401 Unthorized Error When requesting Production CSID

FATOORA portal and Simulation portal
1

Dear ZATCA Fatoora Team,

HTTP 401 on POST /e-invoicing/core/production/csids after all 6 compliance checks PASS on core (production portal OTP)

Environment: Production (/e-invoicing/core)

Problem

We cannot obtain a Production CSID for our EGS device. Fatoora returns:

  • HTTP 401 — Unauthorized

  • errorMessage: "You are not authorized to use this api endpoint"

  • Endpoint: POST https://gw-fatoora.zatca.gov.sa/e-invoicing/core/production/csids

At the same time, the same compliance CSID + secret successfully passes all mandatory compliance invoice checks on core.

What works

Step Endpoint Result
Compliance CSID (OTP from production Fatoora portal) POST /e-invoicing/core/compliance Success — compliance CSID + secret + requestID received
Compliance invoice checks (all 6 categories) POST /e-invoicing/core/compliance/invoices PASS for all required types (standard/simplified + credit/debit notes)

Compliance categories cleared (all accepted by ZATCA on core):

  • standard-compliant

  • standard-credit-note-compliant

  • standard-debit-note-compliant

  • simplified-compliant

  • simplified-credit-note-compliant

  • simplified-debit-note-compliant

What fails

Step Endpoint Result
Production CSID exchange POST /e-invoicing/core/production/csids HTTP 401 — not authorized for this API endpoint

Device / taxpayer details

  • VAT (TIN): 314380355800003

  • EGS serial (CSR SAN): 1-MARSAL|2-v1.0|3-RYD-POS-01

  • CSR MS template: ZATCA-Code-Signing (production)

  • CSR invoice type code: 1100 (both standard + simplified)

  • Compliance request ID: 1779022180283

  • Compliance cert issuer (decoded from binarySecurityToken): CN=eInvoicing

  • OTP source: Production Fatoora portal (https://fatoora.zatca.gov.sa) — not simulation

How we call production CSID

We follow the onboarding flow: Basic auth with compliance binarySecurityToken + secret, header Accept-Version: V2, and compliance_request_id set to the compliance CSID requestID. Body is {} (we also tried body-only { "compliance_request_id": "<id>" } per samples). CSR is not sent to /production/csids.

Auth mode tried: Basic base64(binarySecurityToken:secret) and PHP-style double-base64 on the token — same 401.

Why we believe this is not a simulation/production mix-up

  1. ZATCA_ENV=production — all API calls go to /e-invoicing/core (not /simulation).

  2. CSR uses ZATCA-Code-Signing, not PREZATCA-Code-Signing.

  3. OTP was generated on the production Fatoora portal.

  4. All six /compliance/invoices submissions were accepted on core with this same compliance CSID.

  5. We understand CN=eInvoicing is the typical issuer on compliance CSIDs and does not by itself indicate simulation.

Question for ZATCA / community

  1. What causes 401 “not authorized to use this api endpoint” on /core/production/csids when /core/compliance/invoices already accepted all six compliance categories for the same requestID?

  2. Is there a portal prerequisite (device activation, taxpayer onboarding, solution-provider registration) that must be completed before the production CSID API is enabled?

  3. Should we open a support ticket with ZATCA for this TIN/device, and if so, what information do you need beyond the details above?

  4. The compliance passes but production CSID fails with 401.

Any guidance or similar experiences would be appreciated.