How to read this reference | INFONITE

Every page under this heading is generated from the running service. What a generated page cannot tell you is which call comes first — so this one does, in about a minute.

New here? This page is the map, not the introduction. What Spain Public Administration reads, what your customer goes through and how a session ends are on its overview — and what every flow shares, one step further, on What is a flow.

Spain Public Administration overview

The happy path

Create the session

Create Session from your backend, with your application secret. You get a session_id and the URL to open.

Wait for something to happen

Register a webhook and we tell you when consent is signed, when a source answers late and when the session ends; or ask for the session state.

Read what came back

Session Results carries the structured records, and Download Attachments the official documents exactly as the administration issued them.

Two things worth knowing before you build

The webhooks can travel encrypted. A session created with an aes_key sends every webhook with its data encrypted under that key, so what reaches your endpoint is readable only by you. The results you read with your application secret travel over TLS, like every call.

The session key

The person is in the loop. Unlike a direct execution, nothing of theirs reaches you: your customer identifies themselves in the widget, and only they can answer what each administration asks. That is the whole point of a flow, and it decides what you build around it.

What they need

Everything that holds for every endpoint — the X-APP-SECRET header, the base URLs, the error shape and the rate limits — is stated once, not repeated on each page.

Using the API