> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://infonite.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://infonite.dev/_mcp/server.

# How to read this reference

Every page under this heading is **generated from the running service**. What a generated page cannot tell you is which call comes first — so this one does, in about a minute.

**New here?** Read [what a flow is](/flows/overview) and the [Spain Public Administration overview](/flows/spain-public-administration/overview) first. This page is the map, not the introduction.

---

## The happy path

#### Create the session

[Create Session](api:POST/es-public-administration/v1/manager/init) from your backend, with your application secret. You get a **`session_id`** and the URL to open.

#### Send your customer to the widget

They consent, identify themselves and wait — the journey is the widget's job, not yours. [Redirects & Completion](/flows/spain-public-administration/redirects) covers where they land when it is over.

#### Wait for something to happen

Register a [webhook](/flows/spain-public-administration/webhooks) and we tell you when consent is signed, when a source answers late and when the session ends; or ask for [the session state](api:GET/es-public-administration/v1/manager/\{session_id}).

#### Read what came back

[Session Results](api:GET/es-public-administration/v1/manager/\{session_id}/results) carries the structured records, and [Download Attachments](api:GET/attachments/\{session_id}/\{attachment_id}) the official documents exactly as the administration issued them.

---

## Two things worth knowing before you build

#### [The results can travel encrypted](/guides/payload-encryption)

A session created with an `aes_key` delivers its records encrypted — in the webhook payload as well — so what reaches your endpoint is readable only by you.

#### [The person is in the loop](/flows/spain-public-administration/overview)

Unlike a direct execution, the credentials never reach you: your customer types them into the widget. That is the whole point of a flow, and it decides what you have to build.

**Everything that holds for every endpoint** — the `X-APP-SECRET` header, the base URLs, the error shape and the rate limits — is stated once in [Using the API](/api-reference/overview), not repeated on each page.