If a Consumer (Supplier) registers a technical account on behalf of an End Consumer, the application must include the document Addendum to the DIZ – Authorisation.
The Addendum to the DIZ – Authorisation may be attached to the application as an electronic PDF document signed with a Qualified Electronic Signature (QES) or a Qualified Electronic Seal (QESeal). Unsigned scanned copies will not be accepted. Alternatively, it may be submitted in paper form, in which case it must be signed by the statutory representative, notarised or officially certified, and bound.
As of 30 January 2023, applicants acting as End Consumers are no longer required to attach the Addendum to the DIZ – Confirmation of End Consumer Status to their applications. The relationship between the Consumer and the End Consumer is left entirely to the mutual agreement and responsibility of the parties, in accordance with the Detailed Integration Plan (DIZ), without any requirement to notify NASES of the specific terms and content of the End Consumer's legal status.
----------------------------------------------
If you already have a registered technical account and wish to use an additional technical account provided by another supplier, you must attach the document Consent to the Use of Mailbox Solutions from Multiple Providers to the new application for technical account registration.
The consent document may be attached to the application as an electronic PDF document signed with a Qualified Electronic Signature (QES) or a Qualified Electronic Seal (QESeal). Unsigned scanned copies will not be accepted. Alternatively, it may be submitted in paper form and must be signed by the statutory representative.
----------------------------------------------
To cancel an existing technical account, the statutory representative must submit a request to the electronic mailbox of the National Agency for Network and Electronic Services (NASES). The request must be electronically signed with a Qualified Electronic Signature (QES) or a Qualified Electronic Seal (QESeal). The document Revocation of Authorisation must be attached.
The Revocation of Authorisation may be attached to the application as an electronic PDF document signed with a Qualified Electronic Signature (QES) or a Qualified Electronic Seal (QESeal). Unsigned scanned copies will not be accepted. Alternatively, it may be submitted in paper form on the company's letterhead, signed by the statutory representative and bearing the company stamp.
----------------------------------------------
If a statutory representative authorises an employee to perform actions related to the registration of a technical account or the re-registration of a certificate associated with a technical account, the document Employee Authorisation must be attached to the electronic application.
The Employee Authorisation may be attached to the application as an electronic PDF document signed with a Qualified Electronic Signature (QES) or a Qualified Electronic Seal (QESeal). Unsigned scanned copies will not be accepted. Alternatively, it may be submitted in paper form on the company's letterhead, signed by the statutory representative and bearing the company stamp.
To use automated access via an authentication certificate and a technical account, you must first integrate with the Central Government Portal (ÚPVS). For information about the required steps, please contact the Central Contact Centre at +421 2 35 803 083 or complete the contact formOpens in a new window.
The message also specifies the name of the technical account (ICO - ...) for which the authentication certificate is about to expire.
If you did not carry out the registration yourself and have a contracted supplier or service provider for your records management system or another information system used to log in to the ÚPVS or access its services, inform them about the notification and agree on the procedure for re-registration.
The supplier or service provider may re-register the certificate on your behalf, provided that all requirements described in the methodological guidance on technical account registration and in the list of attachments referred to above in the article are met.
Bulk registration of authentication certificates through a single application is not supported by the Authentication Certificate Register.
If multiple certificates need to be registered, the integrated entity must use one of the following options:
You must use the form entitled “Application for Cancellation of a Service Provider in the IAM Module.”
After logging in to the ÚPVS, you can find the form under “Find a Service” or under “Profile” → “Technical Accounts and Certificates” → “Service Providers”, where you should click the “Cancel” button.
You must use the form entitled “Application for Changing Service Provider Details in the IAM Module.”
After logging in to the ÚPVS, you can find the form under “Find a Service” or under “Profile” → “Technical Accounts and Certificates” → “Service Providers”, where you should click the “Edit” button.
You must use the form entitled “Application for Registration of a Service Provider in the IAM Module.”
After logging in to the ÚPVS, you can find the form under “Find a Service” or under “Profile” → “Technical Accounts and Certificates” → “Service Providers.”
No. An authentication certificate must be linked to a technical account.
You can find the technical account name in one of the following ways:
A power of attorney must be attached to the application.
Such applications are not processed automatically upon submission. Instead, they are subject to manual review by an ÚPVS staff member.
Applications for registration and updating of a Service Provider (SP) are processed once every 24 hours.
Other applications are processed every 5 to 10 minutes, unless manual processing by an ÚPVS staff member is required, for example, in the case of an anonymously submitted application.
You must use the form entitled “Application for Revocation of Technical Account Access Rights (Cancellation of Technical Account).”
After logging in to the ÚPVS, you can find the form under “Find a Service” or under “Profile” → “Technical Accounts and Certificates.” Select the relevant technical account and click the “Cancel” button.
You must use the form entitled “Application for Revocation of an Authentication Certificate in the Authentication Certificate Register.”
After logging in to the ÚPVS, go to “Find a Service” or “Profile” → “Technical Accounts and Certificates.” Click the name of the technical account linked to the authentication certificate, then click the “Revoke” button next to the relevant certificate.
You must use the form entitled “Application for Updating an Authentication Certificate Entry in the Authentication Certificate Register.”
You can find the form after logging in to the ÚPVS, under “Find a Service.”
You must use the form entitled “Application for Changing Technical Account Access Rights.”
After logging in to the ÚPVS, you can find the form under “Find a Service” or under “Profile” → “Technical Accounts and Certificates.” Select the relevant technical account and click the “Edit” button.
The registered technical account, linked to the authentication certificate, can be used to obtain a time-limited SAML token. This token is used to prove the entity's identity when accessing authenticated ÚPVS services, for example, when automatically retrieving the contents of an electronic mailbox.
You will receive a notification confirming the successful processing of your application in the owner's electronic mailbox and at the email address provided as the contact address in the application.
To register an authentication certificate, you must use the form entitled “Application for Registration of an Authentication Certificate in the Authentication Certificate Register.”
You can find the form under “Profile” → “Technical Accounts and Certificates” or under “Find a Service” on the ÚPVS.
The technical account is created automatically as part of the authentication certificate registration process.
The application can also be submitted without logging in. In this case, after submitting it electronically, you must print the application, sign it, have your signature officially certified, and send it to the National Agency for Network and Electronic Services (NASES).
All important information, requirements, steps, and procedures concerning authentication certificates, technical accounts, and service providers can be found on this page.Opens in a new window
Notifications concerning the impending expiration of an authentication certificate or a service provider (SP) certificate are sent to the owner's electronic mailbox 30 days, 14 days, 7 days, and 1 day before expiration, as well as on the expiration date itself.
If you provided contact details in your application, the notifications will also be sent to the email address you specified.
Under the currently applicable IAM Integration Manual, an authentication certificate must be valid for a minimum of 30 days and a maximum of 2 years. A technical account has an unlimited validity period.
The applicant may limit only the validity period of the authorisation between the technical account and its owner. The “Valid from” and “Valid until” fields determine the validity of the authorisation and, consequently, the right to access and manage the electronic mailbox. Specifying an end date for the authorisation is optional.
The technical account remains active even after the authentication certificate expires, but it cannot be used to log in. Once a valid authentication certificate has been registered, the technical account can be used to log in again.
The certificate may be issued by the applicant itself (a so-called self-signed certificate). If the certificate is issued by a certification authority, information identifying the issuing certification authority must not be included in the certificate. There is also no need to send information about the issuing authority to NASES.
The Authentication Certificate Register contains all information about certificate validity and does not take into account the status of an authentication certificate in the issuing certification authority’s Certificate Revocation List (CRL). Certificates must be revoked by submitting a request to the register.
Further details are provided in the guide “Authentication Certificate Register (RAC) – Technical Accounts and Authentication Certificates,” available earlier in the article.
To use ÚPVS services, you must integrate your system with the portal. Any entity seeking to integrate can request access to the technical documentation.
The complete integration process and all the necessary information are available on the Integrations Opens in a new windowpage.
An authentication certificate is an electronic document that proves the electronic identity of the entity to which it was issued. It is used for identification and authentication when accessing an information system or conducting electronic communications automatically in connection with the exercise of public authority, as well as for automated access to or management of an electronic mailbox.
Instructions for creating an authentication certificate are provided in the document “Authentication CertificateOpens in a new window.”
A technical account is created following an application to register an authentication certificate together with a technical account. It is required to use an authentication certificate.
A technical account is a special type of identity created internally in the Identity Access Management (IAM) system. It is intended for a natural person, legal entity, or public authority and is used for identification and authentication through technical or software-based means using an authentication certificate. The technical account represents the identity of its owner.
A technical account in the IAM module (Identity Access Management, the identity management system within ÚPVS), or the authorisation granted through that technical account, determines the scope of permissions for accessing and managing the electronic mailbox of the represented entity through supported communication interfaces. For public authorities, it also determines the scope of permissions for accessing services provided by the shared modules of ÚPVS.
A technical account represents one entity: a natural person (FO), legal entity (PO), or public authority (OVM) that owns the technical account. That entity may subsequently represent any number of other entities, provided the necessary authorisations have been granted.
Example: A legal entity providing services to various clients can register a technical account linked to an authentication certificate and then represent any number of clients based on the authorisations granted to it.
One identity may have multiple registered technical accounts and multiple authentication certificates.
An individual authentication certificate can be registered only once and linked to only one technical account. Registration of the same authentication certificate will be rejected because its digital fingerprint matches an existing certificate.
An unlimited number of authentication certificates can be registered for a single technical account. There is no fixed limit; however, if a large number of certificates is required for one identity (on the order of hundreds), prior consultation with the Integration Department is recommended.
Yes. This is possible if the person associated with the technical account to which the valid authentication certificate is linked has been authorised to access multiple electronic mailboxes.
In practice, this means that once a form granting a natural person, legal entity, or public authority permission to access and manage an electronic mailbox has been submitted, the authorised person can access that mailbox using their authentication certificate. The authorisation form is available directly in the electronic mailbox and can be submitted electronically or in paper form.
One entity (FO/PO/OVM) may represent an unlimited number of other entities based on authorisations granted in this way. The same authentication certificate linked to its technical account can be used to access each mailbox it is authorised to manage.
To call ÚPVS services on behalf of a represented entity (the end consumer), the information system of the representing entity (consumer) must call the IAM STS authentication service with the OnBehalfOfId parameter. This parameter must contain the UPVSIdentityID (UUID identifier) of the identity that granted the representing entity permission to manage the mailbox.
In response to this request, the IAM service issues a SAML token for the represented entity. The information system can then use this token in the standard way when calling individual ÚPVS services.
The UUID of the represented entity required for the OnBehalfOfId parameter can be obtained through the ÚPVS graphical interface. In the identity's “Profile” section, it is displayed in the “Identity ID” field. This identifier is available in the profile of both the identity that was granted representation rights and the identity that granted those rights.
Once ÚPVS services are being used on behalf of a represented entity through an STS token obtained using the OnBehalfOfId parameter, the authentication certificate of the represented entity must no longer be used, if the representing entity has access to it under a power of attorney included as an annex to the Integration Intent Agreement (DIZ).
The model power of attorney published by NASES in May 2019 and included as an annex to the DIZ contains an option allowing the representing entity (consumer) to configure authorisation to manage the electronic mailbox of the represented entity (end consumer).
The power of attorney attached to the DIZ therefore allows the authorised representative (consumer) to grant itself permission to access and manage the electronic mailboxes of the represented entities on their behalf using their authentication certificates. This enables migration from the original method to the new method of managing electronic mailboxes.
If access and mailbox management permissions are to be granted exclusively to a technical account, meaning that the statutory representative of the organisation receiving the authorisation must not be able to access those mailboxes using their electronic identity card (eID) or MobileID, a list of the entities for which access should be restricted must be sent to NASES. This restriction can also be configured for existing representation arrangements.
Note: If an entity needs to use services on behalf of other entities from different information systems and wishes to configure different authorisation levels for those systems or use more than one certificate or technical account, this is also possible. In such cases, multiple technical accounts may be registered for one identity, or multiple certificates may be registered for a single technical account belonging to that identity.
A new form is being prepared that will allow mailbox management permissions to be granted exclusively for access through technical accounts using authentication certificates, with the option of also allowing access through eID and other methods. This will prevent representation arrangements from being unnecessarily displayed on the login page to the statutory representative of the representing identity when logging in using eID.
Authentication certificates enable automated access to services provided by the shared modules of ÚPVS and automated access to or management of an electronic mailbox through technical or software-based means, without requiring an electronic identity card with a chip (eID card).
These technical and software solutions can be obtained from third-party providers or developed in-house, provided the requirements for successful integration with ÚPVS are met.
Applications may be submitted by public authorities, natural persons, entrepreneurs, and legal entities.
The general terms and conditions governing the rights, obligations, and legal relationships associated with the provision of electronic services through the Central Government Portal are set out in the document “General Terms and Conditions for the Provision of ÚPVS Services.Opens in a new window”
