AS4

Applicability Statement 4. The lightweight ebMS3 profile built on SOAP 1.2 and WS-Security. The official PEPPOL transport since 2017.

Definition

AS4 is defined by the OASIS Standard AS4 Profile of ebMS 3.0 Version 1.0, published in January 2013. It is a normative subset of ebMS3 designed to be easier to implement and deploy:

• Transport: HTTP or HTTPS (TLS).
• Envelope: SOAP 1.2 multipart MIME, with an ebMS3 header carrying routing and metadata (Message ID, RefToMessageId, From, To, Service, Action, ConversationId).
• Security: XML signature and XML encryption conformant to WS-Security 1.1 (XML Signature, XML Encryption). X.509 certificates mandatory.
• Receipts: AS4 specifies two profiles — One-Way push (most used in PEPPOL) and One-Way pull (rare). The receiver returns a SOAP signed receipt that serves as non-repudiable proof of receipt.
• Retries: ebMS3 / AS4 mandates an automatic retransmission mechanism in the absence of a receipt, governed by the P-Mode (Processing Mode).

Origin

AS4 was born out of a realisation: AS2 is effective for point-to-point bilateral exchanges, but struggles when routing through a network (PEPPOL, e-SENS, etc.). ebMS3 (OASIS Standard 2007) provided the solution, but its complexity deterred uptake. AS4 selects a coherent subset of ebMS3 and publishes it as a standard in its own right in 2013. PEPPOL adopted AS4 as the mandatory transport in its 2017 decision (PEPPOL Network Infrastructure 4.0), migrating away from START and AS2. Today AS4 is the reference transport in institutional European e-invoicing.

Example in context

A Belgian supplier sends a PEPPOL BIS Billing 3.0 invoice to a French buyer. The supplier's Access Point posts the SBD (SBDH + UBL Invoice) on the receiver AP's AS4 endpoint, identified via SML/SMP. The message is wrapped in SOAP 1.2 signed XMLDSig + encrypted XMLEnc, with an ebMS3 header carrying From=0208:sender, To=0009:siret-receiver, Service=peppol, Action=cenbii-procid-ubl::cen.eu... The receiver validates and acknowledges via an AS4 signed receipt; any failure triggers a P-Mode-driven retry.

Related terms

• ebMS3 — the parent standard.
• WS-Security — the security layer.
• OASIS — the standard's editor.
• PEPPOL BIS Billing 3.0 — primary user.