# 401 Unthorized Error When requesting Production CSID

**URL:** <https://zatca1.discourse.group/t/401-unthorized-error-when-requesting-production-csid/10234>\
**Category:** FATOORA portal and Simulation portal\
**Created:** [May 17, 2026, 1:50pm UTC](https://zatca1.discourse.group/t/401-unthorized-error-when-requesting-production-csid/10234 "2026-05-17T13:50:10Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Muhammad-Wasi](https://avatars.discourse-cdn.com/v4/letter/m/bbce88/32.png) [@Muhammad-Wasi](https://zatca1.discourse.group/u/Muhammad-Wasi)\
**Post date:** [May 17, 2026, 1:50pm UTC](https://zatca1.discourse.group/t/401-unthorized-error-when-requesting-production-csid/10234/1 "2026-05-17T13:50:10Z")

</div>

Dear ZATCA Fatoora Team,

HTTP 401 on `POST /e-invoicing/core/production/csids` after all 6 compliance checks PASS on core (production portal OTP)

**Environment:** Production (`/e-invoicing/core`)

**Problem**

We cannot obtain a **Production CSID** for our EGS device. Fatoora returns:

- **HTTP 401** — `Unauthorized`

- **errorMessage:** `"You are not authorized to use this api endpoint"`

- **Endpoint:** `POST https://gw-fatoora.zatca.gov.sa/e-invoicing/core/production/csids`

At the same time, the **same compliance CSID + secret** successfully passes all mandatory compliance invoice checks on core.

**What works**

| **Step** | **Endpoint** | **Result** |
| --- | --- | --- |
| Compliance CSID (OTP from **production** Fatoora portal) | `POST /e-invoicing/core/compliance` | Success — compliance CSID + secret + `requestID` received |
| Compliance invoice checks (all 6 categories) | `POST /e-invoicing/core/compliance/invoices` | **PASS** for all required types (standard/simplified + credit/debit notes) |

**Compliance categories cleared (all accepted by ZATCA on core):**

- `standard-compliant`

- `standard-credit-note-compliant`

- `standard-debit-note-compliant`

- `simplified-compliant`

- `simplified-credit-note-compliant`

- `simplified-debit-note-compliant`

**What fails**

| **Step** | **Endpoint** | **Result** |
| --- | --- | --- |
| Production CSID exchange | `POST /e-invoicing/core/production/csids` | **HTTP 401** — not authorized for this API endpoint |

**Device / taxpayer details**

- **VAT (TIN):** `314380355800003`

- **EGS serial (CSR SAN):** `1-MARSAL|2-v1.0|3-RYD-POS-01`

- **CSR MS template:** `ZATCA-Code-Signing` (production)

- **CSR invoice type code:** `1100` (both standard + simplified)

- **Compliance request ID:** `1779022180283`

- **Compliance cert issuer (decoded from binarySecurityToken):** `CN=eInvoicing`

- **OTP source:** Production Fatoora portal (`https://fatoora.zatca.gov.sa`) — not simulation

**How we call production CSID**

We follow the onboarding flow: Basic auth with **compliance** `binarySecurityToken` + `secret`, header `Accept-Version: V2`, and `compliance_request_id` set to the compliance CSID `requestID`. Body is `{}` (we also tried body-only `{ "compliance_request_id": "<id>" }` per samples). **CSR is not sent** to `/production/csids`.

Auth mode tried: `Basic base64(binarySecurityToken:secret)` and PHP-style double-base64 on the token — same 401.

**Why we believe this is not a simulation/production mix-up**

1. `ZATCA_ENV=production` — all API calls go to `/e-invoicing/core` (not `/simulation`).

2. CSR uses **`ZATCA-Code-Signing`** , not `PREZATCA-Code-Signing`.

3. OTP was generated on the **production** Fatoora portal.

4. All six `/compliance/invoices` submissions were **accepted on core** with this same compliance CSID.

5. We understand **`CN=eInvoicing`** is the typical issuer on **compliance** CSIDs and does not by itself indicate simulation.

**Question for ZATCA / community**

1. What causes **401 “not authorized to use this api endpoint”** on `/core/production/csids` when `/core/compliance/invoices` already accepted all six compliance categories for the same `requestID`?

2. Is there a **portal prerequisite** (device activation, taxpayer onboarding, solution-provider registration) that must be completed before the production CSID API is enabled?

3. Should we open a **support ticket** with ZATCA for this TIN/device, and if so, what information do you need beyond the details above?

4. The compliance passes but production CSID fails with 401.

Any guidance or similar experiences would be appreciated.