beA

With the ComCenter, you can access your beA mailbox.

Requirements

Permission & License

To use beA with ComCenter, your user needs to have the comcenter.channel.bea role. The tenant needs to have comcenter.bea license.

Software Token

To use beA with ComCenter, you will need a software token (beA software certificate). You can order that from the Federal Chamber of Notaries (Bundesnotarkammer).

The software token (also known as the beA software certificate) is a file containing a digital certificate provided by the Federal Chamber of Notaries. It enables the use of beA without a beA card and card reader. To use beA with the ComCenter, a software token is absolutely required.

You can order the software token from the Federal Chamber of Notaries. More information is available on the Seiten der Bundesnotarkammer. There you will also find a detailed guide on how to create and download the software token.

The software token does not grant immediate access to the beA mailbox. For security reasons, it must first be linked to a profile and activated before it can be used. The beA user manual describes this process in detail at Neues Token hinterlegen und freischalten.

Initial Setup

During the creation of a beA channel, the software token is uploaded. The PIN is also stored. Both information, certificate and PIN, are considered highly sensitive information, because they grant access to the beA postboxes of the owner. Certificate and PIN are encrypted in transit and at rest.

The new channel is only available to the user that created it. It cannot be seen or used or managed by any other user!

Using multiple users beA Mailbox and Finding the SAFE-ID

To allow a beA user with a software certificate to access another person’s mailbox, you must:

1. Granting Permissions in the beA Portal
2. Unlock the user’s software certificate (Sicherheits-Token) for the target mailbox.
3. Locate the mailbox’s SAFE-ID for use in external systems such as ComCenter.

Predefined Roles

In beA, permissions are typically assigned via predefined roles.
These roles bundle multiple rights and cover the most common use cases:

• Mitarbeiter – Basic access (read/view), no sending or signing rights.
  
• Zustellungsbevollmächtigter – Authorized to officially receive court documents (eEB).
  
• Postfachverwalter – Full administrative control, including user and settings management.

(Note: “Vertretung” is often used in practice to describe a user with extended rights, but the official BRAK documentation lists roles as shown above.)

Step 1: Granting Permissions in the beA Portal

To manage access rights in beA, log in as the mailbox owner (Postfachinhaber) via the official beA web portal using your beA card.
A software certificate alone does not provide sufficient rights for user and permission management.

1. Navigate to:
   Einstellungen → Postfachverwaltung → Benutzerverwaltung
   
2. Search for the user you want to grant access to.
   • If the user does not exist, create a new entry using Benutzer hinzufügen.
     
   • Do not assign a separate mailbox, so the user becomes a sub-user of the main mailbox.
     
3. Select the user and open: Rolle & Rechte verwalten

Individual Rights

Instead of relying only on predefined roles, it is also possible to assign individual rights for more fine-grained control.
Examples include:

• 01 – View mailbox overview
  
• 03 – Create new messages
  
• 05 – Send messages
  
• 06 – Read messages
  
• 14 – Sign and send electronic receipts (eEB)
  
• 15 – Reject eEB
  
• 30 – View and download attachments
  
• 99 – Full access (all permissions)

Note: At least one role must be assigned before individual rights can be added or removed.
For most cases, the role Mitarbeiter is used as a starting point, since it only contains basic rights.

Save the Configuration

Once roles and/or rights have been set, confirm and save the configuration.
The changes will take effect the next time the user logs in with their beA certificate.

Further Information

The complete and always up-to-date list of roles and rights is documented in the official
beA manual of the BRAK – Authorization Concept.

Step 2: Unlock the user’s software certificate (Sicherheits-Token) for the target mailbox

After permissions are set, you must explicitly unlock the delegated user’s security token (software certificate) for the mailbox.

1. Still logged in as the mailbox owner, go to:
   Einstellungen → Postfachverwaltung → Sicherheits-Token freischalten

2. Locate the certificate associated with the delegated user.

3. Select it and unlock it by entering your PIN.

4. Confirm the activation.

The user can now access the mailbox using their own beA account and certificate, within the permissions granted.

This process must be repeated for each mailbox the user should access.

Step 3: Locate the mailbox’s SAFE-ID for use in external systems such as ComCenter

The SAFE-ID is the unique identifier of a beA mailbox. It is required for external tools like ComCenter.

1. The delegated user logs into the beA portal using their own credentials and software certificate.

2. Use the mailbox selector in the top-right corner to choose the mailbox they now have access to.

3. Navigate to:
   Einstellungen → Postfachverwaltung → Informationen zum Postfach

4. The SAFE-ID will be shown on that page.

Repeat this for each mailbox you want to configure.

References

• beA user administration - authorization concept (DE)
• Manage user rights and roles (DE)
• Unlock security token (DE)

Channel Setup

This chapter describes the basic usage from the end user’s perspective.

Create beA channel identitiy

Users can create and manage their beA channels via the Channel Management section in the ComCenter.
Each channel is stored encrypted and is only visible to the user who created it.

1. Open the ComCenter user interface.
   
2. Navigate to Channel Management.
   
3. Click Add Channel.
   
4. Select beA type.
5. Add a Name for the channel.
6. Add a SAFE_ID (address) of the channel.
7. Upload a valid certificate (Software Token).
8. Enter the PIN associated with the token.
   
9. Click Save.
   → The beA channel is stored encrypted and appears with status complete, if a test connection to the beA server could be successfully established.

Update an existing beA channel

Opening an existing channel user can update all the fields of it with valid ones.

Channel status

The status of a channel indicates whether the setup and authentication were successful.
It helps users quickly see if the channel can be used for sending and receiving messages. The current status is shown in the Channel Management Overview.

Visibility of beA Channels

Each beA channel is stored user-specific and is therefore only visible to the user who created it.
This ensures that personal access data (software token and PIN) remain private and secure.

Visibility rules

Practical example

If User A uploads their own software token and sets up a beA channel,
User B will not see this channel in their Channel Overview.
Both users must create their own beA channel to access beA messaging.

Note: beA channels are bound to the individual user account and cannot be shared or transferred.
If multiple users need access to the same beA postbox, shared access must be configured separately (see related FAQ: How to utilize other users’ postboxes?).

How does the user log in and stay logged in with a beA session?

Users do not need to log in manually to beA. Once a valid software token and PIN are configured in the channel, ComCenter automatically manages the connection to beA.

Session handling

• When sending or receiving messages, ComCenter automatically establishes a beA session in the background.
  
• The session remains active as long as it is valid and needed for communication.
  
• If the session expires, ComCenter automatically reestablishes it.

Note: ComCenter manages the beA session automatically — no manual login is required.
If message transmission fails, please check whether the software token or PIN is still valid.

Channel Functions Overview

Folders in beA

Root folders

Folders define a hierarchical structure used to organize messages. Root folders represent the highest level in this structure and include:

• Posteingang (Inbox)
• Gesendet (Sent)
• Entwürfe (Drafts)
• Recycle bin (currently not available)
• Outbox (currently not available)

Custom folders

Users are able to create own folders as follows:

Users can create and delete custom folders by clicking on Create Subfolder or Delete Subfolder button from the vertical ellipsis menu.

![alt text]

A modal opens, allowing users to type the name of the folder. Name must not be empty and can be no longer than 100 symbols. Duplication of folders is not allowed. Default name of a custom folder is “New Folder”. Only two nested subfolders are allowed.

Moving messages through folders

Users are able to move existing messages from one folder to another. Users can move messages by opening them and clicking on the button Move in the toolbar:

A modal opens, allowing users to choose between existing folders. Messages can be moved from a root folder to a subfolder, between subfolders, or from a subfolder back to the root folder. Moving messages to the same folder is not allowed. Moving messages between different root folders is also not allowed (e.g., from Posteingang to Gesendet).

Creating Draft Messages

Logged users can create draft messages by clicking Create Message button and populate mandatory and non-mandatory fields.

Available inputs

1. Reference number sender - non mandatory field, indicating the Case number of the sender, if such
2. Message subject - mandatory fields with minimum lenght of 2 characters
3. Reference number recipient - non mandatory field, indicating the Case number of the recipient, if such
4. Attachments (see Attachments section)
5. Acknowledgment of receipt (see Eeb section)
6. Recipient - mandatory field, can be found and selected

Search recipient

User can find recipient by clicking on the input field. It will provide a search modal, interacting with BRAK address book.

You can search for recipients by following inputs:

• First Name
  
• Last Name
• Office Name
• City
• Postal Code

After entering the desired information, click Search to display matching results. Click Clear to reset the input fields and start a new search.

The system displays matching results from the address book, including recipient details (as shown in the official beA web app), so that the correct contact can be selected.

Set recipient

Recipients can be set in two ways:

• Manually via the UI:
  Select the recipient directly from the address book search results.

• Programmatically via web component input:
  Provide the target SAFE-ID, Govello-ID, or VAS as input — this recipient will then be preselected by default.

Attachments

1. Go to the Attachments section.
2. Click on the drop zone or drag and drop the file into the area.
3. The order of the files determines their order in the message.

• You can see, open, and edit the attachments in the beA web app.
  
• You can remove attachments from the draft.
• You can reorder attachments.
• You can change type of the attachments.

Non valid attachments shows error and are not uploaded. Every attachment name must be unique, and attachment names must be valid.
The beA API validates the attachments.

The file xjustiz_nachricht.xml is not allowed for upload, as it is generated dynamically.

File Types and Size Limits

• Unsupported file types: .exe, .com, .bat, .cmd, .lnk, .ini
• xjustiz_nachricht.xml cannot be uploaded
• xjustiz_nachricht.xml is generated automatically on draft message creation and kept up-to-date after each change
• Maximum size of a single file: 100 MB
• Recommended maximum size per file: up to 10 MB (files larger than 10 MB are technically allowed, but may cause issues or are discouraged). System shows a warning message for larger files.
• Maximum size of all attachments including the draft: 200 MB. The total size of all attachments, including xjustiz_nachricht.xml and the message draft itself, must not exceed 200 MB.
• Maximum amount of all attachments: 1000
• Dropdown field: Legal document or Attachment

Preview Attachments

If a message contains attachments, they are displayed in the Attachments section in the lower part of the message details (see Screenshot 1).
The table provides information about file name, type, size, and actions for download and preview.

To view an attachment directly, click Preview

.

The document opens in a preview window without the need to download it.

Note: The preview works only for supported file formats (e.g. PDF, TXT, image files). For the rest “No preview” page is shown. The preview is only available for supported file formats (e.g. PDF, TXT, image files).

Acknowledgement of receipt / eEB

• Check the option Acknowledgement of receipt.
• This automatically generates the corresponding entry in the xJustiz dataset.

Note: The eEB entry is part of the attachment entries. The option is only enabled if there is at least one attachment in the draft.

• When opening the draft again, the option remains checked (as long as attachments are present).
• If all attachments are removed from the draft, the option EEB required is automatically unchecked and disabled.
• If the draft is opened in the beA web application, the EEB requirement is also shown.

Note: The checkbox is only available if at least one attachment exists in the draft. If the checkbox is selected and attachments are present, the system will prompt the user to clear the acknowledgment before deleting the final attachment.

Saving drafts

The system automatically saves your current message as a draft. You can reopen it later from the Drafts folder.

Sending drafts

Once all mandatory fields (*) are filled in, the Send message button becomes active. Click Send message to submit your draft.

Understanding beA message details

To view the details of a beA message, click on the desired message in the message overview.
The message will open on the right-hand side and display all relevant information. Message details are displayed, including the status of eEB. The content of a ProcessCard (if existing) is displayed in the message details at the top of the message.

Understanding the eEB status of messages

After sending a message that requires an electronic receipt (eEB), the status of the message is displayed directly.
This allows the sender to immediately see whether the message was accepted or rejected, without having to access beA separately, or searching for the content of the eEB response message.

Accepted: The message was confirmed and accepted by the recipient.

Rejected: The message was rejected by the recipient.

Pending: No feedback has been received from the recipient yet.

Response: The message is an eEB response.

Filling out the eEB form

When a message requires an electronic receipt (eEB), a form appears in the message details.
From here, the eEB can be accepted or rejected directly.

The form contains the following elements:

• Title: eEB angefordert – indicates that an eEB is required for this message.
  
• Description This message requests an eEB. Please accept or reject the eEB.
  
• Akzeptieren (Accept) Confirms receipt of the message.
  
• Ablehnen (Reject:) Rejects the electronic receipt request.
  
• Date field (DD/MM/YYYY) - represents the date of acceptance.
  
• Begründung (Reason) Dropdown menu to select a reason when rejecting an eEB.
  
• Text field Free text to add as an explanation or note for the recipient when rejecting an eEB.
  
• Senden (Send) Submits the selected action to beA.

Note: The eEB must be either accepted or rejected before the process can be completed.
Once sent, the eEB status is automatically updated and displayed in the message list and detail view and cannot be revoked or changed.

Accepting an eEB

To accept the eEB:

1. Open the message that requires confirmation.
2. Click Accept eEB to confirm receipt and provide mandatory Date field (DD/MM/YYYY):.
3. Confirm the action.

Denying an eEB

To reject an eEB:

1. Open the message that requires confirmation.
   
2. Click Reject eEB.
   
3. Provide a Reason from Begründung (Reason) - mandatory field.
4. Provide a free text to explain the reason for the rejection in Text field- mandatory field.
5. Confirm the action.

After denial, the status changes to Rejected, and the sender is automatically notified through the beA system.

Note: The denial of an eEB is also legally transmitted via beA and visible to the sender as part of the message history.

Verification Report (Prüfprotokoll)

What is a Prüfprotokoll?

When a digital signature is verified through beA (besonderes elektronisches Anwaltspostfach), a Prüfprotokoll (verification report) is generated.
This report documents:

• The verification status of the signature
• The validity of certificates
• Additional technical information about the verification process

The Prüfprotokoll ensures transparency and allows you to present a legally sound record of the verification result.

Verification Statuses

When a signature is checked, the result can be one of three outcomes:

1. SUCCESS – The signature is fully valid and has passed all checks.
2. PARTIAL – The signature is valid, but some conditions could not be verified completely (e.g., missing CRL/OCSP information).
3. FAILED – The signature is invalid, or one or more verification checks did not pass.

This status is always reflected in the accompanying Prüfprotokoll (verification report).

Where to Find the Prüfprotokoll

You can view the Prüfprotokoll in two convenient places:

1. Immediately after sending or receiving a message

   • The report is attached to the delivery/verification receipt.
   • This means you instantly have proof of the verification outcome.

   

2. From the toolbar of an already created message

   • When viewing a stored message, you can open the report directly from the toolbar.
   • This ensures you can always retrieve the verification report later.

   

Seamless with the beA Web Portal

Our application follows the same behavior as the official beA web portal:

• A Prüfprotokoll is available for SUCCESS, PARTIAL, and FAILED results.
• You can preview the report directly in the interface — no need to export or download first.
• The workflow is familiar and consistent with the beA standard.

Why This Matters

• You always receive a complete verification report for your records.
• The Prüfprotokoll is consistent, transparent, and auditable, supporting compliance requirements.
• Instant preview access saves time and ensures clarity, just like in the official beA portal.

Archiving Messages, Attachments and Validation Reports

General information

• Incoming and outgoing beA messages and their attachments and validation reports are automatically archived. Messages - by ComCenter while attachments and validation report - by STP.Documents. With this process users do not have to rely on the beA server for long term availability.
• File extensions supported for archiving: jpg, jpeg, png, bmp, gif, txt, pdf, doc, docx, dot, dotx, ppt, pptx, xls, xlsx, zip, msg, beamsg, xml, json, pkcs7.
• If, for any reason, the archiving process fails, the system will automatically retry to archive the messages with the attachments and validation reports. System will do 10 attempts to finish archiving and if not succeeded will return error and the progress status will change to “Failed” (see section Progress status).
• If, for any reason, the archiving process has not completed successfully, it will automatically restart the next time the user opens the message.
• Progress status icons are updated on refresh.

Outgoing messages

• For outgoing beA messages, the system triggers archiving process automatically.
• The user can understand progress status by clicking on the message in Gesendet folder. At the top right of the message toolbar an icon is available.

Inbox messages

• For incoming beA messages, the system will trigger archiving process automatically once the user opens the message.
• The user can understand progress status by clicking on the message in Posteingang folder. At the top right of the message toolbar an icon is available. On first click it will be Not started, but after refresh the icon will be updated.

Available Progress Statuses

Not started

Archiving is not started.

Started

Archiving has started.

Partially Succeeded

Archiving has started, and some parts of the process have completed successfully - the messages themselves have been archived, but not all attachments were archived successfully by STP.Documents. The system will attempt up to 10 times to archive all items. The user can try to restart the process by opening the message again. If the status remains unchanged, the user should contact an administrator.

Completed

The process of archiving messages, attachments and validation report is completed successfully.

Failed

The process has failed for any reason. The user can try to restart the process by opening the message again. If the status remains unchanged, the user should contact an administrator.