diff --git a/app/service/send_notification.py b/app/service/send_notification.py
index 0c8740868..469cf473b 100644
--- a/app/service/send_notification.py
+++ b/app/service/send_notification.py
@@ -23,6 +23,7 @@ from app.models import (
     SMS_TYPE,
     EMAIL_TYPE,
     LETTER_TYPE,
+    POSTAGE_TYPES,
     NOTIFICATION_DELIVERED,
     UPLOAD_LETTERS,
 )
@@ -148,6 +149,11 @@ def send_pdf_letter_notification(service_id, post_data):
         allow_whitelisted_recipients=False,
     )
 
+    postage = post_data.get('postage')
+    if postage not in POSTAGE_TYPES:
+        message = "postage must be set as 'first' or 'second'"
+        raise BadRequestError(message=message)
+
     template = get_precompiled_letter_template(service.id)
     file_location = 'service-{}/{}.pdf'.format(service.id, post_data['file_id'])
 
@@ -167,7 +173,6 @@ def send_pdf_letter_notification(service_id, post_data):
         'address_line_1': post_data['filename']
     }
 
-    # TODO: stop hard-coding postage as 'second' once we get postage from the admin
     notification = persist_notification(
         notification_id=post_data['file_id'],
         template_id=template.id,
@@ -183,7 +188,7 @@ def send_pdf_letter_notification(service_id, post_data):
         client_reference=post_data['filename'],
         created_by_id=post_data['created_by'],
         billable_units=billable_units,
-        postage='second',
+        postage=postage,
     )
 
     upload_filename = get_letter_pdf_filename(
diff --git a/tests/app/service/test_rest.py b/tests/app/service/test_rest.py
index b4dbcb068..080d989d0 100644
--- a/tests/app/service/test_rest.py
+++ b/tests/app/service/test_rest.py
@@ -2282,7 +2282,8 @@ def test_create_pdf_letter(mocker, sample_service_full_permissions, client, fake
     data = json.dumps({
         'filename': 'valid.pdf',
         'created_by': str(user.id),
-        'file_id': fake_uuid
+        'file_id': fake_uuid,
+        'postage': 'second'
     })
 
     response = client.post(
diff --git a/tests/app/service/test_send_pdf_letter_notification.py b/tests/app/service/test_send_pdf_letter_notification.py
index e0a45517a..e1fe8ef94 100644
--- a/tests/app/service/test_send_pdf_letter_notification.py
+++ b/tests/app/service/test_send_pdf_letter_notification.py
@@ -22,7 +22,7 @@ def test_send_pdf_letter_notification_raises_error_if_service_does_not_have_perm
     permissions,
 ):
     service = create_service(service_permissions=permissions)
-    post_data = {'filename': 'valid.pdf', 'created_by': fake_uuid, 'file_id': fake_uuid}
+    post_data = {'filename': 'valid.pdf', 'created_by': fake_uuid, 'file_id': fake_uuid, 'postage': 'first'}
 
     with pytest.raises(BadRequestError):
         send_pdf_letter_notification(service.id, post_data)
@@ -36,7 +36,7 @@ def test_send_pdf_letter_notification_raises_error_if_service_is_over_daily_mess
     mocker.patch(
         'app.service.send_notification.check_service_over_daily_message_limit',
         side_effect=TooManyRequestsError(10))
-    post_data = {'filename': 'valid.pdf', 'created_by': fake_uuid, 'file_id': fake_uuid}
+    post_data = {'filename': 'valid.pdf', 'created_by': fake_uuid, 'file_id': fake_uuid, 'postage': 'first'}
 
     with pytest.raises(TooManyRequestsError):
         send_pdf_letter_notification(sample_service_full_permissions.id, post_data)
@@ -45,7 +45,27 @@ def test_send_pdf_letter_notification_raises_error_if_service_is_over_daily_mess
 def test_send_pdf_letter_notification_validates_created_by(
     sample_service_full_permissions, fake_uuid, sample_user
 ):
-    post_data = {'filename': 'valid.pdf', 'created_by': sample_user.id, 'file_id': fake_uuid}
+    post_data = {'filename': 'valid.pdf', 'created_by': sample_user.id, 'file_id': fake_uuid, 'postage': 'first'}
+
+    with pytest.raises(BadRequestError):
+        send_pdf_letter_notification(sample_service_full_permissions.id, post_data)
+
+
+def test_send_pdf_letter_notification_validates_postage(
+    sample_service_full_permissions, fake_uuid, notify_user
+):
+    user = sample_service_full_permissions.users[0]
+    post_data = {'filename': 'valid.pdf', 'created_by': user.id, 'file_id': fake_uuid, 'postage': 'third'}
+
+    with pytest.raises(BadRequestError):
+        send_pdf_letter_notification(sample_service_full_permissions.id, post_data)
+
+
+def test_send_pdf_letter_notification_requires_postage(
+    sample_service_full_permissions, fake_uuid, notify_user
+):
+    user = sample_service_full_permissions.users[0]
+    post_data = {'filename': 'valid.pdf', 'created_by': user.id, 'file_id': fake_uuid}
 
     with pytest.raises(BadRequestError):
         send_pdf_letter_notification(sample_service_full_permissions.id, post_data)
@@ -72,7 +92,7 @@ def test_send_pdf_letter_notification_raises_error_when_pdf_is_not_in_transient_
     notify_user,
 ):
     user = sample_service_full_permissions.users[0]
-    post_data = {'filename': 'valid.pdf', 'created_by': user.id, 'file_id': fake_uuid}
+    post_data = {'filename': 'valid.pdf', 'created_by': user.id, 'file_id': fake_uuid, 'postage': 'first'}
     mocker.patch('app.service.send_notification.utils_s3download', side_effect=S3ObjectNotFound({}, ''))
 
     with pytest.raises(S3ObjectNotFound):
@@ -88,7 +108,7 @@ def test_send_pdf_letter_notification_creates_notification_and_moves_letter(
     user = sample_service_full_permissions.users[0]
     filename = 'valid.pdf'
     file_id = uuid.uuid4()
-    post_data = {'filename': filename, 'created_by': user.id, 'file_id': file_id}
+    post_data = {'filename': filename, 'created_by': user.id, 'file_id': file_id, 'postage': 'second'}
 
     mocker.patch('app.service.send_notification.utils_s3download')
     mocker.patch('app.service.send_notification.get_page_count', return_value=1)