Inbound channels

Requests by email

Turn on with INTAKE_EMAIL_SECRET. Your mail relay posts each message to:

POST /api/inbound/intake/email/<tenantId>
x-spend-intake-secret: <INTAKE_EMAIL_SECRET>

The sender must be a Spend user in that tenant. Spend drafts a request from the message and emails the sender a link to review and submit it. Nothing is submitted without them.

Requests from Microsoft Teams

Create an outgoing webhook in Teams pointed at /api/inbound/teams/<tenantId>, and set the security token Teams shows as TEAMS_INTAKE_SECRET_<TENANT>. Messages to the webhook become draft requests, and the reply in Teams links to the draft.

To post approval cards into Teams chats, set TEAMS_APPROVAL_WORKFLOW_URL to a Power Automate workflow (or bot) that delivers them.

E-invoices from a Peppol access point

Set EINVOICE_INBOUND_SECRET_<TENANT>. The access point posts each delivery:

POST /api/inbound/einvoice/<tenantId>
x-spend-einvoice-secret: <secret>

{ "messageId": "...", "sender": "0088:...", "receiver": "0088:...", "payloadBase64": "<UBL invoice>" }

Only enrolled, verified suppliers are accepted; other deliveries are refused and recorded. Invoice responses (acknowledged, in process, approved, paid, rejected) go back through the access point set in ACCESS_POINT_URL every 15 minutes.

Public bid board

Anyone can read an agency’s advertised solicitations at GET /api/public/bids/<tenantId> as JSON, or /api/public/bids/<tenantId>.rss as an RSS feed, when the agency’s policy includes the public feed.