header "Authorization: Bearer ${TOKEN}" \
  --header "Idempotency-Key: 04df..." \
  --header "Content-Type: application/json" \
  --data '{"recipient":{"type":"legal_entity","id":"DEMO-001"},"contentHash":"sha256:...","callbackUrl":"https://client.example/webhooks/delivery"}' 
// Java 21 example: validate input, use idempotency and handle retryable failures.
HttpRequest request = HttpRequest.newBuilder(endpoint)
    .header("Authorization", "Bearer " + token)
    .header("Idempotency-Key", idempotencyKey)
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString(payload))
    .build();
HttpResponse<String> response = client.send(request, BodyHandlers.ofString());
if (response.statusCode() == 429 || response.statusCode() >= 500) {
    retryWithExponentialBackoff(request); // bounded, jittered retry
}
if (response.statusCode() / 100 != 2) throw new DeliveryApiException(response.body());
// Node.js: validate, send idempotently, verify the signed webhook separately.
const response = await fetch(endpoint, {
  method: 'POST',
  headers: { authorization: `Bearer ${token}`, 'idempotency-key': key,
             'content-type': 'application/json' },
  body: JSON.stringify(payload),
  signal: AbortSignal.timeout(10_000)
});
if ([429, 500, 502, 503, 504].includes(response.status)) await boundedRetry();
if (!response.ok) throw new Error(`Delivery API ${response.status}`);
# Python: typed validation, timeout and bounded retry.
with httpx.Client(cert=("client.crt", "client.key"), timeout=10.0) as client:
    response = client.post(endpoint, json=payload, headers={
        "Authorization": f"Bearer {token}",
        "Idempotency-Key": idempotency_key,
    })
    if response.status_code in {429, 500, 502, 503, 504}:
        raise RetryableDeliveryError(response.text)
    response.raise_for_status()
    result = response.json()
// .NET: use HttpClientFactory, mTLS handler, timeout and idempotency.
using var request = new HttpRequestMessage(HttpMethod.Post, endpoint);
request.Headers.Authorization = new("Bearer", token);
request.Headers.Add("Idempotency-Key", idempotencyKey);
request.Content = JsonContent.Create(payload);
using var response = await client.SendAsync(request, cancellationToken);
if ((int)response.StatusCode == 429 || (int)response.StatusCode >= 500)
    throw new RetryableDeliveryException(await response.Content.ReadAsStringAsync());
response.EnsureSuccessStatusCode();