Production checklist
- Bind the client to the correct issuer profile and OIB, grant only required permissions, and keep the secret in a secret manager.
- Give every mutation a stable, business-unique
Idempotency-Key; do not generate a new key merely because a request timed out. - Ensure raw UBL supplier and operator OIBs match the credential. Store your document ID, the
invoiceIdassigned by Klik Račun,operationId, and final digest. - Treat
202 Acceptedas queued work, not an issued invoice. Poll to a terminal status; routeACTION_REQUIREDto manual reconciliation. - Grant
invoices:external-as4only to an integrator with a contracted external access point and an AS4 receipt-retention procedure. Deliver the exact effective UBL, then attest its digest and acknowledgement through/external-as4-evidence; keep separate evidence for every generated document. - Send P10/384 XML only through preview and confirmation. Never use a
planIdas a permanent template. - Record payment amount, date, method, and currency from the real business event. Void evidence through
/void; do not delete its history.
Test token issuance, structured and raw drafts, validation, issuance, partial payment and voiding, a deliberately stale correction plan, and cross-organization 404 behavior before enabling live traffic.