# Flowie Exchange API

> One REST API for sending, receiving, and managing electronic invoices across every e-invoicing network — Peppol, France PPF, Italy SDI, KSA Fatoora, Israel ITA, India GST IRP, Malaysia MyInvois, and more. Covers 47 countries across Europe, MENA, and Asia-Pacific; auto-reports lifecycle to FR PPF and IT SDI; supports white-label / multi-tenant platform integrations.

This file follows the [llms.txt](https://llmstxt.org) standard. It exposes the Flowie Exchange API documentation in a form that is fast and unambiguous for large language models to ingest.

**Base URLs**
- Production: `https://back.p2p-flowie.com`
- Sandbox: `https://back.flowie.ink`

**Versioning**: All endpoints below are under `/v1/`. Breaking changes ship under `/v2/…` with a 12-month deprecation window.

**Authentication**: `Authorization: Bearer <token>` — accepts either a Flowie JWT or an Exchange API key (`flw_live_…`, `flw_plat_live_…`, `flw_wl_live_…`, or their `_test_` variants).

**Get a sandbox key without signup** (rate-limited 120/IP/hr):
`POST https://back.flowie.ink/exchange/v1/sandbox/bootstrap` returns a fresh `flw_test_…` key + a starter sandbox company. Pass `{"keyType": "platform"}` (or `"white_label"`) to mint a platform-typed key (`flw_plat_test_…` / `flw_wl_test_…`) that satisfies the platform-key gate on `/v1/platform/*`.

**Need to act on a real user's account?** Two options. (a) **Handoff token** — the human generates a personalized URL on the [home page](https://docs.get-flowie.com/index.html#agent-handoff) and pastes it to you; you redeem it with a single POST to `/v1/oauth/handoff/exchange` and get a key bound to their org. (b) **OAuth consent with PKCE** — you show the user a consent URL, they approve scopes, you exchange the code. See *AI agents — onboarding* below.

---

## AI agents — onboarding

If you are an AI agent reading this index, start here. **Check the URL you were given first** — if it contains `?handoff=hand_…`, jump to Path 1 (Handoff). Otherwise, three paths exist:

**Path 1 — Handoff token (the user pre-approved you).** A human pasted you a URL like `https://back.flowie.ink/exchange/docs-public/build-with-ai/agent-onboarding.html?handoff=hand_…`. The token is single-use, ≤60 min TTL, scope-bounded, and the issued key is bound to the user's **real organization** (not a fresh sandbox). Just one POST:

```
POST https://back.flowie.ink/exchange/v1/oauth/handoff/exchange
Content-Type: application/json
{"handoff_token": "hand_AbC..."}
```

Returns `{access_token: "flw_test_…" or "flw_live_…", scopes, expires_in, organization_id, company_id}`. Use `access_token` as the `Authorization: Bearer …` for every subsequent call. This is the fastest path — no PKCE, no consent UI.

**Path 2 — Sandbox bootstrap (no human involved).** One POST, no auth, returns a 7-day `flw_test_…` key + a starter sandbox company. Use for prototyping, demos, MCP playgrounds, agent CI:

```
POST https://back.flowie.ink/exchange/v1/sandbox/bootstrap
Content-Type: application/json
{"label": "my-agent"}
```

**Path 3 — OAuth consent flow (one-time human approval).** RFC 7636 PKCE, public clients, sandbox-issued keys for v1. Four steps:

1. `POST /v1/oauth/authorize` with `{client_name, scopes, code_challenge, code_challenge_method: "S256", state?}` → returns `{request_id, consent_url, expires_in: 600}`.
2. Show the user the `consent_url`. They sign in if needed, review the scope list, click Approve.
3. Server returns a one-time `auth_code` (5-min TTL) — either rendered on screen for OOB (`urn:ietf:wg:oauth:2.0:oob`) or via a redirect.
4. `POST /v1/oauth/token` with `{grant_type: "authorization_code", code, code_verifier}` → returns `{access_token: "flw_test_…", scopes, expires_in, organization_id, company_id}`.

The PKCE `code_verifier` is a 43-128 char random string the agent keeps secret until step 4. The `code_challenge` is `BASE64URL(SHA256(code_verifier))` with no padding.

**Endpoints:**
- [Agent onboarding guide](https://docs.get-flowie.com/build-with-ai/agent-onboarding.html): Full walkthrough — handoff + sandbox + OAuth, with Claude Desktop / Python / curl recipes.
- [POST /v1/oauth/handoff/exchange](https://docs.get-flowie.com/build-with-ai/agent-onboarding.html#handoff): Path 1 — single-use redemption of a pre-approved token. No other auth required.
- [POST /v1/oauth/handoff](https://docs.get-flowie.com/build-with-ai/agent-onboarding.html#handoff): Authenticated; user generates a handoff URL to paste to their agent.
- [POST /v1/oauth/handoff/sandbox](https://docs.get-flowie.com/build-with-ai/agent-onboarding.html#handoff): Anonymous variant — mints a fresh sandbox org + handoff token in one call. Powers the home-page auto-minted URL so an agent given the bare URL is already authenticated to a fresh sandbox.
- [GET /v1/oauth/scopes](https://docs.get-flowie.com/build-with-ai/agent-onboarding.html#scopes): Public scope catalogue (13 scopes — `send`, `documents.read`, `lifecycle`, `compliance`, etc.). No auth.
- [POST /v1/oauth/authorize](https://docs.get-flowie.com/build-with-ai/agent-onboarding.html#oauth): Path 3 step 1 — register consent intent.
- [POST /v1/oauth/token](https://docs.get-flowie.com/build-with-ai/agent-onboarding.html#pkce): Path 3 step 4 — exchange auth code + PKCE verifier for an API key.
- [POST /v1/sandbox/bootstrap](https://docs.get-flowie.com/sandbox/index.html#keys): Path 2 (no consent needed; sandbox-only).
- [Build with AI](https://docs.get-flowie.com/build-with-ai/index.html): Once you have a key, connect via MCP for native tool calls.

---

## Foundations

- [Introduction](https://docs.get-flowie.com/index.html): Landing page with quickstart in 8 languages.
- [API reference](https://docs.get-flowie.com/reference/index.html): Every endpoint, with parameters, request/response schemas, and idiomatic code samples.
- [Data model](https://docs.get-flowie.com/reference/data-model.html): Entity-relationship diagram + per-resource field reference.
- [Document & invoice types](https://docs.get-flowie.com/reference/document-types.html): Every `type` value (invoice, credit-note, debit-note, orders, quote, event), every invoice subtype (prepayment 386, corrected 384, self-billed 389), and how self-billing vs reverse-charge self-invoicing differ.
- [Authentication](https://docs.get-flowie.com/reference/index.html#authentication): JWT vs API key, scopes, key types.
- [Idempotency](https://docs.get-flowie.com/reference/index.html#idempotency): `Idempotency-Key` header, 24h cache, retry semantics.
- [Pagination](https://docs.get-flowie.com/reference/index.html#pagination): Cursor-based, with `limit`, `cursor`, `hasMore`.
- [Rate limits & quotas](https://docs.get-flowie.com/reference/index.html#rate-limits): Per-tier, with `X-RateLimit-*` headers.
- [Errors](https://docs.get-flowie.com/reference/errors.html): Every error code with cause and remediation.
- [Versioning](https://docs.get-flowie.com/reference/index.html#versioning): Sunset header policy, additive vs breaking changes.

## Resources (REST)

- [Companies](https://docs.get-flowie.com/reference/index.html#companies): Register a Peppol-capable legal entity. Auto-enrichment, SMP registration. CRUD + resolve, search, join requests.
- [Documents](https://docs.get-flowie.com/reference/index.html#documents): Send, receive, list, search, download (XML/PDF), and tag invoices, credit notes, debit notes, purchase orders.
- [Lifecycle](https://docs.get-flowie.com/reference/index.html#lifecycle): Business-level state machine (`issued → under_review → approved → paid`) with allowed-transition enforcement and auto-compliance reporting.
- [Directory](https://docs.get-flowie.com/reference/index.html#directory): Search the public Peppol directory, lookup any participant, verify reachability before sending.
- [Partners](https://docs.get-flowie.com/reference/index.html#partners): Per-company contact book with default routing settings.
- [Webhooks](https://docs.get-flowie.com/reference/index.html#webhooks): HTTPS subscription endpoints for events. CRUD + secret rotation.
- [Events](https://docs.get-flowie.com/reference/index.html#events): Durable event log + replay endpoint (GET `/v1/events`, POST `/v1/events/{id}/replay`).
- [Compliance](https://docs.get-flowie.com/reference/index.html#compliance): Status & report records for PPF/SDI/HERMES.
- [Stats](https://docs.get-flowie.com/reference/index.html#stats): Per-period usage (sent/received/delivered/failed) by company/country/type.
- [Platform](https://docs.get-flowie.com/reference/index.html#platform): Multi-tenant onboarding, platform-key management, branding, per-tenant usage.
- [API keys](https://docs.get-flowie.com/reference/index.html#api-keys): Self-service create / list / revoke.
- [Categorization](https://docs.get-flowie.com/reference/index.html#categorization): Tag groups + AI suggest.
- [Payments](https://docs.get-flowie.com/reference/index.html#payments): Document payment info, record payment, ISO 20022 / SEPA export.
- [Requests](https://docs.get-flowie.com/reference/index.html#requests): GET `/v1/requests/{requestId}` returns the captured failed request envelope (debug inspector).

## Build with AI

- [Build with AI hub](https://docs.get-flowie.com/build-with-ai/index.html): The AI surface hub — MCP servers, agent-ready docs (llms.txt), and self-service agent onboarding. Full MCP guide: Claude Desktop / Claude Code / Cursor / Python configs + worked workflows (list, send, mark paid, onboard).
- [MCP curated endpoint](https://docs.get-flowie.com/build-with-ai/index.html#endpoints): `https://back.p2p-flowie.com/exchange/mcp` (prod) / `https://back.flowie.ink/exchange/mcp` (sandbox) — 34 tools across Documents, Directory, Companies, Lifecycle, Compliance, Partners. Streamable-HTTP transport.
- [MCP full endpoint](https://docs.get-flowie.com/build-with-ai/index.html#endpoints): `…/exchange/mcp/full` — every documented FastAPI op (94 tools), including admin / sandbox / AFNOR / platform routes.
- [MCP authentication](https://docs.get-flowie.com/build-with-ai/index.html#auth): Same Bearer token as REST (JWT or `flw_*`); the original Authorization header is forwarded to the underlying handler.
- [MCP tool catalog](https://docs.get-flowie.com/build-with-ai/index.html#tools): Per-operation MCP tools — `send_document`, `list_documents`, `update_lifecycle`, `search_directory`, `verify_recipient`, `resolve_company`, etc.
- [MCP direct HTTP](https://docs.get-flowie.com/build-with-ai/index.html#raw-http): JSON-RPC over HTTP POST — `initialize` → `tools/list` → `tools/call` if you don't want the SDK.
- [Docs for agents](https://docs.get-flowie.com/build-with-ai/index.html#docs-for-agents): Machine-readable docs — `llms.txt` (page index), `llms-full.txt` (whole corpus), and one Markdown slice per endpoint under `llms/reference/`.

## Sandbox & testing

- [Inbound: ERP webhooks → /v1/documents/send](https://docs.get-flowie.com/guides/index.html#ingest): How to wire Dynamics 365 / SAP / NetSuite / Sage / custom systems as inbound sources. Full payload-shape matrix (json / ubl-xml / file=auto / file=raw) × six document types.
- [Order integrations: Quote → SO → PO → Invoice](https://docs.get-flowie.com/guides/index.html#order-flow): S2P and O2C playbooks with cross-references and three-way matching.
- [Sandbox guide](https://docs.get-flowie.com/sandbox/index.html): Every test scenario as a row.
- [Bootstrap a key](https://docs.get-flowie.com/sandbox/index.html#keys): `POST /v1/sandbox/bootstrap` (no auth, 120/IP/hr).
- [Key types](https://docs.get-flowie.com/sandbox/index.html#key-types): Personal / platform / white-label sandbox keys.
- [Sandbox shortcuts](https://docs.get-flowie.com/sandbox/index.html#sandbox-shortcuts): Per-route table of what's synthesised under sandbox keys.
- [Test VAT registry](https://docs.get-flowie.com/sandbox/index.html#test-vats): Magic VATs (e.g. `BE0000000001` happy, `BE0000000404` not-found).
- [Test Peppol IDs](https://docs.get-flowie.com/sandbox/index.html#test-peppol): `0208:TEST_OK`, `0208:TEST_AP_FAIL`, `0208:TEST_TIMEOUT`, etc.
- [Recipient simulators](https://docs.get-flowie.com/sandbox/index.html#test-recipients): Multi-step lifecycle: `0208:SIM_HAPPY`, `SIM_DISPUTE`, `SIM_PARTIAL`.
- [Force any error](https://docs.get-flowie.com/sandbox/index.html#test-errors): `X-Sandbox-Force-Error` header → forced 400/401/403/404/409/422/429/500/503.
- [Force a rate-limit](https://docs.get-flowie.com/sandbox/index.html#test-rate): `POST /v1/sandbox/rate-limit/exhaust`.
- [Time-travel](https://docs.get-flowie.com/sandbox/index.html#test-clock): `POST /v1/sandbox/clock/advance` (`s|m|h|d|w|y`).
- [Reset](https://docs.get-flowie.com/sandbox/index.html#test-reset): `POST /v1/sandbox/reset` to wipe events/idempotency.
- [Live API playground](https://docs.get-flowie.com/playground/index.html): Browser-side request runner.
- [Request inspector](https://docs.get-flowie.com/playground/requests.html): Look up any `requestId` from an error response.
- [Webhook fixtures](https://docs.get-flowie.com/fixtures/index.html): Downloadable JSON for every event type.

## Webhooks

- [Webhook cookbook](https://docs.get-flowie.com/reference/webhooks.html): Event catalog, payload shape, signing, retries, replay.
- [Event catalog](https://docs.get-flowie.com/reference/webhooks.html#events): `document.received`, `document.sent`, `document.delivered`, `document.failed`, `document.updated`, `lifecycle.updated`, `company.smp_registered`, `compliance.reported`, `compliance.reported.failed`.
- [HMAC signing](https://docs.get-flowie.com/reference/webhooks.html#signing): `X-Flowie-Signature: t=<unix>,v1=<sha256-hex>` over `t + "." + raw_body`. Reject if `|now - t| > 5min`.
- [Retry schedule](https://docs.get-flowie.com/reference/webhooks.html#retries): 8 attempts at 0s / 30s / 2m / 10m / 30m / 2h / 6h / 12h. Auto-pause after 8 consecutive failures.
- [Interactive verifier](https://docs.get-flowie.com/reference/webhooks.html#verifier): Browser-side HMAC verification widget.

<!-- ENDPOINT-INDEX:begin (generated by scripts/build_llms_endpoint_index.py) -->

## Endpoint index

Every operation in the API (112 across 23 groups), generated from [openapi.json](https://docs.get-flowie.com/openapi.json). Paths are relative to the base URL (`https://back.p2p-flowie.com/exchange` in production, `https://back.flowie.ink/exchange` in sandbox). Unless a line says otherwise, every call takes `Authorization: Bearer <key>`. Full parameters, request bodies and examples: [API reference](https://docs.get-flowie.com/reference/index.html).

### Sandbox

- `POST /v1/sandbox/bootstrap` — Self-serve a fresh sandbox API key + starter company (no auth)
- `POST /v1/sandbox/clock/advance` — Fast-forward a sandbox company's virtual clock
- `POST /v1/sandbox/clock/reset` — Snap a sandbox company's virtual clock back to now
- `POST /v1/sandbox/idempotency/flush` — Drop every idempotency entry stored for the calling key
- `POST /v1/sandbox/rate-limit/exhaust` — Force the caller's org into a 429-loop for N seconds
- `POST /v1/sandbox/reset` — Wipe sandbox events / idempotency cache for the caller

### OAuth

- `POST /v1/oauth/authorize` — Step 1 of the consent flow — register intent, get a consent URL
- `POST /v1/oauth/handoff` — Generate a pre-approved, single-use link to share with an AI agent
- `POST /v1/oauth/handoff/exchange` — Redeem a handoff token for an API key (single-use, no auth)
- `POST /v1/oauth/handoff/sandbox` — Anonymous sandbox handoff — bootstrap a fresh org + mint a handoff token
- `GET /v1/oauth/scopes` — Public scope catalogue (no auth required)
- `POST /v1/oauth/token` — Exchange the consent auth code (with PKCE) for an API key

### Companies

- `GET /v1/companies` — List companies the caller can manage
- `POST /v1/companies` — Create (or find-and-link) a company from a VAT number
- `POST /v1/companies/import` — Onboard a company for portability migration (SIRET-first)
- `POST /v1/companies/import/batch` — Import many Sovos companies in one call (bulk portability migration)
- `GET /v1/companies/join-requests` — List the current user's pending join requests
- `GET /v1/companies/resolve` — Resolve (and lazily create) a company from VAT / SIREN
- `GET /v1/companies/search` — Autocomplete search in public registries (not yet in Flowie)
- `DELETE /v1/companies/{company_id}` — Deregister a company from Peppol
- `GET /v1/companies/{company_id}` — Get a company by id, `vat:<VAT>`, or `peppol:<scheme:id>`
- `PATCH /v1/companies/{company_id}` — Update a company (partial / JSON merge-patch semantics)
- `POST /v1/companies/{company_id}/join` — Request to join a company (as the calling user)
- `POST /v1/companies/{company_id}/join-requests/{request_id}/accept` — Accept a pending join request (org admin)
- `POST /v1/companies/{company_id}/join-requests/{request_id}/reject` — Reject a pending join request (org admin)
- `POST /v1/companies/{company_id}/register` — Deploy a company on Peppol (via Sovos) and activate registration

### Documents

- `GET /v1/documents` — List documents with filters and cursor pagination
- `POST /v1/documents/search` — Search documents with a structured filter body (POST variant of GET /documents)
- `POST /v1/documents/send` — Send a document (invoice, credit-note, order, quote, event) over Peppol
- `POST /v1/documents/send/batch` — Send many documents in a single call
- `POST /v1/documents/validate` — Validate a document body without sending it
- `GET /v1/documents/{document_id}` — Get the full nested representation of a single document
- `POST /v1/documents/{document_id}/actions` — Perform an inbox-style action on a document (tag, archive, assign, link, …)
- `GET /v1/documents/{document_id}/pdf` — Download a PDF rendering of a document
- `GET /v1/documents/{document_id}/structured` — Get a flat agent-friendly view of a single document
- `GET /v1/documents/{document_id}/xml` — Download the canonical UBL XML for a document

### Lifecycle

- `POST /v1/documents/by-number/{number}/lifecycle` — Transition a document to a new lifecycle status, targeted by invoice number
- `POST /v1/documents/lifecycle/batch` — Transition many documents in one call
- `GET /v1/documents/{document_id}/lifecycle` — Read a document's lifecycle history and current status
- `POST /v1/documents/{document_id}/lifecycle` — Transition a document to a new lifecycle status

### Directory

- `GET /v1/directory/search` — Search the Peppol directory and the French PPF annuaire
- `POST /v1/directory/verify` — Verify a Peppol recipient can receive a given document type
- `GET /v1/directory/{peppol_id}` — Look up a single Peppol participant by ID

### Webhooks

- `GET /v1/webhooks` — List webhooks registered for the caller's organization
- `POST /v1/webhooks` — Register a new webhook endpoint
- `DELETE /v1/webhooks/{webhook_id}` — Delete a webhook subscription
- `PATCH /v1/webhooks/{webhook_id}` — Update a webhook's URL, event list, or signing secret

### Events

- `GET /v1/events` — List unacknowledged events for the caller's organization
- `POST /v1/events/ack` — Acknowledge a batch of events in a single call
- `POST /v1/events/{event_id}/ack` — Acknowledge a single event so it stops appearing in /v1/events
- `POST /v1/events/{event_id}/replay` — Re-deliver a previously emitted event to subscribed webhooks

### Partners

- `GET /v1/partners` — List partners (union of book-of-relations + org-v2 partnerships)
- `POST /v1/partners` — Create a partner (supplier / buyer / both)
- `GET /v1/partners/by-account-number` — Resolve a partner by an internal account number (custom field)
- `DELETE /v1/partners/{partner_id}` — Delete a partner
- `GET /v1/partners/{partner_id}` — Get a partner by id, `vat:<VAT>`, or `peppol:<scheme:id>`
- `PATCH /v1/partners/{partner_id}` — Update a partner (partial / JSON merge-patch semantics)
- `GET /v1/partners/{partner_id}/invoices` — List invoices exchanged with a partner

### Purchase Orders

- `GET /v1/purchase-orders/{purchase_order_id}/invoices` — List invoices linked to a purchase order

### Payments

- `GET /v1/payments/documents/{documentId}` — Get payment information for a document (invoice / PO)
- `POST /v1/payments/documents/{documentId}/pay` — Record a payment against a document
- `POST /v1/payments/export/iso20022` — Generate an ISO 20022 (SEPA pain.001) payment file

### Categorization

- `GET /v1/categorization/groups` — List available tag groups (UNSPSC, Accounting, Custom, …)
- `GET /v1/categorization/groups/{group_id}/tags` — List the tags (category values) inside a group
- `POST /v1/categorization/objects/tags/auto` — Get AI-recommended tags for an object
- `GET /v1/categorization/objects/{object_id}/tags` — Get all tags assigned to a document, partner, or supplier
- `POST /v1/categorization/objects/{object_id}/tags` — Assign a tag to an object
- `DELETE /v1/categorization/objects/{object_id}/tags/{tag_id}` — Remove a tag from an object

### Compliance

- `GET /v1/compliance/reports` — List individual compliance reports (per document) emitted to e-invoicing platforms
- `GET /v1/compliance/status` — Per-company compliance posture across registered jurisdictions

### Stats

- `GET /v1/stats` — Usage, quota, and rate-limit stats for the calling API key

### Platform

- `GET /v1/platform/api-keys` — List API keys issued to managed companies
- `POST /v1/platform/api-keys` — Mint an API key for a managed company
- `DELETE /v1/platform/api-keys/{key_id}` — Revoke a managed-company API key
- `GET /v1/platform/companies` — List the companies managed by this platform
- `POST /v1/platform/companies` — Onboard a managed company (create org + optional webhook + key)
- `GET /v1/platform/events` — Stream every event across the platform's managed companies
- `PATCH /v1/platform/settings` — Update platform branding, defaults, and custom domain
- `GET /v1/platform/usage` — Aggregate platform usage for a billing period

### API Keys

- `GET /v1/api-keys` — List API keys for your own organization
- `POST /v1/api-keys` — Create an API key for your own organization
- `DELETE /v1/api-keys/{key_id}` — Revoke an API key by id

### Requests

- `GET /v1/requests` — List captured request logs for your organization
- `GET /v1/requests/summary` — Per-API-key (or per-user) usage rollup
- `GET /v1/requests/{request_id}` — Fetch a single captured request/response envelope by X-Request-Id

### Portability

- `POST /v1/portability/messages` — Build a normalised inter-PA portability message (subject + 18-field CSV)
- `POST /v1/portability/messages/parse` — Parse an inbound inter-PA portability message

### Identity

- `GET /v1/me` — Get the caller identity + accessible organizations

### Document Callbacks

- `POST /document/callback` — cXML PunchOutOrderMessage callback (BrowserFormPost)
- `GET /document/oci-callback` — OCI cart callback (GET variant — supplier auto-submit)
- `POST /document/oci-callback` — OCI cart callback (Mercateo / Conrad / SAP-style suppliers)

### AFNOR Flow Service

- `POST /afnor/flow-service/v1/flows` — Submit a flow (createFlow)
- `POST /afnor/flow-service/v1/flows/search` — Search flows (searchFlows)
- `GET /afnor/flow-service/v1/flows/{flow_id}` — Download a flow (getFlow)
- `GET /afnor/flow-service/v1/healthcheck` — Health check
- `GET /afnor/flow-service/v1/webhooks` — List webhooks (listWebhooks)
- `POST /afnor/flow-service/v1/webhooks` — Create webhook (createWebhook)
- `DELETE /afnor/flow-service/v1/webhooks/{webhook_uid}` — Delete webhook (deleteWebhook)
- `GET /afnor/flow-service/v1/webhooks/{webhook_uid}` — Get webhook detail (getWebhook)
- `PATCH /afnor/flow-service/v1/webhooks/{webhook_uid}` — Update webhook technical params (updateWebhook)

### AFNOR Directory Service

- `GET /afnor/directory-service/v1/directory-line/code:{addressing_identifier}` — Get directory line by id (getDirectoryLineById)
- `POST /afnor/directory-service/v1/directory-line/search` — Search directory lines (searchDirectoryLine)
- `GET /afnor/directory-service/v1/healthcheck` — Health check
- `POST /afnor/directory-service/v1/routing-code/search` — Search routing codes (searchRoutingCode)
- `GET /afnor/directory-service/v1/routing-code/siret:{siret}/code:{routing_identifier}` — Get routing code (getRoutingCodeBySiretAndId)
- `GET /afnor/directory-service/v1/siren/code-insee:{siren}` — Get company by SIREN (getCompanyBySiren)
- `POST /afnor/directory-service/v1/siren/search` — Search companies by SIREN (searchCompanyBySiren)
- `GET /afnor/directory-service/v1/siret/code-insee:{siret}` — Get establishment by SIRET (getFacilityBySiret)
- `POST /afnor/directory-service/v1/siret/search` — Search establishments by SIRET (searchFacilityBySiret)

### Health

- `GET /health/contracts` — Contract-monitor status across tracked upstream services
- `GET /health/liveness` — Liveness probe — is the process up?
- `GET /health/readiness` — Readiness probe — should traffic be sent here?

<!-- ENDPOINT-INDEX:end -->

## Compliance (per country)

- [France · PPF](https://docs.get-flowie.com/compliance/fr/index.html): Flowie is registered PDP `0040`. Mandatory receive 2026-09-01, send 2027-09-01. Required fields, error codes (00025/00043/00058/00104/00200/00306/00500), Service Exécutant, e-reporting timing.
- [Italy · SDI](https://docs.get-flowie.com/compliance/it/index.html): Mandatory since 2019. Codice Destinatario routing, FatturaPA XML, intermediario flow, 10-year retention. Error codes 00200/00306/00311/00400/00404/00417/00471.
- [Belgium · HERMES](https://docs.get-flowie.com/compliance/be.html): B2B mandate 2026-01-01. BE BIS profile, Mercurius for B2G (federal OVO numbers), OGM-VCS payment reference. Error codes HER-001/002/007, MERC-201, BR-BE-01.

## Guides

- [Sending invoices](https://docs.get-flowie.com/guides/index.html#send-invoice): Register sender → verify recipient → send → listen for `document.delivered`.
- [Receiving invoices](https://docs.get-flowie.com/guides/index.html#receive): Subscribe webhook → verify HMAC → fetch structured view → advance lifecycle.
- [Tracking lifecycle](https://docs.get-flowie.com/guides/index.html#lifecycle-flow): Allowed-state map; mark paid example with auto-compliance.
- [Building a white-label platform](https://docs.get-flowie.com/guides/index.html#white-label): `flw_plat_live_…` keys + `X-Flowie-Company`. Branding, tenant-scoped webhooks.
- [FR · IT · BE compliance](https://docs.get-flowie.com/guides/index.html#compliance): Cross-border concerns, deadline matrix, opt-out flags.
- [Sandbox testing](https://docs.get-flowie.com/guides/index.html#sandbox): Magic identifiers, replay, ngrok loop.
- [Going live checklist](https://docs.get-flowie.com/guides/index.html#go-live): 10-point pre-launch.
- [Migrating from v2](https://docs.get-flowie.com/guides/index.html#migration): Legacy `/api/…` → `/v1/…` mapping table.
- [Platform onboarding kit](https://docs.get-flowie.com/guides/onboarding-kit.html): WorkOS-style 6-step walkthrough, scale to 100, billing, observability, offboarding, production checklist.

## Operational

- [Changelog](https://docs.get-flowie.com/changelog.html): All API changes — `new`, `changed`, `deprec`, `break`, `fix`. Releases since 2025-10.
- [Status page](https://status.flowie.ink): Real-time uptime (external).
- [OpenAPI spec](https://docs.get-flowie.com/openapi.json): Machine-readable contract (OpenAPI 3.1).

## Optional

- [Markdown exports](https://docs.get-flowie.com/llms-full.txt): Full content of every doc page concatenated for ingestion.
- [Per-page markdown](https://docs.get-flowie.com/llms/): One `.md` per HTML page — `index.md`, `reference.md`, `sandbox.md`, etc.
- [Webhook payload fixtures](https://docs.get-flowie.com/fixtures/): One JSON file per event type, schema-stable across patch releases.
- [AFNOR XP Z12-013 adapter](https://docs.get-flowie.com/reference/index.html#afnor): French PDP-interoperability surface under `/afnor/flow-service` and `/afnor/directory-service`.
- [cXML PunchOut callback](https://docs.get-flowie.com/reference/index.html#punchout): `/document/callback` for SAP Ariba / Coupa / Ivalua.