Fingerprints: what the stack gives away

The stack signs its own work. A login that bounces through a national identity provider, forms served from a named product, case APIs answering on standardised paths: each layer leaves marks that read from certificate logs, DNS and the pages as served, before a packet reaches the target.

Identity

A login that leaves for DigiD is SAML, service-provider-initiated, and returns by artifact binding. The browser is redirected to the DigiD provider carrying an AuthnRequest whose AssertionConsumerService URL is the supplier front-end’s own return endpoint, so the request names the supplier handling the session. The back channel runs on PKIoverheid certificates over mutual TLS. eHerkenning takes the same shape toward a broker (makelaar) rather than a single provider. Between the redirect target and the ACS host, one login flow places both the identity integration and the front-end behind it.

Common Ground

Case interfaces answer on standardised component paths: /catalogi/api/v1/ for the catalogue, /zaken/api/v1/ for cases, /documenten/api/v1/ for documents, /besluiten/api/v1/ for decisions, with Autorisaties and Notificaties alongside. Each publishes its own description at /<component>/api/v1/schema/openapi.yaml, and the components are frequently split across their own subdomains.

Open Zaak is the reference implementation behind many deployments, so a host that matches its routes and admin reads as Open Zaak until something says otherwise. Older estates answer instead on StUF SOAP koppelvlakken, and the two often sit side by side through a migration.

Forms and portals

The citizen-facing edge is the most legible part of the stack, built to be visited:

  • Open Formulieren embeds through a front-end SDK, so a page carrying a <div id="openforms-root" data-base-url="…/api/v1/" data-form-id="…"> is Open Forms, its backend API at /api/v1/ and form.io underneath.

  • Seneca runs the Smartsite CMS with a separate Formulierenserver, and Smartsite’s markers in the served page identify it.

  • SIMgroep’s SIMsite is a Drupal build, paired with SIMform for forms and SIMloket for the product catalogue, so Drupal tells and the SIM paths point to it together.

  • Exxellence, trading now as xxllnc, ships the Exxellence Suite: eCreator forms, the customer-contact system, and the PIP (Persoonlijke Internet Pagina) portal, which municipal sites often expose behind a /persoonlijke-internet-pagina route.

Geo

Object and map data surfaces as OGC services, WMS and WFS endpoints and BAG/BGT viewers, frequently proxied to or mirrored from PDOK, with Vicrea tooling behind much of it.

Core

The registrations from Centric and PinkRoccade rarely answer from the internet directly. They appear second-hand: as the SaaS domain a portal calls, or as the supplier named in a DigiD ACS URL, never quite as a front door of their own.