Skip to content
Last updated

EviPost API

The EviPost API lets you submit certified physical postal communications (equivalent to a burofax) and query the status of previously submitted items. It is a REST API that uses HTTP Basic authentication and returns JSON responses.

For end-to-end lifecycle, postal service types, and integration guidance, see the EviPost service guide.


Environments

EnvironmentBase URL
Productionhttps://api.evicertia.com
Pre-production / QAhttps://api.ecertia.com

For the public Namirial Notify API environments, this V1 service is exposed under the /v1 base path. Use public routes such as /v1/EviPost/Submit, /v1/EviPost/Query, and /v1/EviPost/AffidavitRequest.

Some lower-level technical artifacts may show these V1 routes without the /v1 prefix. For customer integrations, use the public /v1 base path shown in this documentation.

For shared environment guidance across services, see the API reference overview.


Authentication

All endpoints require HTTP Basic authentication. Pass your Namirial Notify credentials as the username and password in the Authorization header.

Authorization: Basic <base64(username:password)>

See credential handling, callback endpoint hardening, and operational security checks.


Idempotency

EviPost Submit supports idempotent submission. Include the X-Evi-IdempotencyToken header with a unique value per logical operation (a GUID is recommended).

If the same token is submitted again after the original request completed with 200 OK, the server returns 202 Accepted with the original response body — the communication is not resubmitted.

The following response codes are not cached and will re-execute the request regardless of token: 400, 401, 408, 409, 429, and 5xx responses.


Error responses

EviPost v1 uses a responseStatus object for error responses.

{
  "responseStatus": {
    "errorCode": "ArgumentException",
    "message": "RecipientAddress.Country is required.",
    "errors": [
      {
        "errorCode": "NotEmpty",
        "fieldName": "RecipientAddress.Country",
        "message": "RecipientAddress.Country is required."
      }
    ]
  }
}
FieldDescription
errorCodeMachine-readable error classifier
messageHuman-readable summary of the error
errorsArray of field-level validation errors (present on 400 responses)

Common status codes and their causes:

StatusTypical cause
400 Bad RequestMissing required field, invalid address, invalid certification level, document too large, or business rule failure
401 UnauthorizedIncorrect credentials or missing Authorization header
403 ForbiddenAccount not provisioned for EviPost

For shared error handling guidance, see Error handling.


Endpoints

Submit a certified postal communication

POST /v1/EviPost/Submit

Submits a new certified postal communication. On success, returns a UniqueId that identifies the submission and can be used to query its status later.

Required fields: Document (base64-encoded PDF), RecipientAddress.

Optional fields include RecipientName, RecipientLegalName, IssuerName, IssuerLegalName, IssuerAddress, Options, LookupKey, RecipientPhone, RecipientEmail, IssuerPhone, IssuerEmail, and IssuerComments.

ResponseDescription
200 OKPostal communication accepted. Body contains { "uniqueId": "..." } — the UUID of the submitted postal communication. (EviMail and EviSMS return the equivalent identifier as eviId.)
202 AcceptedReturned when an idempotent replay matches a previously 200 OK submission. The original response body is returned unchanged.
400 Bad RequestInvalid request or business rule failure. The response body contains a responseStatus object with errorCode, message, and an optional errors array of field-level details.
401 UnauthorizedAuthentication failed.
403 ForbiddenThe account is not provisioned for EviPost. Contact your Namirial Notify account manager to enable this service.

See Idempotency above for retry safety guidance.

Example request:

POST /v1/EviPost/Submit HTTP/1.1
Authorization: Basic XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX==
Content-Type: application/json

{
  "LookupKey": "a2R4S25kWiu79fsbubSXkw==",
  "Document": "<base64-encoded PDF>",
  "RecipientName": "Juan Valido",
  "RecipientLegalName": "Juan Valido",
  "RecipientAddress": {
    "StreetAddress": "Gran Via 74, 5 A",
    "PostalCode": "28014",
    "Locality": "Madrid",
    "Region": "Madrid",
    "Country": "ES"
  },
  "IssuerName": "Pedro Comprador",
  "IssuerLegalName": "Pedro Valido",
  "IssuerAddress": {
    "StreetAddress": "C/ Gran Via, 1, 1-A",
    "PostalCode": "28001",
    "Locality": "Madrid",
    "Region": "Madrid",
    "Country": "ES"
  },
  "IssuerPhone": "+34677888777",
  "IssuerEmail": "pedro.comprador@example.com",
  "IssuerComments": "Sending in March.",
  "Options": {
    "PostServiceType": "Registered",
    "CertificationLevel": "Advanced_EU",
    "NotaryRetentionPeriod": 5,
    "OnlineRetentionPeriod": 1
  }
}

Example response:

{
  "uniqueId": "69819c3e-0c0e-42b3-a792-a33b014a13a2"
}

Query certified postal communications

GET /v1/EviPost/Query

Returns a list of postal communications matching the specified filters. Results are paginated using Limit and Offset.

Query parameters:

ParameterTypeDescription
WithUniqueIdsstringFilter by one or more unique IDs (comma-separated).
WithLookupKeysstringFilter by one or more lookup keys (comma-separated).
OnStatestringFilter by current state. Contact support before using this parameter.
WithOutcomestringFilter by outcome. Contact support before using this parameter.
OrderResultsBystringSort field for results. Supported value: CreationDate.
OffsetintegerNumber of results to skip.
LimitintegerMaximum number of results to return.
IncludeDocumentOnResultbooleanInclude the original document (base64 PDF) in results.
IncludeAffidavitsOnResultbooleanInclude affidavit metadata in results.
IncludeAffidavitBlobsOnResultbooleanDeprecated. When true with IncludeAffidavitsOnResult=true, include each affidavit PDF as Base64 in affidavits[].bytes; blob queries are limited to one postal communication. Set this to false for metadata-only results and use /AffidavitsDownload for new integrations.
ResponseDescription
200 OKReturns { "totalMatches": N, "results": [...] }.
401 UnauthorizedAuthentication failed.
403 ForbiddenThe account is not provisioned for EviPost. Contact your Namirial Notify account manager to enable this service.

If Limit is omitted, the API uses a default of 100. The default drops to 25 when IncludeAffidavitsOnResult is true.

With the deprecated IncludeAffidavitBlobsOnResult=false, IncludeAffidavitsOnResult=true adds affidavit metadata and IDs without embedding the PDF files. Pass the returned affidavit IDs to the shared /AffidavitsDownload endpoint to retrieve the signed PDFs in a ZIP archive. This is the recommended retrieval flow for new integrations.

Example request:

GET /v1/EviPost/Query?WithUniqueIds=3977d143-a6cb-4642-abc6-a33b016cbec2&IncludeAffidavitsOnResult=true&IncludeAffidavitBlobsOnResult=false HTTP/1.1
Authorization: Basic XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX==

Example response:

{
  "results": [
    {
      "evidenceId": "3977d143-a6cb-4642-abc6-a33b016cbec2",
      "lookupKey": "a2R4S25kWiu79fsbubSXkw==",
      "recipientName": "Juan Valido",
      "address": {
        "streetAddress": "Gran Via 74, 5 A",
        "postalCode": "28014",
        "locality": "Madrid",
        "region": "Madrid",
        "country": "ES"
      },
      "state": "Sent",
      "stateDate": "2026-01-15T10:00:07Z",
      "lastStateChangeDate": "2026-01-15T10:00:11Z",
      "outcome": "None",
      "outcomeDate": "2026-01-15T10:00:00Z",
      "creationDate": "2026-01-15T10:00:00Z",
      "submittedOn": "2026-01-15T10:00:00Z",
      "processedOn": "2026-01-15T10:00:03Z",
      "sentOn": "2026-01-15T10:00:07Z",
      "timeToLive": 43200,
      "costCentre": "dept-legal",
      "affidavits": [
        {
          "uniqueId": "000c1f70-42ac-a3ea-149f-943879726a87",
          "date": "2026-01-15T10:00:12Z",
          "evidenceUniqueId": "3977d143-a6cb-4642-abc6-a33b016cbec2",
          "description": "Certification of postal communication"
        }
      ]
    }
  ],
  "totalMatches": 1
}

Request an on-demand affidavit

POST /v1/EviPost/AffidavitRequest

Generates a custom affidavit for a previously submitted EviPost. To use this endpoint, AffidavitsOnDemandEnabled: true must have been set in the original Submit request.

Request body:

FieldTypeDescription
UniqueIdstring (UUID)Required. Unique ID of the EviPost to generate an affidavit for.
IncludeDocumentbooleanOptional. Include the original document in the affidavit.
IncludeEventsbooleanOptional. Include detailed event information in the affidavit.
ResponseDescription
200 OKReturns { "requestId": "..." }.
400 Bad RequestBusiness rule or validation failure. The response body contains a responseStatus object with errorCode, message, and an optional errors array.
401 UnauthorizedAuthentication failed.

Example request:

POST /v1/EviPost/AffidavitRequest HTTP/1.1
Authorization: Basic XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX==
Content-Type: application/json

{
  "UniqueId": "87ffa214-e773-4bd5-9b8d-a8ef00fd80f8",
  "IncludeDocument": true,
  "IncludeEvents": true
}

Example response:

{
  "requestId": "79726a87000c1f7042aca3ea149f9438"
}

Cancel a postal communication

POST /v1/EviPost/Cancel

Cancels a previously submitted EviPost that has not yet been dispatched to the postal carrier. Only the account that originally submitted the postal communication can cancel it.

Permission required

This endpoint requires the CanUseCancel permission in addition to the standard EviPost API permission. Contact your Namirial Notify account manager if you need this permission enabled.

Request body:

FieldTypeDescription
UniqueIdstring (UUID)Required. Unique ID of the EviPost to cancel, as returned at submission.
ResponseDescription
200 OKReturns { "uniqueId": "..." } — the ID of the cancelled postal communication.
400 Bad RequestInvalid request. The UniqueId is missing or not a valid UUID.
401 UnauthorizedAuthentication failed, or the authenticated account is not the owner of the postal communication.
403 ForbiddenThe account lacks the CanUseCancel permission, or EviPost is not enabled for this account.
404 Not FoundNo postal communication with the given UniqueId was found.

Example request:

POST /v1/EviPost/Cancel HTTP/1.1
Authorization: Basic XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX==
Content-Type: application/json

{
  "UniqueId": "69819c3e-0c0e-42b3-a792-a33b014a13a2"
}

Example response:

{
  "uniqueId": "69819c3e-0c0e-42b3-a792-a33b014a13a2"
}

States and outcomes

For a cross-service explanation of lifecycle terminology, see States and outcomes. For a visual lifecycle reference, see the EviPost evidence lifecycle.

States represent the current step in the postal communication lifecycle.

StateDescription
DraftCommunication prepared but not yet submitted.
SubmittedAccepted by the platform, pending processing.
ProcessedLocally processed and queued for the postal operator.
DispatchedDispatched to the postal communication system.
IssuedItem issued by the postal operator (operator-specific intermediate state).
SentHanded off to the postal operator or messaging service.
FailedA processing or delivery failure occurred.
UndeliveredThe operator reported non-delivery. This does not itself close tracking or identify a collection or return-to-sender action.
MissingValue exposed by the API contract; no normal transition into this state is defined by the current lifecycle implementation. Contact support if it appears.
DeliveredDelivered to the final recipient.
DisposedThe provider reported destruction of the undelivered item under a service configured for disposal.
CancelledCommunication was cancelled.
ClosedPostal tracking is complete and the outcome is final. Affidavit publication can still follow.

Outcomes represent the result recorded so far and can change while the communication remains open. Use the outcome at Closed as the final result.

An individual delivery-attempt event does not itself change the state to Undelivered. For Registered and Letter with delivery tracking enabled, the platform accepts a later valid delivery report before closure; whether an operator emits that sequence is unconfirmed. LetterLite cannot complete normal closure with Delivered once non-delivery has been recorded. A Letter workflow configured for disposal can continue to Disposed; a later failure report for Letter can instead lead to Failed before closure. Registered and LetterLite can close with a final Undelivered outcome. See Delivery attempts and non-delivery for operator details and callback guidance.

OutcomeDescription
NoneNo outcome determined yet.
DispatchedItem dispatched to the postal operator (intermediate outcome, may be superseded).
SentItem sent. This can be the final outcome for plain Letter without delivery receipt, attempt tracking, or disposal.
DeclinedDefined in the API contract and domain, but not emitted by the current postal event handlers. Recipient refusal is reported as Rejected.
RejectedRecipient rejected the postal communication.
AcknowledgedValue exposed by the API contract but not produced by the current lifecycle implementation. Contact support if it appears.
HinderedValue exposed by the API contract but not produced by the current lifecycle implementation. Contact support if it appears.
UndeliveredNon-delivery was reported. Final only when the communication is Closed.
FailedA processing error prevented normal delivery.
DeliveredSuccessfully delivered to the recipient.
DisposedDestruction of the undelivered item was reported for a service configured for disposal.
CancelledCancelled by the issuer.
ExpiredDelivery could not be completed within the postal deadline.

Key request fields

Document

The document or letter to be sent, provided as a base64-encoded PDF string.

RecipientAddress / IssuerAddress

Both address objects share the same shape:

FieldRequiredDescription
StreetAddressYesStreet name and number.
PostalCodeYesPostal code.
LocalityYesCity or town.
RegionConditionalProvince or region. Required in RecipientAddress for Registered. The issuer region must also be present, either supplied in IssuerAddress or filled from the site address.
CountryYesISO 3166-1 alpha-2 country code (e.g. ES).
PostOfficeBoxAddressNoPost office box address, if applicable.

Options

The Options object groups all processing and certification settings.

All Options fields are optional at the API level: omit one and the platform applies a default (PostServiceType → Registered, Language → your site's configured language, AffidavitProfile → inferred from CertificationLevel, EvidenceAccessControlMethod → the account's configured default method). The Web form preselects its own account or site defaults; these need not match the API defaults. The Web service type comes from the site configuration. The only conditional requirements are PostServiceProfile (when PostServiceType is Letter) and the challenge fields (when EvidenceAccessControlMethod is Challenge).

FieldDescription
PostServiceTypeRegistered (default), Letter, or LetterLite. Defaults to Registered if omitted. See details below.
PostServiceProfileProfile identifier for the postal service. Required when PostServiceType is Letter (provisioned by support). Not used for Registered or LetterLite.
CertificationLevelLegal framework for certification. Supported values include Standard, Advanced, and regional variants such as Standard_EU or Advanced_EU. Availability depends on the account. EviPost does not support QERDS levels.
AffidavitProfileControls which affidavits are generated. If omitted, it is inferred from CertificationLevel; if set, it must be consistent with the certification level. See details below.
AffidavitsOnDemandEnabledBoolean. Enables on-demand affidavit generation via AffidavitRequest. Requires an advanced content profile (AdvancedContentOnSubmit, AdvancedContentOnClose, or AdvancedContentOnSubmitAndOnClose).
OnlineRetentionPeriodTime in years for online evidence retention. Default: 1 year.
NotaryRetentionPeriodIf set, applies 5-year notarial custody. Set to 0 to disable.
NotaryProfileRequired when NotaryRetentionPeriod > 0. Identifier of the notary for custody.
EvidenceAccessControlMethodControls how recipients access the evidence: Public, Challenge, AutoChallenge (the account's configured default method applies when omitted). When Challenge, also supply EvidenceAccessControlChallenge and EvidenceAccessControlChallengeResponse.
EvidenceAccessControlChallenge / EvidenceAccessControlChallengeResponseChallenge question and expected answer. Both required when EvidenceAccessControlMethod is Challenge.
CostCentreOptional. Groups submissions for billing/reporting purposes.
CustomFieldsOptional. Array of custom key-value fields (see CustomFields below).
PushNotificationUrlOptional. URL to receive state-change callbacks.
PushNotificationFilterOptional. Array of states that trigger a callback.
LanguageOptional. Language for the evidence record and generated affidavits (e.g. en, es). Defaults to your site's configured language if omitted.
EnableDeliveryReceiptOptional. For Letter type: request a delivery receipt from the provider.
EnableDeliveryAttemptsOptional. For Letter type: enable delivery attempt tracking.
DeliveryAttemptsNumberOptional. For Letter type: number of delivery attempts to request from the provider.
DisposalDaysAmmountOptional. For Letter type: number of days after which the item is disposed of if undelivered.
PushNotificationExtraDataOptional. Free-text passed through in every callback payload.

PostServiceType

Controls the type of postal delivery. EviPost physical delivery is currently available for destinations within Spain; availability of each type depends on your account provisioning.

  • Registered — Default. Sends a certified postal communication equivalent to a burofax, delivered through the national postal operator (Correos). Delivery attempts are handled by the operator and are not configured in the submit request.
  • Letter — Sends to a printing and enveloping provider (MRW). Requires prior provisioning by support and a PostServiceProfile. Supports optional delivery receipt and delivery attempt tracking.
  • LetterLite — A lower-cost single-attempt printed certified letter (MRW). Available only within mainland Spain (the islands, Ceuta, Melilla, Portugal, Andorra, and Gibraltar are excluded). The delivery-attempt and disposal options cannot be used, and PostServiceProfile is not required.

CertificationLevel

Defines the legal framework and geographic variant for certification. The API accepts Standard, Advanced, and regional values such as Standard_EU, Advanced_EU, Standard_CO, or Advanced_MX. Availability depends on the account. EviPost does not support QERDS certification levels.

AffidavitProfile

Controls what affidavits are generated during the process:

ValueDescription
NoneNo affidavits generated.
BasicA single receipt affidavit when tracking is complete. Default for Standard certification.
AdvancedContentOnSubmitOne affidavit per event, plus a timestamped content affidavit at submission. Default for Advanced certification.
AdvancedContentOnCloseOne affidavit per event, plus a receipt showing the document body when tracking is complete.
AdvancedContentOnSubmitAndOnCloseCombination of the above two.

PushNotificationFilter

An array of event names that trigger a callback to PushNotificationUrl. Valid values for EviPost: Processed, Dispatched, Sent, Delivered, Closed, Cancelled, Issued, Disposed, AffidavitPublished.

AffidavitPublished is not a lifecycle state — it is a platform meta-event that fires when affidavit generation for this communication completes.

PushNotificationExtraData

A free-text field for additional data to be included in every push notification sent to PushNotificationUrl. Available in the AdditionalData.ExtraData field of the callback payload.

CustomFields

An array of custom key-value fields attached to the submission. Each field requires Key, Label, and Value. Fields marked with IsLookupKey: true are indexed and surfaced in query results under LookupKey, concatenated with :: if multiple values are present.


Push notification payload

When an EviPost changes state, Namirial Notify sends a POST to PushNotificationUrl with the following JSON payload:

Common fields:

FieldDescription
IdentifierUnique identifier of the event.
KindEvent type (matches the state that triggered the notification).
DateTimestamp of the event.
EvidenceIdUnique identifier of the EviPost.
EvidenceTypeAlways eviPost.
SiteName of the issuer's site.
OwnerName of the site user.
OwnerEmailEmail of the site user.
AdditionalDataObject containing event-specific fields (see below).

AdditionalData fields:

FieldDescription
SenderName of the sender.
RecipientName of the recipient.
LookupKeyLookup key set at submission.
StateCurrent state name.
CreationDateSubmission date.
ExtraDataValue of PushNotificationExtraData, if set.

For Dispatched and Sent events, AdditionalData also includes TransmissionDetails. For Delivered, it includes Details. For Closed, it includes Outcome.

Example payload (Processed event):

{
  "Identifier": "600a41fd-d96b-4c4b-abb2-a87000d7da3f",
  "EvidenceId": "bae409d127de4b18b97ca87000c75b1c",
  "EvidenceType": "eviPost",
  "Kind": "Processed",
  "Date": "2018-01-22T12:05:53.5875507Z",
  "Site": "pruebas",
  "Owner": "Pruebas evicertia",
  "OwnerEmail": "pruebas@evicertia.com",
  "AdditionalData": {
    "Sender": "Pedro Comprador",
    "Recipient": "Juan Valido",
    "LookupKey": "push-notification-test",
    "State": "Processed",
    "CreationDate": "2018-01-22T13:05:49.9850990+01:00",
    "ExtraData": "{\"myId\": \"99cf386b-1590-4ddb-af68-607b3e7c1194\"}"
  }
}

On-demand affidavit callback

When an affidavit requested via AffidavitRequest has been generated, Namirial Notify may send the normal AffidavitPublished push notification to the PushNotificationUrl configured on the original submission, when the original PushNotificationFilter includes AffidavitPublished. For on-demand affidavits, the payload can include the request identifier in AdditionalData.RequestId.

Example payload:

{
  "Identifier": "1234",
  "EvidenceId": "2aca3ea149f943879726a87000c1f704",
  "EvidenceType": "eviPost",
  "Kind": "AffidavitPublished",
  "Date": "2018-01-22T12:46:32.4830752+01:00",
  "Site": "pruebas",
  "Owner": "Pruebas evicertia",
  "OwnerEmail": "pruebas@evicertia.com",
  "AdditionalData": {
    "RequestId": "79726a87000c1f7042aca3ea149f9438",
    "AffidavitId": "000c1f7042aca3ea149f943879726a87",
    "AffidavitName": "Certification of postal communication (upon request)"
  }
}

OpenAPI specification

The OpenAPI 3.0.3 specification for the EviPost API provides a machine-readable definition of the service endpoints, request and response schemas, authentication method, and error responses.

Covered in the specification:

  • Submit endpoint (POST /v1/EviPost/Submit) — detailed request and response schemas, idempotency headers, validation rules, and HTTP status codes
  • Query endpoint (GET /v1/EviPost/Query) — pagination parameters, filtering by ID or lookup key, state and outcome enums, and result structure
  • Affidavit request endpoint (POST /v1/EviPost/AffidavitRequest) — on-demand affidavit generation
  • Authentication — HTTP Basic authentication requirements
  • Error handling — V1 service-style error responses with responseStatus object containing errorCode, message, and errors
  • Data types — schema definitions for documented addresses, postal options, certification levels, and evidence metadata

The OpenAPI spec can be used to generate client libraries, integration tests, or interactive API documentation.

View OpenAPI spec →