Conformance with the Colissimo documents

Part of the Colissimo Labels, Pickup Points & Tracking documentation. See also Developer notes for the field-by-field table. Previous: Developer notes.

What the add-on does against the documents of Colissimo, and what could not be checked. Colissimo gives no test accounts, so the add-on was built from the published documents and the public files of the services and was never run against a Colissimo contract.

Short name	Document	Used for
SLS	“Flexibilite - Shipping Web Service”, technical document, october 2023 (EN)	Labels, CN23, return labels, products, error codes
OpenAPI / WADL / WSDL	openapi.json and ?_wadl of .../sls-ws/SlsServiceWSRest/2.0, .../sls-ws/SlsServiceWS/2.0?wsdl, .../pointretrait-ws-cxf/PointRetraitServiceWS/2.0?wsdl, saved in tests/fixtures/official	Property names, types, required fields, resource paths, header apiKey
PR	“Flexibilite - Web service de choix de livraison”, november 2024	Pickup point search and lookup by identifier
WID	“Pick-up Point V2 WIDGET” technical paper, version feb 2026	Widget, token, parameters
TL	“Specifications timeline tracking web service”, v2.6, 13 december 2024	Tracking
Kit	Colissimo communication kit page (logo rules)	Why no logo is used

How it was tested. tests/unit.php (php81 and php83) validates every request body the add-on builds against the OpenAPI schemas (unknown properties, required properties, types, field lengths from SLS II.5.2), runs the official example requests of SLS chapter VII through the same validation, parses multipart answers built in the observed framing, and replays the pickup, tracking and error samples of the documents. A mock server that follows the documents is used by the browser tests. Nothing was run against a real Colissimo contract.

Verified against the documents

• Endpoints and methods of the three services; apiKey header; credentials in the body for the contract number and password variant.
• Product codes DOM, DOS, COM, CDS, HD, CORE and the rule that HD needs pickupLocationId, a mobile number, an e-mail address and commercialName (SLS III.1, II.5.2).
• Label formats PDF 10x15 / A4, ZPL 203 / 300 dpi and the _UL unique label variants (SLS III.3).
• Weight 0.01 to 30 kg with two decimals, amounts in euro cents, insurance levels, ftd for Overseas France (SLS III.2, III.7).
• Field lengths of every address and reference field, transliteration before cutting, French phone rules (SLS II.5.2.5, II.5.2.6, I.5).
• Customs data: categories 1 to 6, HS code 6 / 8 / 10 digits, at most 100 articles, value in euros, returnTypeChoice 2 or 3, EORI field (SLS II.5.2.4, III.5).
• Pickup point request and answer fields, error codes (PR II.5, II.6, II.8, III).
• Widget token, script, parameters, filter values 0 / 1 / 2 / 3 / 5 / 10 / 11 (WID 2.2, 2.4, 2.5).
• Timeline steps 0 to 5, status codes and event fields (TL II.3, II.4).

Verified by looking at the live services (no credentials)

Four calls with a made-up login on 2026-11-07 showed: the label answer is multipart/related with start="<jsonInfos>" and a JSON part with Content-ID jsonInfos; functional errors come with HTTP 400 (the check method answers plain JSON, the label method the same multipart framing); letter.sender is required in practice ([50007]); the REST pickup paths findRDVPointRetraitAcheminement and findPointRetraitAcheminementByID exist and answer HTTP 400 with errorCode 201 to a wrong login; the tracking service answers HTTP 200 with the error in status[0].code; and repeated failures block a login ([30013]), which is why the add-on never retries authentication errors and why the live service is not probed again.

Flagged: not verifiable without a Colissimo contract

Topic	What the add-on assumes
Key-only authentication of generateLabel	With an application key the body carries no contractNumber / password (the OpenAPI marks them deprecated). Not proven with a valid key.
getLabel answer	Read as raw label bytes or as the multipart answer; the OpenAPI document only says “Response”. Used for adopting a parcel and for re-downloading; a failure only leaves the label to reprint in the Colissimo Box.
CN23 part Content-ID	cn23 (OpenAPI description); the live name could differ.
Signed pdfUrl	Fetched only from ws.colissimo.fr; the signature is not checked.
Overseas territories for COM / CDS	GP, MQ, GF, RE, YT, PM, BL, MF, NC, PF, WF, TF; the Colissimo list of eligible countries was not machine readable.
Postal code length	The document says AN5 but also that the format is checked per country (Canada has 6 characters); the add-on cuts to 10.
Widget callback object	The selected point is read as identifiant and reseau (the names of the point web service). The server looks the point up again, so a wrong key only makes the choice fail with a message.
Public tracking page	https://www.laposte.fr/outils/suivre-vos-envois?code=<number> is the public La Poste link, not part of the web service documents.
Tracking query limits	The tracking document names none; the add-on reads about every 5 hours at most.
Not implemented	Cash on delivery, DDP, the hand-over slip (generateBordereauByParcelsNumbers), mailbox pickup (planPickup), generateToken, international returns CORI / CORF, Colissimo Flash products.

Deviations found in the documents

• The example requests of SLS chapter VII use addresseeParcelRef values longer than the limit AN1..15 of the same document; the test shortens the value before validating, the add-on cuts to 15.
• The example number 0x12345678 is one of the dummy numbers SLS II.5.2.5 refuses; the tests therefore use another mobile number and assert that the dummy is rejected.
• The OpenAPI document still names the base URL of an internal host in servers; the public host ws.colissimo.fr of SLS II.1 is used.

Logo and trademark

The communication kit offers the logo to merchants for their own merchant site and forbids changes of colour or shape; partner use refers to the general terms of Colissimo Entreprise, and no procedure for software vendors is stated. The add-on and its product pages therefore use text only. The widget shows its own logo because it is a tool of La Poste. Colissimo and La Poste are trademarks of their respective owners.