First-run onboarding

Connect a tenant key, activate modules, add trading parties, and send a sandbox document. Guided checklist uses live /onboarding/status.

Sandbox evidence stays SIMULATED. Live Peppol is not claimed until OpenPeppol membership unlocks Own-AP.