Can I retrieve the original SBD Paypload?

[Kinchkun]

Cheers,

thank you for your work :)

I am developing a PEPPOL Access Point (AP) which stores retrieved documents in Amazon S3. For this, I am implementing the following interface:

fun handleIncomingSBD(
    @Nonnull aMessageMetadata: IAS4IncomingMessageMetadata,
    @Nonnull aHeaders: HttpHeaderMap,
    @Nonnull aUserMessage: Ebms3UserMessage,
    @Nonnull aSBDBytes: ByteArray,
    @Nonnull aSBD: StandardBusinessDocument,
    @Nonnull aPeppolSBD: PeppolSBDHData,
    @Nonnull aState: IAS4MessageState,
    @Nonnull aProcessingErrorMessages: ICommonsList<Ebms3Error>,
) {
    val payloadBytes = serializeElement(aSBD.any as Element)
    s3.storeBytes(payloadBytes)
}

I only want the payload and not the SBD itself.

What I don't like about this solution is that we retrieve the SBD bytes, parse it into an XML tree, and then serialize part of the tree back into bytes.

Is there a way to access the original payload bytes? The serialization and deserialization process slightly alters the original message, not in a meaningful way, but I need to store the byte-wise exact original message somehow.

Kind regards,

[phax]

@Kinchkun thanks for starting that dicussion. I understand your request, but it cannot be fulfilled generically because of the following reason:

• SBDH includes the payload elements as an xs:any
• This means, that the transmission that you receive is a single XML document
• As such, the the general rules for XML namespaces apply, as described in https://www.w3.org/TR/xml-names/
• Therefore it is possible, that the namespace URL of the (e.g.) Invoice element is contained inside the surrounding StandardBusinessDocument element as in this example:

<StandardBusinessDocument xmlns:xs="http://www.w3.org/2001/XMLSchema"
  xmlns="http://www.unece.org/cefact/namespaces/StandardBusinessDocumentHeader"
  xmlns:ubl="urn:oasis:names:specification:ubl:schema:xsd:Invoice-2">
  <StandardBusinessDocumentHeader>
    <!-- etc. -->
  </StandardBusinessDocumentHeader>
  <ubl:Invoice>
    <!-- etc. -->
  </ubl:Invoice>
</StandardBusinessDocument>

==> Therefore, if you "extract" the payload from the SBDH you would receive an invalid XML document because the ubl namespace prefix would be undefined.

So you should be aware, that XML is NOT a text format, but an application format (that's why the preferred MIME type is application/xml) and it is safe to read the payload and re-serialize it, because the content is "semantically equivalent", even though the serialization is different. The key element for equality of XML is the equality in memory, and not in serialized form.

[Kinchkun]

Hi,
thank you for your fast and thoroughly response. Now I understand the issue, thank you.

[shunkica]

Hello @phax I stumbled upon this discussion when looking for a solution for my problem regarding signed UBL payloads inside SBD.

When UBL document is signed with an URI="" Reference and then wrapped inside a SBD, it is impossible to validate the signature without extracting it from the SBD.

Can you suggest how to properly sign the UBL document in this case, so that the signature can be validated even after it is wrapped with a SBD?

[phax]

@shunkica when asking for the Peppol Network: there is no reason to sign the UBL only. The transmission must always be signed on the SBDH level only. Because Peppol handles arbitrary document types (and not just UBL) it cannot assume that each document type supports signing by default. Addtionally the SBDH parameters must also be part of the signing process, as they indicate important routing information.

[shunkica]

@phax My specific problem involves the new Croatian e-Invoicing. From 1.1.2026. Croatia is transitioning to AS4 for all B2B and B2G e-Invoice exchange. Previously we had a B2G system only (using custom wsservices, not AS4), where the UBL Invoices / Credit Notes had to be signed using XAdES-B-B inside <ext:UBLExtensions><ext:UBLExtension><ext:ExtensionContent><sig:UBLDocumentSignatures><sac:SignatureInformation> and then also you had the option to use XAdES-B-T to prove when the signature was created.

If I understand what you are saying correctly, I should first create the entire SBD with the Invoice included, and then sign it? Therefore the Signature in UBLExtensions with Reference URI="" would be for the entire SBD document, not just the Invoice itself?

I think this might be problematic, because the central C3 point which does processing on the Croatian AS4 network for all government entities, extracts the payload out from the SBD before passing it to the customer (government entities). They have devised a complicated "hybrid" approach to have the old system work alongisde the new one. Therefore such a signature would be invalid for them since all they get is the UBL Invoice/CreditNote itself.

[phax]

@shunkica May I ask you to move this to a new thread - I think that might be interesting to others and then it can be labelled accordingly. Just copy paste the content and I will respond properly