How to read this reference
Every page under this heading is generated from the running service. What a generated page cannot tell you is which call comes first — so this one does, in about a minute.
New here? Read what a flow is and the Spain Public Administration overview first. This page is the map, not the introduction.
The happy path
Create the session
Create Session from your backend, with your application secret. You get a session_id and the URL to open.
Send your customer to the widget
They consent, identify themselves and wait — the journey is the widget’s job, not yours. Redirects & Completion covers where they land when it is over.
Wait for something to happen
Register a webhook and we tell you when consent is signed, when a source answers late and when the session ends; or ask for the session state.
Read what came back
Session Results carries the structured records, and Download Attachments the official documents exactly as the administration issued them.
Two things worth knowing before you build
A session created with an aes_key delivers its records encrypted — in the webhook payload as well — so what reaches your endpoint is readable only by you.
Unlike a direct execution, the credentials never reach you: your customer types them into the widget. That is the whole point of a flow, and it decides what you have to build.
Everything that holds for every endpoint — the X-APP-SECRET header, the base URLs, the error shape and the rate limits — is stated once in Using the API, not repeated on each page.