# La Poste Groupe

> The French state-owned postal, parcel, banking and digital services group. Its
> public API programme runs on Okapi, La Poste's own API management platform, at
> developer.laposte.fr: nine APIs behind one gateway (api.laposte.fr) authenticated
> with an X-Okapi-Key header and metered by subscription plans with published
> quotas. Colissimo, the group's parcel arm, additionally publishes SOAP contracts
> at ws.colissimo.fr.

Generated by the API Evangelist enrichment pipeline on 2026-09-02. La Poste does not
publish an llms.txt of its own (/llms.txt returns 404 on developer.laposte.fr,
www.laposte.fr and data.laposte.fr, and 410 on www.lapostegroupe.com). Everything
below was fetched or probed; nothing is inferred.

## Start here

- [Developer portal](https://developer.laposte.fr/): Okapi self-service hub - browse the catalogue, subscribe an application to a plan, get a key.
- [API catalogue](https://developer.laposte.fr/catalog-apis): the nine public APIs.
- [Getting started / knowledge base](https://developer.laposte.fr/getting-started): the Okapi knowledge base, also at faq.developer.laposte.fr.
- [Provider documentation](https://documentation-okapi.laposte.fr/): Docusaurus documentation for teams publishing an API onto Okapi.
- [Service status](https://developer.laposte.fr/status/api): live per-service state and latency. Backed by an unauthenticated JSON endpoint at https://developer.laposte.fr/api/statusApi.
- [Terms of use](https://developer.laposte.fr/cgu) | [Privacy](https://developer.laposte.fr/data-privacy)

## Authentication

Every gateway API takes an `X-Okapi-Key` request header, issued per application and
tied to a plan subscription. An unauthenticated call returns
`HTTP 401 {"code":"UNAUTHORIZED","message":"This action requires an authorization"}`.
Digiposte additionally uses HTTP Basic on its token endpoint and then OAuth 2.0
bearer tokens. The Open Data instance at data.laposte.fr takes an `x-apiKey` header,
and answers read queries without one.

## Machine-readable contracts

- [Suivi v2 OpenAPI 3.0.1](openapi/la-poste-groupe-suivi-openapi.json) - base https://api.laposte.fr/suivi/v2
- [Digiposte v3 OpenAPI 3.0.0](openapi/la-poste-groupe-digiposte-openapi.json) - 12 operations; servers[] is empty in the published document
- [Lettre recommandee en ligne OpenAPI 3.0.1](openapi/la-poste-groupe-lettre-recommandee-en-ligne-openapi.json) - 2 operations; a raw springdoc export with generator defaults left in
- [La Poste Open Data OpenAPI 3.1.0](openapi/la-poste-groupe-open-data-openapi.json) - 44 paths, served live at https://data.laposte.fr/data-fair/api/v1/api-docs.json
- [Colissimo SlsServiceWS WSDL](wsdl/la-poste-groupe-colissimo-sls.wsdl) - 15 SOAP operations: label generation, pickup planning, deposit slips
- [Colissimo PointRetraitServiceWS WSDL](wsdl/la-poste-groupe-colissimo-point-retrait.wsdl) - 9 SOAP operations: pickup-point and relay search
- [RFC 9727 API catalog](well-known/la-poste-groupe-api-catalog.json) - 21 anchors, served at https://data.laposte.fr/.well-known/api-catalog

## The nine public APIs

- [Suivi v2](https://developer.laposte.fr/catalog-apis/suivi@2) - `https://api.laposte.fr/suivi/v2` - tracking harmonised across tracked mail, Colissimo and Chronopost. `GET /idships/{idship}`, up to ten comma-separated numbers. Free plan but private (access on request), 10 calls/second.
- [ControlAdresse v2](https://developer.laposte.fr/catalog-apis/controladresse@2) - `https://api.laposte.fr/controladresse/v2` - French address validation and normalisation. `GET /adresses`, `GET /adresses/{code}`. Freemium 2,000 calls/year; Serenite EUR 50 excl. tax per 28 days.
- [Geolocalisation v1](https://developer.laposte.fr/catalog-apis/geolocalisation@1) - `https://api.laposte.fr/geolocalisation/v1` - address to GPS. Freemium 300 calls/year.
- [Geolocalisation inversee v1](https://developer.laposte.fr/catalog-apis/geolocinversee@1) - `https://api.laposte.fr/geolocinversee/v1` - GPS to up to five nearby addresses. Freemium 300 calls/year.
- [Digiposte v3](https://developer.laposte.fr/catalog-apis/digiposte@3) - `https://api.laposte.fr/digiposte/v3` - certified digital-safe partner API: memberships, certified document deposit, organisation safes, sharing, enrolment procedures. Free plan.
- [Lettre recommandee en ligne v1](https://developer.laposte.fr/catalog-apis/lettre-recommandee-en-ligne@1) - online registered mail. `POST /lh/pro/orders`, `POST /lh/pro/orders/pddng`. No public base URL is published.
- [Code de la route v2](https://developer.laposte.fr/catalog-apis/codedelaroute@2) - `https://api.laposte.fr/codedelaroute/v2` - driving-theory exam sessions and reservations, 12 routes. Free plan, 100 calls/second.
- [La Poste Open Data v1](https://developer.laposte.fr/catalog-apis/opendata@1) - `https://api.laposte.fr/opendata/v1` - postal codes, contact points, opening hours, services, accessibility, self-service machines, street letterboxes, new communes.
- [Colissimo](https://developer.laposte.fr/catalog-apis/colissimo@1) - `https://ws.colissimo.fr` - SOAP web services for labels, pickup planning and relay-point search.

## Derived and generated artifacts in this repo

- [Authentication profile](authentication/la-poste-groupe-authentication.yml)
- [Conventions, including reversibility](conventions/la-poste-groupe-conventions.yml)
- [Error catalogue](errors/la-poste-groupe-problem-types.yml)
- [Lifecycle, status page and deprecation](lifecycle/la-poste-groupe-lifecycle.yml)
- [Plans and pricing](plans/la-poste-groupe-plans-pricing.yml)
- [Rate limits](rate-limits/la-poste-groupe-rate-limits.yml)
- [Sandbox model](sandbox/la-poste-groupe-sandbox.yml)
- [Conformance and domain standards](conformance/la-poste-groupe-conformance.yml)
- [Data model](data-model/la-poste-groupe-data-model.yml)
- [Packages and SDKs](packages/la-poste-groupe-packages.yml) | [CLI](cli/la-poste-groupe-cli.yml)
- [Agent skills](skills/_index.yml)
- [Well-known probe](well-known/la-poste-groupe-well-known.yml)
- [MCP candidate tool set](mcp/la-poste-groupe-mcp.yml)

## Things an agent should know before integrating

- **No idempotency anywhere.** The string "idempoten" does not appear in any of the four OpenAPI documents or either WSDL. Every write - certified document deposit, membership creation, exam reservation, registered-letter order, Colissimo label generation - is unsafe to retry blind.
- **Suivi's HTTP status is not the whole answer.** A 207 body is an array of per-shipment envelopes each carrying its own `returnCode`. Six of the eight declared `returnCode` values have no published meaning.
- **No rate-limit headers.** Quotas are published on the plan card and never signalled at runtime; there is no `RateLimit-*`, `X-RateLimit-*` or `Retry-After`.
- **Deprecation is in French prose, not in the contract.** Six Digiposte v3 operations are titled OBSOLETE or PROCHAINEMENT DECOMISSIONNE in the portal while carrying no `deprecated: true` flag, and no sunset date.
- **Two majors are live but uncatalogued.** The status page reports ControlAdresse v1 and Code de la route v1 as running services; neither appears in the API catalogue.
- **Every first-party SDK is abandoned.** `laposte-okapi-sdk` last released 2016-10-15, `laposte-okapi-cli` 2017-04-27, the Colissimo Magento modules 2017 and 2019.
- **No MCP server and no A2A agent card.** `/.well-known/agent-card.json` and `/.well-known/agent.json` 404 on every La Poste host probed.
- **No error format standard.** Three incompatible envelopes; nothing returns `application/problem+json`.

## Security

- [security.txt](well-known/la-poste-groupe-security.txt) - served at https://www.laposte.fr/.well-known/security.txt and https://www.lapostegroupe.com/.well-known/security.txt
- Vulnerability disclosure policy: https://vdp.laposte.fr/p/Security-Information
- CERT du Groupe La Poste: https://www.lapostegroupe.com/fr/le-cert-du-groupe-la-poste, cert@laposte.fr
- La Poste states it runs no general bug bounty programme.

## Support contacts published per API

- serviceclients.sna@laposte.fr - ControlAdresse, Geolocalisation, Geolocalisation inversee
- support.api@laposte.fr - Lettre recommandee en ligne
- data.laposte@laposte.fr - Open Data