Registration and permissions in eVAT: who sets up what in a company and in an accounting firm?
Who can create a technical user, what the three eVAT permissions allow, and why each client needs its own technical user. Illustrated, from NAV sources.
eVAT M2M does not require a separate registration application. Access is configured through a technical user, its signing and exchange keys, and permissions granted in two systems. Only the taxpayer’s primary user can create the technical user.
Access setup also requires clear internal responsibilities: who may create a technical user, who safeguards the keys, and who approves submission of the return. Drawing on NAV’s permission rules, this article sets out a workable division of duties for companies and accounting firms.
eVAT access in numbers
- 3 user types: primary, secondary and technical
- 2 interfaces and permission levels: NAV User Manager and eVAT
- 3 eVAT permissions: management, approval, queries
Source: NAV eVAT user manual and eVAT M2M 2.0 specification
Three kinds of user, three roles
Every eVAT user is linked to a taxpayer. The primary user acts on the taxpayer’s behalf with full authority. A secondary user can perform only the tasks for which access has been granted. The technical user authenticates the filing software to NAV.
The three kinds of eVAT user
All three belong to the same taxpayer, but each can do different things — and not all of them can submit the return.
Primary user
The taxpayer, its legal representative or permanent representative · via KAÜ (government ID)
Can:
- Uses every eVAT function, including submitting the return
- Creates secondary and technical users
- Assigns permissions on both interfaces
- Can act for several taxpayers and switch between them without logging out
Cannot:
- Cannot communicate machine-to-machine: M2M traffic only works through a technical user
Secondary user
A person registered by the primary user · with two-factor login
Can:
- Views the summary, the document list and the draft return
- With editor rights, edits the document list, closes the period and prepares the draft return
- With editor rights, starts pre-validation and self-revision
Cannot:
- Cannot submit the return
- Can only view users; cannot assign permissions
Technical user
The filing software’s identity · login, password, signing and exchange key
Can:
- Uploads, queries and — with approval rights — submits, as permitted
- Always communicates on behalf of the taxpayer it belongs to
- Any number can be created per taxpayer
Cannot:
- Cannot log in to the web interface
- Cannot submit another taxpayer’s return
- Cannot be split into per-person permissions towards NAV
Summary based on NAV’s eVAT user manual (sections 3.1–3.4) and the eVAT M2M specification. Source: NAV: eVAT user manual (in Hungarian)
A primary user can be an individual taxpayer, the legal representative of a taxable person, or its permanent representative. According to NAV, a permanent representative needs an authorisation covering tax matters, or matters related to VAT and other indirect taxes. This is how a company’s finance manager, chief accountant or an accounting firm’s employee can become a primary user.
Setting up M2M access: two systems, two permission levels
M2M access is configured in two stages. In the NAV User Manager, the primary user creates the technical user, generates its keys and grants access to eVAT. On the eVAT web interface, the primary user then assigns the permissions required for specific operations.
The path to machine access: two interfaces, two permission levels
Click the steps, or page through with Previous and Next. The taxpayer’s primary user performs the first five steps; the last two happen in the filing software.
- NAV User Manager: Log in and select the taxpayer — With KAÜ; if you represent several taxpayers, select the right one.
- NAV User Manager: Create the technical user — The system generates the 15-character login name; the primary user sets the password.
- NAV User Manager: Generate the signing and exchange keys — The signing key signs requests; the exchange key encodes the data-exchange token.
- NAV User Manager: “Access to the eVAT system interface” — This lets the technical user reach eVAT at all. (Permission level 1)
- eVAT web interface: Assign the eVAT permissions — Applications → eVAT → Users: return management, return approval, convenience services and queries. (Permission level 2)
- Filing software: Store the access data — Login name, password, signing and exchange key, and the tax number — stored securely.
- Filing software: Test connection in the test environment — The test environment needs its own technical user and its own keys.
Our registration guide describes each step in detail. Source: eVAT M2M 2.0 interface specification, section 4.2
A technical user can have access in the NAV User Manager and still receive a FORBIDDEN response. NAV’s developer forum identifies a common cause: the operation-specific permissions have not yet been assigned under Users on the eVAT web interface.
What do the three eVAT permissions allow?
Three permissions can be assigned to the technical user on the eVAT web interface. For every machine operation, the specification states which one is required:
| Permission | What it allows | If it is missing |
|---|---|---|
| Return management | Uploading and finalising the return, and managing attachments | The software cannot upload the return data |
| Return approval | Submitting the validated return through the M2M connection | The software cannot submit the return |
| Convenience services, queries | Querying processing status, earlier returns, documents held by NAV, the tax-code catalogue and invoice tax codes | Submission may work, but the software cannot see the status or NAV’s data |
The right to submit the return is not tied to a person
NAV assigns permissions to the technical user, not to people. If the technical user has the return approval permission, the software in which it is set up can also submit the return to NAV. NAV does not check which employee triggered the submission in the software.
Suggested division of roles in a company
The law does not prescribe who performs each step; NAV only states that technical users and permissions are assigned by a primary user. The split below is a starting point to adapt to your own organisation:
| Task | Typically done by |
|---|---|
| Logging in as primary user | The company’s legal representative, or a finance manager or chief accountant registered as permanent representative |
| Technical user, keys, permission level 1 | The primary user — according to NAV, only they can |
| Assigning the eVAT permissions (level 2) | The primary user |
| Storing the access data in the software | The primary user, or a user designated for this in the software |
| Working with documents on the web interface | Secondary users: accounting, finance |
| Deciding on submission | Finance manager or chief accountant — as the approver designated in the software |
| Regular review of permissions | Finance manager or chief accountant, for example yearly and when staff leave |
In an accounting firm: every client needs its own technical user
Accounting firms often assume that a single technical user of their own can submit every client’s return. That is not how eVAT works. A technical user belongs to one taxpayer, and according to NAV’s developers machine communication never happens on the accountant’s behalf, but always on the taxpayer’s. If the uploading technical user’s tax number differs from the taxpayer’s in the return, the system rejects the upload.
An accounting firm and its clients: every connection on the client’s behalf
The firm’s filing software — Stores each client’s access data separately.
each client with its own technical user
- Client A Ltd. — Client A’s technical user and keys; requests carry Client A’s tax number.
- Client B plc — Client B’s own technical user, with its own permissions.
- Client C LP — Client C’s own technical user; the firm’s own user cannot replace it.
NAV eVAT M2M — Accepts a client’s return only from that client’s technical user.
According to NAV’s developers, machine communication never happens on the accountant’s behalf, but always on the taxpayer’s. Source: NAV developers’ answer, nav-gov-hu/eVAT #242
The firm can get access to the client’s technical user in two ways:
| Option | How it works | What to watch |
|---|---|---|
| The client creates it | The client’s primary user creates the technical user, assigns the permissions and hands the access data over to the firm | A secure handover channel; the client can revoke access at any time |
| The firm as permanent representative | If the client has registered a firm employee with a suitable permanent authorisation, the employee can do the setup as primary user | The technical user still belongs to the client and communicates on its behalf |
An employee acting as permanent representative can switch between represented taxpayers in the NAV User Manager without logging out, which speeds up setup considerably for many clients. For web work, firm employees can also get secondary-user access, but with it they cannot submit the return.
What does this mean for you?
For companies
In a company, setup is a one-off task, but responsibility is ongoing. Clarify these in advance:
Who is the primary user? If the finance manager or chief accountant is to set up access, the company has to register them as a permanent representative.
How many technical users? NAV does not limit their number. Separate technical users are advisable for eVAT and the Online Invoice connection, and for the test and live environments.
Where are the keys? Whoever holds the password and keys can act on the company’s behalf within the technical user’s permissions, so encrypted storage and access logging are essential.
Who submits the return? NAV ties the right to submit to the technical user, not to a person, so the approval process has to be defined with the software’s roles.
The filing software should separate preparation from approval through distinct roles and maintain an audit trail of every relevant action.
For accounting firms
In an accounting firm, setup has to be done client by client. A consistent approach helps:
An own technical user per client: the firm’s own technical user cannot be used for clients’ returns.
A consistent handover process: decide who creates the technical user (the client, or the firm as permanent representative) and how the access data gets into the software securely.
A register: track per client which technical user works with which permissions, and when it was last reviewed.
Staff web access: a secondary user can work with documents but cannot submit.
Technical users, keys and permissions should be isolated by client and governed by a documented handover and revocation process.
Test and live: two separate systems
NAV keeps the test environment completely separate from the live system. According to the specification, requirements apply per environment: technical users and keys created in the test environment cannot be used in live, and vice versa.
| Environment | User Manager | eVAT web interface |
|---|---|---|
| Test | uam-test.nav.gov.hu | eafa-test.nav.gov.hu |
| Live | uam.nav.gov.hu | eafa.nav.gov.hu |
According to NAV’s developers, a common mistake is trying to submit to the test system with the live user, or to live with the test user. For test-environment access problems, NAV provides support at eafa_m2m@nav.gov.hu.
Web XML upload: the system-created technical user
If the return is submitted on the web interface by XML upload, eVAT creates a special technical user. This happens on the primary user’s first XML upload: since only a primary user can create technical users, XML upload does not work for a secondary user until the primary user has started one. The special technical user is needed even if the taxpayer already has a technical user created for another purpose — for example for the Online Invoice connection.
The special technical user’s permissions cannot be changed in the eVAT Users menu.
It can only be deleted in the NAV User Manager, but it has to be created again on the next XML upload.
The machine connection needs a separate technical user created and authorised by the primary user.
Typical errors and their causes
| Message | What it means | Typical cause |
|---|---|---|
| FORBIDDEN | The technical user is not permitted to call the operation | Only level 1 is set, or the relevant eVAT permission is missing |
| INVALID_SECURITY_USER | The login name and password hash do not match | Wrong password, or the software computes the password hash incorrectly |
| INVALID_USER_RELATION | The technical user does not belong to the given tax number | A request sent with another taxpayer’s tax number, or an inactive user |
| FILING_ROLE_FORBIDDEN | The technical user may not act in this return | The permission does not match the operation; check the environment (test or live) and the user too |
| CONFLICTING_TAX_NUMBERS | The uploader and the taxpayer in the return differ | A return uploaded with another taxpayer’s technical user |
Explanations and fixes for eVAT validation messages can be searched in our error database. FILING_ROLE_FORBIDDEN · CONFLICTING_TAX_NUMBERS
Practical cases: who sets it up, and why doesn’t it work?
Who sets it up, and why doesn’t it work?
Six situations that come up again and again during setup and the first submissions. The explanations are based on NAV’s documentation and public answers from NAV’s developers.
- The technical user has “Access to the eVAT system interface” ticked in the NAV User Manager, yet the software gets a FORBIDDEN response. What is missing?
- Correct: The permissions must also be assigned on the eVAT web interface — Correct. The right granted in the User Manager is only level 1. For operations, the return management, approval and query permissions must also be assigned on the eVAT web interface, under Users.
- A new key pair must be generated — No. A wrong key or password produces an authentication error (such as INVALID_SECURITY_USER), not FORBIDDEN.
- Wait a few days for activation — No. In such cases NAV’s developers pointed to the second permission level, not to waiting.
- An accounting firm wants to submit all its clients’ returns with the technical user created for its own company. Does that work?
- Correct: No: each client needs the client’s own technical user — Correct. According to NAV’s developers, machine communication always happens on the taxpayer’s behalf, so the company’s own technical user is required — just as for invoicing software.
- Yes, if the firm is a permanent representative — No. Representation entitles the firm to act on the web interface and to do the setup, but the machine connection needs the client’s technical user.
- Yes, if the technical user gets every permission — No. A technical user belongs to one taxpayer and can only act on its behalf. The system rejects uploads of another taxpayer’s return.
- A firm employee, as a secondary user, has prepared the client’s draft return on the eVAT web interface. Can they submit it?
- Yes, with editor rights — No. Editor rights cover editing the document list, closing the period and preparing the draft, not submission.
- Yes, after two-factor login — No. Two-factor authentication is how they log in; it does not change their permissions.
- Correct: No: submission is for the primary user or a technical user with approval rights — Correct. According to the manual, a secondary user can view and edit data within their rights, but cannot submit the return.
- The software uploads the return and has it validated successfully, but gets a permission error on submission. What is the likely cause?
- The convenience services and queries permission is missing — No. That is needed for queries (such as processing status or the tax-code catalogue), not for submission.
- Correct: The return approval permission is missing — Correct. Submission (ManageDeclarationSubmission) requires a separate permission. Without it the software can upload the return and have it validated, but cannot submit it.
- The technical user’s password has expired — No. With failed authentication the upload would not have worked either.
- A developer tries to submit to the live system with a technical user and keys created in the test environment. What happens?
- Correct: It fails: live needs its own technical user and its own keys — Correct. According to the specification, technical users and keys created in the test environment cannot be used in live. NAV’s developers note that mixing up test and live users is a common mistake.
- It works, because they belong to the same taxpayer — No. Requirements apply per environment: test and live are independent of each other.
- Queries work, submissions don’t — No. A test-environment user cannot be used for any operation in the live system.
- In a company, the accountant may upload the return, but it may only be submitted after the finance manager’s decision. Where can this separation be set up?
- In the NAV User Manager, per person — No. Towards NAV, a technical user’s permissions cannot be split by person.
- Correct: With the filing software’s own roles — Correct. NAV ties the permission to the technical user, not to a person; according to the specification, if several users need different permissions, this has to be implemented in the business software’s user management.
- With two technical users, only one of which gets approval rights — Partly true, but not enough: a technical user does not belong to a person, so who may trigger submission is decided by the software’s roles.
How SimplyX supports this
Because NAV assigns submission rights to the technical user, individual responsibilities must be enforced in the filing software. SimplyX separates preparation and approval through role-based access — for example administrator, accountant and viewer roles — while the audit log records who performed each action and when. Accounting firms and groups can manage several companies in one system with data and permissions separated by company. How SimplyX eVAT M2M works
Related resources
eVAT M2M registration — the setup steps, based on NAV’s sources
eVAT validation messages — every message with its conditions
Standard tax-code catalogue — a searchable database of all NAV standard tax codes
Next step
With access and permissions set up, the next step is a test return. Part 6 of the series shows how to prepare a test return on a closed period, without live risk. Tax-code mapping is covered in part 4.
Sources
NAV: eVAT M2M 2.0 interface specification, v1.1 (July 2026, in Hungarian)
NAV: eVAT user manual (in Hungarian)
NAV: New login interface — NAV User Manager (in Hungarian)
NAV: Preparing to use eVAT (in Hungarian)
NAV: Using the Online Invoice system — primary user, permanent representative (in Hungarian)
NAV developers: an accounting firm’s technical user (#242)
NAV developers: technical user permissions (#220)
NAV developers: FORBIDDEN and the eVAT permissions (issue #339)