Custom StUF integration development

StUF (Standaard Uitwisselings Formaat) is the messaging standard maintained by VNG Realisatie (formerly KING) for exchanging data within the municipal application landscape. A StUF integration exchanges XML messages via SOAP, usually on top of Digikoppeling. The standard has sector models: StUF-ZKN for case and document services, and StUF-BG for core registry data such as persons and addresses. An integration can be simple (a request/response query) or complex (asynchronous notifications with subscriptions between multiple core applications).

StUF is a mature, widely used but now legacy standard. Its successor is the ZGW APIs (REST/JSON) within VNG's Common Ground movement. In practice both often run side by side: many core applications and national facilities still speak StUF, while new components use ZGW. Appfront builds both StUF and ZGW integrations and can migrate a StUF landscape to ZGW/Common Ground step by step, for example via a case bridge that translates StUF-ZKN into the ZGW APIs.

StUF-ZKN (Case and Document Services) handles the exchange of cases, statuses, decisions and documents between, for example, a case management system and task-specific applications. StUF-BG (Basic Data) handles querying and synchronising core data such as persons, addresses and businesses, often from a BRP facility or a data warehouse. Both build on the same StUF message structure (version 03.01) and transport layer, but cover different functional domains. Which one you need depends on the applications and processes you want to connect.

StUF messages are XML and are exchanged via SOAP, typically over the Digikoppeling WUS profile (and ebMS for certain notification traffic), with PKIoverheid certificates for authentication and security. We work with StUF message types such as Lv01/La01 (request/response), Lk01 (notification/mutation), Bv03 (acknowledgement) and the free-form messages Di01/Du01. On our side, we build the adapter in the stack that suits you, whether Java/.NET, Node.js or Python, including XML validation against the schemas, logging and monitoring.

The cost is determined by which sector model (StUF-ZKN, StUF-BG or both) and which message types you need, the number of applications to connect, whether it involves queries only or also mutations and subscriptions, and the requirements around Digikoppeling, PKIoverheid and the supplier's test environment. A possible migration path to ZGW also factors in. We always provide a clear quote following a no-obligation analysis of your application landscape.

Yes. StUF traffic involving core and case data contains personal data and falls under the GDPR. Transport runs over Digikoppeling with PKIoverheid certificates and encryption, with authorisation at message level so that a recipient only receives the data they are entitled to. Appfront builds according to OWASP ASVS and the government security frameworks (BIO), with separation of duties, full logging and a data minimisation approach. We document the data flows so that your record of processing activities stays complete and you can demonstrably comply with the GDPR.

Yes. Appfront regularly takes over existing StUF integrations, even when they were originally set up by another supplier. We review the message definitions, mappings, error handling and Digikoppeling configuration, document the current setup and propose improvements. From that point on, we handle adjustments, extensions and monitoring, and where desired we can migrate the integration to the ZGW APIs in phases.

StUF is the standard within the Dutch municipal domain. A StUF integration is therefore suited to municipalities, municipal collaborative partnerships, environmental services and implementing organisations that need to connect core applications such as a case management system, a BRP facility, a tax application or a middle office/broker, or to connect to national facilities. We also help software vendors who want to make their application StUF-compliant or expose it via ZGW.