The journey
- 1. Create
The supplier creates an electronic invoice in its own business system.
- 2. Hand off
The supplier passes the invoice to its Access Point, through whatever integration that provider offers.
- 3. Locate
The sending Access Point turns the buyer's Participant Identifier into a DNS name and looks it up. The record, kept by the SML, points to the one SMP that holds the buyer's details. The invoice stays where it is.
- 4. Check capabilities
The sending Access Point asks that SMP whether the buyer can receive this document type and process. The answer gives the receiving Access Point's address and certificate.
- 5. Transmit
The sending Access Point signs and encrypts the invoice in its envelope and sends it straight to the receiving Access Point with Peppol AS4, over TLS.
- 6. Deliver
The receiving Access Point passes the invoice on to the buyer's system, through whatever integration it offers the buyer.
- 7. Outcomes
Each signal means something different. An AS4 receipt confirms that the receiving Access Point got the message. A Message Level Status tells the sender if delivery towards the buyer failed, and if it succeeded when the sender asked to know. Only the buyer decides what happens to the invoice, and can report it with an invoice response.
The lookup is shown for every invoice, but a sending Access Point may reuse what it found for earlier invoices, and looks up again when that information turns out to be out of date.
The parts
Supplier (C1)
Creates the invoice in its own business system.
Corner 1 is the party that creates the business document. Its country travels in the envelope as COUNTRY_C1, which every envelope must carry for Peppol's traffic statistics.
Sending Access Point (C2)
The supplier's Peppol service provider. It finds the buyer and sends the invoice.
Corner 2 looks up the receiver through the SML and the receiver's SMP, then sends the document to corner 3 with the Peppol AS4 profile. It signs the message with its own Peppol certificate and encrypts it for the receiving Access Point's certificate, which it read from the SMP. Message Level Status messages come back to it from corner 3.
Receiving Access Point (C3)
The buyer's Peppol service provider. It receives the invoice and passes it on.
Corner 3 receives AS4 messages over TLS on port 443 and acknowledges the transport with an AS4 receipt. It then reports to corner 2 with a Message Level Status: always when the document is rejected or can't be delivered towards the buyer, and on success only when corner 2 asked for it.
Buyer (C4)
Receives the invoice in its accounting system and decides what to do with it.
Corner 4 is the party that processes the business document. A business answer, such as an invoice response, is a separate Peppol document of its own.
SML
Points to the SMP that holds a participant's details.
The Service Metadata Locator is a single, central service provided by OpenPeppol. It controls the DNS records that discovery uses. A sender hashes the lowercased participant identifier with SHA-256, encodes it in Base32 and looks up the U-NAPTR record (service Meta:SMP) for that name under the SML's domain. The record gives the address of the one SMP the participant is registered with. The SML holds no documents and no capabilities.
SMP
Lists what a participant can receive, and where to send it.
The Service Metadata Publisher answers, for one participant and one document type, which processes are supported and, for each, an endpoint: its transport profile (peppol-transport-as4-v2_0), the receiving Access Point's address and its certificate. The SMP signs the answer. Senders may cache it and must look up again when it turns out to be out of date. The SMP never forwards documents.