I am encountering an error while using the reporting API in the ZATCA sandbox environment.
The technology stack I’m using consists of PHP/Laravel.
BASE URL
https://gw-fatoora.zatca.gov.sa/e-invoicing/developer-portal
Everystep is working fine expect reporting api giving me an error.
Everything is functioning properly, except when calling the Reporting API, I receive the following error:
{
+"validationResults":
+"infoMessages": array:1 [▶]
+"warningMessages": []
+"errorMessages": array:1 [▼
0 => {
+"type": "ERROR"
+"code": "signed-properties-hashing"
+"category": "CERTIFICATE_ERRORS"
+"message": "Invalid signed properties hashing, SignedProperties with id='xadesSignedProperties'"
+"status": "ERROR"
}
]
+"status": "ERROR"
}
+"reportingStatus": "NOT_REPORTED"
}
The error appears under the CERTIFICATE_ERRORS category with a message indicating an issue with the “Invalid signed properties hashing” related to the SignedProperties element.
Here are the steps I am following:
- Create an EGS object with the unit’s details.
- Set the environment to non-production (test mode).
- Generate private keys and a CSR for the EGS.
- Request and obtain a compliance certificate using the CSR.
- Sign the invoice in test mode using the compliance certificate.
- Verify the invoice for compliance.
- Generate a production certificate (CSID) once compliance is confirmed.
- Sign the invoice in production mode.
- Report the signed production invoice to the authorities.
Code Explanation:
-
Create EGS Object:
Initialize anEGSobject using the unit details. This object manages Electronic General System (EGS) operations related to invoices.$egs = new EGS($egs_unit); -
Set Test Mode:
The system is switched to non-production by setting the production mode tofalse.$egs->production = false; -
Generate Keys and CSR:
Generate new private keys and a CSR for the EGS. These are needed to securely sign invoices.list($private_key, $csr) = $egs->generateNewKeysAndCSR('solution_name'); -
Request Compliance Certificate:
A compliance certificate is requested using the CSR, and the system returns arequest_id,binary_security_token, andsecretfor further operations.list($request_id, $binary_security_token, $secret) = $egs->issueComplianceCertificate('123345', $csr); -
Sign Invoice (Test Mode):
Sign the invoice in test mode using the private key, unit details, andbinary_security_token. The signed invoice, hash, and QR code are generated.list($signed_invoice_string, $invoice_hash, $qr) = $egs->signInvoice($invoice, $egs_unit, $binary_security_token, $private_key); -
Verify Invoice Compliance:
Check the invoice for compliance using the signed invoice string, hash, compliance certificate, andsecret.$compliance_result = $egs->checkInvoiceCompliance( signed_invoice_string: $signed_invoice_string, invoice_hash: $invoice_hash, certificate: $binary_security_token, secret: $secret ); -
Generate Production CSID:
After confirming compliance, generate a production certificate (CSID) using thebinary_security_token,secret, andrequest_id. This returns production tokens and keys.list($production_request_id, $production_token_type, $production_disposition_message, $production_binary_security_token, $production_secret) = $egs->generateProductionCSID( certificate: $binary_security_token, secret: $secret, compliance_request_id: $request_id ); -
Sign Invoice (Production Mode):
Re-sign the invoice in production mode using the production token and private key. This is required for officially issuing the invoice.list($production_signed_invoice_string, $production_invoice_hash, $production_qr) = $egs->signInvoice($invoice, $egs_unit, $production_binary_security_token, $private_key); -
Report Invoice:
Report the signed production invoice to the authorities using the invoice details and production certificate.$egs->reportSimplifiedInvoice( signed_invoice_string: $production_signed_invoice_string, invoice_hash: $production_invoice_hash, certificate: $production_binary_security_token, secret: $production_secret );
Here is my XML of invoice:
<?xml version="1.0" encoding="UTF-8"?>
<Invoice xmlns="urn:oasis:names:specification:ubl:schema:xsd:Invoice-2" xmlns:cac="urn:oasis:names:specification:ubl:schema:xsd:CommonAggregateComponents-2" xmlns:cbc="urn:oasis:names:specification:ubl:schema:xsd:CommonBasicComponents-2" xmlns:ext="urn:oasis:names:specification:ubl:schema:xsd:CommonExtensionComponents-2">
<ext:UBLExtensions>
<ext:UBLExtension>
<ext:ExtensionURI>urn:oasis:names:specification:ubl:dsig:enveloped:xades</ext:ExtensionURI>
<ext:ExtensionContent>
<sig:UBLDocumentSignatures xmlns:sac="urn:oasis:names:specification:ubl:schema:xsd:SignatureAggregateComponents-2" xmlns:sbc="urn:oasis:names:specification:ubl:schema:xsd:SignatureBasicComponents-2" xmlns:sig="urn:oasis:names:specification:ubl:schema:xsd:CommonSignatureComponents-2">
<sac:SignatureInformation>
<cbc:ID>urn:oasis:names:specification:ubl:signature:1</cbc:ID>
<sbc:ReferencedSignatureID>urn:oasis:names:specification:ubl:signature:Invoice</sbc:ReferencedSignatureID>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="signature">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2006/12/xml-c14n11"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
<ds:Reference Id="invoiceSignedData" URI="">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
<ds:XPath>not(//ancestor-or-self::ext:UBLExtensions)</ds:XPath>
</ds:Transform>
<ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
<ds:XPath>not(//ancestor-or-self::cac:Signature)</ds:XPath>
</ds:Transform>
<ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">
<ds:XPath>not(//ancestor-or-self::cac:AdditionalDocumentReference[cbc:ID='QR'])</ds:XPath>
</ds:Transform>
<ds:Transform Algorithm="http://www.w3.org/2006/12/xml-c14n11"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>tN/EtqU9sI2p92WijIuRQ0a5aTNBsrXha+OEcSX6q8w=</ds:DigestValue>
</ds:Reference>
<ds:Reference Type="http://www.w3.org/2000/09/xmldsig#SignatureProperties" URI="#xadesSignedProperties">
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>MGM2Nzc3Y2Y1MmFkZDJkMjQ3YzI2MTk2M2I5MmI1ZGNjMjkyOTNjMzgzYTI2Njc3YWIyNTIyNmI4YzZiNDY1Mg==</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>MEUCIB4eFTEkehWSeckGAWRpXyYDqsvmB1cdkUt1xRpyHmb4AiEAmt+ji+hUSNWhIUgQhB6v/Ayr4GgoPqPO2sRTRJvSCgE=</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>MIID3jCCA4SgAwIBAgITEQAAOAPF90Ajs/xcXwABAAA4AzAKBggqhkjOPQQDAjBiMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxEzARBgoJkiaJk/IsZAEZFgNnb3YxFzAVBgoJkiaJk/IsZAEZFgdleHRnYXp0MRswGQYDVQQDExJQUlpFSU5WT0lDRVNDQTQtQ0EwHhcNMjQwMTExMDkxOTMwWhcNMjkwMTA5MDkxOTMwWjB1MQswCQYDVQQGEwJTQTEmMCQGA1UEChMdTWF4aW11bSBTcGVlZCBUZWNoIFN1cHBseSBMVEQxFjAUBgNVBAsTDVJpeWFkaCBCcmFuY2gxJjAkBgNVBAMTHVRTVC04ODY0MzExNDUtMzk5OTk5OTk5OTAwMDAzMFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEoWCKa0Sa9FIErTOv0uAkC1VIKXxU9nPpx2vlf4yhMejy8c02XJblDq7tPydo8mq0ahOMmNo8gwni7Xt1KT9UeKOCAgcwggIDMIGtBgNVHREEgaUwgaKkgZ8wgZwxOzA5BgNVBAQMMjEtVFNUfDItVFNUfDMtZWQyMmYxZDgtZTZhMi0xMTE4LTliNTgtZDlhOGYxMWU0NDVmMR8wHQYKCZImiZPyLGQBAQwPMzk5OTk5OTk5OTAwMDAzMQ0wCwYDVQQMDAQxMTAwMREwDwYDVQQaDAhSUlJEMjkyOTEaMBgGA1UEDwwRU3VwcGx5IGFjdGl2aXRpZXMwHQYDVR0OBBYEFEX+YvmmtnYoDf9BGbKo7ocTKYK1MB8GA1UdIwQYMBaAFJvKqqLtmqwskIFzVvpP2PxT+9NnMHsGCCsGAQUFBwEBBG8wbTBrBggrBgEFBQcwAoZfaHR0cDovL2FpYTQuemF0Y2EuZ292LnNhL0NlcnRFbnJvbGwvUFJaRUludm9pY2VTQ0E0LmV4dGdhenQuZ292LmxvY2FsX1BSWkVJTlZPSUNFU0NBNC1DQSgxKS5jcnQwDgYDVR0PAQH/BAQDAgeAMDwGCSsGAQQBgjcVBwQvMC0GJSsGAQQBgjcVCIGGqB2E0PsShu2dJIfO+xnTwFVmh/qlZYXZhD4CAWQCARIwHQYDVR0lBBYwFAYIKwYBBQUHAwMGCCsGAQUFBwMCMCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwMwCgYIKwYBBQUHAwIwCgYIKoZIzj0EAwIDSAAwRQIhALE/ichmnWXCUKUbca3yci8oqwaLvFdHVjQrveI9uqAbAiA9hC4M8jgMBADPSzmd2uiPJA6gKR3LE03U75eqbC/rXA==</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
<ds:Object>
<xades:QualifyingProperties xmlns:xades="http://uri.etsi.org/01903/v1.3.2#" Target="signature">
<xades:SignedProperties xmlns:xades="http://uri.etsi.org/01903/v1.3.2#" Id="xadesSignedProperties">
<xades:SignedSignatureProperties>
<xades:SigningTime>2024-10-15T13:37:27Z</xades:SigningTime>
<xades:SigningCertificate>
<xades:Cert>
<xades:CertDigest>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>ZDMwMmI0MTE1NzVjOTU2NTk4YzVlODhhYmI0ODU2NDUyNTU2YTVhYjhhMDFmN2FjYjk1YTA2OWQ0NjY2MjQ4NQ==</ds:DigestValue>
</xades:CertDigest>
<xades:IssuerSerial>
<ds:X509IssuerName>CN=PRZEINVOICESCA4-CA, DC=extgazt, DC=gov, DC=local</ds:X509IssuerName>
<ds:X509SerialNumber>379112742831380471835263969587287663520528387</ds:X509SerialNumber>
</xades:IssuerSerial>
</xades:Cert>
</xades:SigningCertificate>
</xades:SignedSignatureProperties>
</xades:SignedProperties>
</xades:QualifyingProperties>
</ds:Object>
</ds:Signature>
</sac:SignatureInformation>
</sig:UBLDocumentSignatures>
</ext:ExtensionContent>
</ext:UBLExtension>
</ext:UBLExtensions>
<cbc:ProfileID>reporting:1.0</cbc:ProfileID>
<cbc:ID>EGS1-886431145-1</cbc:ID>
<cbc:UUID>6f4d20e0-6bfe-4a80-9389-7dabe6620f12</cbc:UUID>
<cbc:IssueDate>2024-09-09</cbc:IssueDate>
<cbc:IssueTime>09:00:00</cbc:IssueTime>
<cbc:InvoiceTypeCode name="0211010">388</cbc:InvoiceTypeCode>
<cbc:DocumentCurrencyCode>SAR</cbc:DocumentCurrencyCode>
<cbc:TaxCurrencyCode>SAR</cbc:TaxCurrencyCode>
<cac:AdditionalDocumentReference>
<cbc:ID>ICV</cbc:ID>
<cbc:UUID>1</cbc:UUID>
</cac:AdditionalDocumentReference>
<cac:AdditionalDocumentReference>
<cbc:ID>PIH</cbc:ID>
<cac:Attachment>
<cbc:EmbeddedDocumentBinaryObject mimeCode="text/plain">NWZlY2ViNjZmZmM4NmYzOGQ5NTI3ODZjNmQ2OTZjNzljMmRiYzIzOWRkNGU5MWI0NjcyOWQ3M2EyN2ZiNTdlOQ==</cbc:EmbeddedDocumentBinaryObject>
</cac:Attachment>
</cac:AdditionalDocumentReference>
<cac:AdditionalDocumentReference>
<cbc:ID>QR</cbc:ID>
<cac:Attachment>
<cbc:EmbeddedDocumentBinaryObject mimeCode="text/plain">AQ1XZXNhbSBBbHphaGlyAg8zOTk5OTk5OTk5MDAwMDMDFDIwMjQtMDktMDlUMDY6MDA6MDBaBAU2MC4wMAUFMTAuMDAGLHROL0V0cVU5c0kycDkyV2lqSXVSUTBhNWFUTkJzclhoYStPRWNTWDZxOHc9B2BNRVVDSUI0ZUZURWtlaFdTZWNrR0FXUnBYeVlEcXN2bUIxY2RrVXQxeFJweUhtYjRBaUVBbXQramkraFVTTldoSVVnUWhCNnYvQXlyNEdnb1BxUE8yc1JUUkp2U0NnRT0IWDBWMBAGByqGSM49AgEGBSuBBAAKA0IABKFgimtEmvRSBK0zr9LgJAtVSCl8VPZz6cdr5X+MoTHo8vHNNlyW5Q6u7T8naPJqtGoTjJjaPIMJ4u17dSk/VHgJRzBFAiEAsT+JyGadZcJQpRtxrfJyLyirBou8V0dWNCu94j26oBsCID2ELgzyOAwEAM9LOZ3a6I8kDqApHcsTTdTvl6psL+tc</cbc:EmbeddedDocumentBinaryObject>
</cac:Attachment>
</cac:AdditionalDocumentReference>
<cac:Signature>
<cbc:ID>urn:oasis:names:specification:ubl:signature:Invoice</cbc:ID>
<cbc:SignatureMethod>urn:oasis:names:specification:ubl:dsig:enveloped:xades</cbc:SignatureMethod>
</cac:Signature>
<cac:AccountingSupplierParty>
<cac:Party>
<cac:PartyIdentification>
<cbc:ID schemeID="CRN">454634645645654</cbc:ID>
</cac:PartyIdentification>
<cac:PostalAddress>
<cbc:StreetName>King Fahahd st</cbc:StreetName>
<cbc:BuildingNumber>0000</cbc:BuildingNumber>
<cbc:PlotIdentification>0000</cbc:PlotIdentification>
<cbc:CitySubdivisionName>West</cbc:CitySubdivisionName>
<cbc:CityName>Khobar</cbc:CityName>
<cbc:PostalZone>31952</cbc:PostalZone>
<cac:Country>
<cbc:IdentificationCode>SA</cbc:IdentificationCode>
</cac:Country>
</cac:PostalAddress>
<cac:PartyTaxScheme>
<cbc:CompanyID>399999999900003</cbc:CompanyID>
<cac:TaxScheme>
<cbc:ID>VAT</cbc:ID>
</cac:TaxScheme>
</cac:PartyTaxScheme>
<cac:PartyLegalEntity>
<cbc:RegistrationName>Wesam Alzahir</cbc:RegistrationName>
</cac:PartyLegalEntity>
</cac:Party>
</cac:AccountingSupplierParty>
<cac:AccountingCustomerParty>
<cac:Party>
<cac:PartyLegalEntity>
<cbc:RegistrationName>Wesam Alzahir</cbc:RegistrationName>
</cac:PartyLegalEntity>
</cac:Party>
</cac:AccountingCustomerParty>
<cac:TaxTotal>
<cbc:TaxAmount currencyID="SAR">10.00</cbc:TaxAmount>
<cac:TaxSubtotal>
<cbc:TaxableAmount currencyID="SAR">50.00</cbc:TaxableAmount>
<cbc:TaxAmount currencyID="SAR">7.50</cbc:TaxAmount>
<cac:TaxCategory>
<cbc:ID schemeAgencyID="6" schemeID="UN/ECE 5305">S</cbc:ID>
<cbc:Percent>15.00</cbc:Percent>
<cac:TaxScheme>
<cbc:ID schemeAgencyID="6" schemeID="UN/ECE 5153">VAT</cbc:ID>
</cac:TaxScheme>
</cac:TaxCategory>
</cac:TaxSubtotal>
<cac:TaxSubtotal>
<cbc:TaxableAmount currencyID="SAR">50.00</cbc:TaxableAmount>
<cbc:TaxAmount currencyID="SAR">2.50</cbc:TaxAmount>
<cac:TaxCategory>
<cbc:ID schemeAgencyID="6" schemeID="UN/ECE 5305">S</cbc:ID>
<cbc:Percent>5.00</cbc:Percent>
<cac:TaxScheme>
<cbc:ID schemeAgencyID="6" schemeID="UN/ECE 5153">VAT</cbc:ID>
</cac:TaxScheme>
</cac:TaxCategory>
</cac:TaxSubtotal>
</cac:TaxTotal>
<cac:TaxTotal>
<cbc:TaxAmount currencyID="SAR">10.00</cbc:TaxAmount>
</cac:TaxTotal>
<cac:LegalMonetaryTotal>
<cbc:LineExtensionAmount currencyID="SAR">50.00</cbc:LineExtensionAmount>
<cbc:TaxExclusiveAmount currencyID="SAR">50.00</cbc:TaxExclusiveAmount>
<cbc:TaxInclusiveAmount currencyID="SAR">60.00</cbc:TaxInclusiveAmount>
<cbc:AllowanceTotalAmount currencyID="SAR">0</cbc:AllowanceTotalAmount>
<cbc:PrepaidAmount currencyID="SAR">0</cbc:PrepaidAmount>
<cbc:PayableAmount currencyID="SAR">60.00</cbc:PayableAmount>
</cac:LegalMonetaryTotal>
<cac:InvoiceLine>
<cbc:ID>1</cbc:ID>
<cbc:InvoicedQuantity unitCode="PCE">5</cbc:InvoicedQuantity>
<cbc:LineExtensionAmount currencyID="SAR">50.00</cbc:LineExtensionAmount>
<cac:TaxTotal>
<cbc:TaxAmount currencyID="SAR">10.00</cbc:TaxAmount>
<cbc:RoundingAmount currencyID="SAR">60.00</cbc:RoundingAmount>
</cac:TaxTotal>
<cac:Item>
<cbc:Name>TEST NAME 1</cbc:Name>
<cac:ClassifiedTaxCategory>
<cbc:ID>S</cbc:ID>
<cbc:Percent>15.00</cbc:Percent>
<cac:TaxScheme>
<cbc:ID>VAT</cbc:ID>
</cac:TaxScheme>
</cac:ClassifiedTaxCategory>
<cac:ClassifiedTaxCategory>
<cbc:ID>S</cbc:ID>
<cbc:Percent>5.00</cbc:Percent>
<cac:TaxScheme>
<cbc:ID>VAT</cbc:ID>
</cac:TaxScheme>
</cac:ClassifiedTaxCategory>
</cac:Item>
<cac:Price>
<cbc:PriceAmount currencyID="SAR">10</cbc:PriceAmount>
</cac:Price>
</cac:InvoiceLine>
</Invoice>
