I successfully onboarded in to Simulation - but the solution is not getting listed in the simulation portal

Onboarding, renewal and revocation
1

I got success response to https://gw-fatoora.zatca.gov.sa/e-invoicing/simulation/compliance

{
“requestID”: …,
“dispositionMessage”: “ISSUED”,
“binarySecurityToken”: …

also i got success response to clearance APIs for all three types (standard invoice, credit note and debit note)
https://gw-fatoora.zatca.gov.sa/e-invoicing/simulation/compliance/invoices

{
“validationResults”: {
“infoMessages”: [
{
“type”: “INFO”,
“code”: “XSD_ZATCA_VALID”,
“category”: “XSD validation”,
“message”: “Complied with UBL 2.1 standards in line with ZATCA specifications”,
“status”: “PASS”
}
],
“warningMessages”: ,
“errorMessages”: ,
“status”: “PASS”
},
“reportingStatus”: null,
“clearanceStatus”: “CLEARED”,
“qrSellertStatus”: null,
“qrBuyertStatus”: null
}

still the fatoora simulation portal is not showing in the “View List of Solutions and Devices”

3

Dear @Mausoof,

To fully onboard your device/solution (EGS), there is one missing step from your end which is requesting the production CSID.

After the completion of the compliance checks by sending all of the required document types to:

https://gw-fatoora.zatca.gov.sa/e-invoicing/simulation/compliance/invoices

You should request a PCSID through:

https://gw-fatoora.zatca.gov.sa/e-invoicing/simulation/production/csids

Ensure that the structure of the request includes the following:

Authorization (basic auth):

 * Username: The username should be the "BinarySecurityToken" issued earlier from the previous step

 * Password: The password should be the "secret" issued earlier from the previous step

Headers:

* Accept-Version: Accept version header should has the value of "V2"

Body:

* "compliance_request_id": which is the “requestID” that has been issued earlier from the previous step.

After completing this request ensuring the above, you will receive the PCSID in terms of BinarySecurityToken & Secret, which will be used in the authorization of the clearance & reporting APIs and the onboarded EGS will appear.

4

Thanks - it works.
https://gw-fatoora.zatca.gov.sa/e-invoicing/simulation/production/csids - worked

Now it is listing in fatoora simulation portal

https://gw-fatoora.zatca.gov.sa/e-invoicing/simulation/invoices/clearance/single also works

5

@Aturkistani

Thanks for your response. We are in final stage of deployment of our zatca integrated solution.
We successfully onboarded with our company’s fatoora account and tested clearance API after receiving Prod CSID in simulation env

We are “Inventory/billing” solution provider. As a solution provider, below is our understanding

  • our software needs to facilitate the generation of separate Production CSID for each client based on the CSR generated with the taxpayer’s details.

  • For each new Client who uses our software for trading business, We have to make sure that whole workflow of Compliance CSID generation, compliance submissions, till Prod CSID generation should be done via our solution interface and the client just needs to enter OTP during this onboarding process (which they generate via their own fatoora login)

  • We have to keep the csrcertificate and private key for each client to later do invoice signing of their respective invoices

  • we have to keep each clients binarySecurityToken & secret so as to do the clearance of their respective invoices

kindly confirm if this understanding is right.

6

Dear @Mausoof,

Please read the below comments, otherwise your understanding is correct.

1- PCSID should be maintained as per each onboarded device, so one client may has multiple PCSIDs

2- the certificate which is used to sign the e-invoices (x.509 certificate) is the decoded (base64) BinarySecurityToken

3- Private key should be stored securely even if the client doesn’t require to sign the e-invoices i.e.(if the client only needs to send B2B invoices), because the private key is linked to the certificate, and if the private key has been lost/leaked for any reason, a new certificate should be obtained for that specific client.

Regards,

1 Like
7

Thanks for confirming @Aturkistani
We are B2B solution provider. So one PCSID per client should be fine.