Endpoints

March 21, 2026 ยท View on GitHub

All API calls use Retrofit with form-urlencoded POST (most endpoints) or JSON body POST.

Base URL

https://www2.agenciatributaria.gob.es/

See AEAT Infrastructure for the full subdomain map.

Core Endpoints (www2)

EndpointMethodPurpose
wlpl/MOVI-P24H/ClaveStartingSvPOST (form)App initialization, establishes device context, sets appmovil cookie. Returns URL whitelists/blacklists.
wlpl/MOVI-P24H/ClaveIsNifActivatedSvPOST (form)Check if a NIF is activated in Cl@ve
wlpl/MOVI-P24H/ClaveRequestPinSvPOST (form)Request a Cl@ve PIN (returns pin + timeToLive in seconds)
wlpl/MOVI-P24H/ClaveRequestAllOperationsSvPOST (form)Poll for pending authentication requests. Also serves as device session validation before PIN request.
wlpl/MOVI-P24H/ClaveAuthenticateSvPOST (form)Confirm a pending Cl@ve Movil authentication request
wlpl/MOVI-P24H/ClaveCancelAuthenticateSvPOST (form)Reject a pending Cl@ve Movil authentication request
wlpl/MOVI-P24H/ClaveDesactivateAuthSvPOST (form)Deactivate device authentication
wlpl/MOVI-P24H/ClaveCheckMyDataSvPOST (form)Get user account data (email, phone, registration level)
wlpl/MOVI-P24H/ClaveOperationsHistorySvPOST (form)Query operations history with date range and filters
wlpl/MOVI-P24H/ClaveSetFirebaseTokenSvPOST (form)Register Firebase push notification token
wlpl/MOVI-P24H/ClaveMigrationSvPOST (form)Migrate from old Cl@ve PIN to new version
wlpl/MOVI-P24H/ClaveMovilQrSvPOST (form)QR code authentication (step 1 of QR flow)
wlpl/MOVI-P24H/ObtenerPeticionesMarketsSvPOSTGet pending market petitions

Activation & Registration Endpoints

EndpointSubdomainMethodPurpose
wlpl/MOVI-P24H/ClaveActivateAuthenticationSvwww6POST (form)Activate device authentication. Requires pin24H cookie. JSESSIONID must be stripped.
wlpl/MOVI-P24H/ClaveRequestStateSvwww12POST (form)Check registration state after DNI auth (registered, phone, level)
wlpl/MOVI-P24H/ObtenerClaveMovilwww12GETGet Cl@ve Movil activation page
wlpl/MOVI-P24H/ValidarClaveMovilwww12POST (form)Validate Cl@ve Movil token (step 2 of SSO confirm flow)
wlpl/MOVI-P24H/ObtenerClaveMovilSMSwww12POST (empty body)Trigger SMS verification code to registered phone. Must not send Content-Type.
wlpl/MOVI-P24H/ValidarClaveMovilSMSwww12POST (form)Validate SMS code (sets pin24H + pin24V cookies)

DNI/NIE Authentication

EndpointMethodPurpose
wlpl/BUCV-JDIT/AutenticaDniNieContrasteh?ref=%2Fwlpl%2FMOVI-AEAT%2FAccesoW12SvPOST (form)Authenticate with DNI/NIE + date of birth

Certificate Registration

EndpointMethodPurpose
wlpl/MOVI-JDIT/C/IniciarAltaConCertificadoSvPOST (JSON)Initiate certificate-based registration
wlpl/MOVI-JDIT/C/ValidarAltaConCertificadoSv (www12)POST (JSON)Validate certificate registration

Supporting URLs (browser-based)

URLPurpose
wlpl/MOVI-JDIT/Acceso?gestion=REGISTRO_CERTIFICADO&nif=Register via certificate
wlpl/MOVI-JDIT/Acceso?gestion=REGISTRO_CARTARegister via letter
wlpl/MOVI-JDIT/Acceso?gestion=MODIFICA_TELEFONO&nif=Change phone number
wlpl/MOVI-JDIT/Acceso?gestion=OBTENER_SUPERIOR&nif=Get advanced registration
wlpl/MOVI-JDIT/Acceso?info=AYUDA_CERT_ANDROIDHelp with Android certificates
wlpl/MOVI-JDIT/Acceso?ext=OFICINAS_CLAVELlave offices
wlpl/MOVI-JDIT/Acceso?ext=REGISTRO_PRESENCIALIn-person registration
wlpl/MOVI-JDIT/SoporteAppSv?APP=CLAVEApp support

Endpoint Reference (Weak Auth Flow)

The following table summarises the endpoints used in the DNI/NIE + SMS activation flow:

#EndpointSubdomainPathMethodBodyPurpose
0ClaveStartingSvwww2/wlpl/MOVI-P24H/POSTFormDevice context + appmovil cookie
1AutenticaDniNieContrastehwww2/wlpl/BUCV-JDIT/POSTFormDNI/NIE weak auth (returns HTML)
2ClaveRequestStateSvwww12/wlpl/MOVI-P24H/POSTFormRegistration state check
3ObtenerClaveMovilSMSwww12/wlpl/MOVI-P24H/POSTEmptyTrigger SMS code
4ValidarClaveMovilSMSwww12/wlpl/MOVI-P24H/POSTFormValidate SMS code (sets pin24H)
5ClaveActivateAuthenticationSvwww6/wlpl/MOVI-P24H/POSTFormDevice activation (no JSESSIONID!)