Request for Validation and Guidance on ZATCA E-Invoice Integration Steps (Sandbox to Production)

XML and business rules
1

Hi,

I would like to confirm the integration steps I have followed for implementing ZATCA’s e-Invoicing system in the Sandbox environment and seek guidance on any improvements needed, as well as the procedure for transitioning to Production.

Steps Followed in Sandbox:

  1. CSR Generation:
    I generated a CSR using the ZATCA SDK (via command line).

  2. Compliance CSID API Call:
    The CSR was submitted to the Compliance CSID API, and I received the binarySecurityToken and secret.

  3. Certificate Retrieval:
    I converted the binarySecurityToken to Base64 to obtain the certificate.

  4. Compliance Check API:
    Using the certificate and secret, I validated the XML invoice (UBL format) through the Compliance Check API.

    • Authentication: Basic Auth using binarySecurityToken and secret.

  5. XML Signing:
    I used the ZATCA .NET DLL (v4.8) to sign the invoice XML, resulting in the compliant e-Invoice.

  6. Reporting API Submission:
    The signed XML was packaged using the ZATCA DLL to generate a request for submission.
    I then submitted the invoice to the Reporting API, again using binarySecurityToken and secret for Basic Auth.

So far, I have successfully submitted a Tax Invoice in the Sandbox environment.

Request for Confirmation and Guidance:

  • Could you please confirm whether the steps above align with ZATCA’s expected integration flow?
  • Are there any improvements or changes you recommend before moving to Production?
  • What is the exact procedure to transition to the Production environment (e.g., CSR process, certificate handling, API endpoints, or security changes)?

Best regards,

2

Dear @chkjamil,

Before sending the invoice to reporting or clearance, PCSID (Production CSID) should be obtained first, and this is being done after completing all of the compliance checks through the PCSID API request.

For signing the invoices in reporting API, it will be based on the PCSID, unlike the compliance check where it will be based on the CCSID (compliance CSID).

I suggest to watch the onboarding steps video, where you can find in the announcements section in this community portal.

Regards,