I’ve moved from the sandbox to the simulation environment to test my code, and everything worked fine in the sandbox—from CSR generation to the compliance check API. In the simulation environment, I generated the CSR and sent a request to the compliance API. My question is: during CSR generation, should actual information (like VAT number, custom_id, etc.) be used in OpenSSL instead of dummy data? My goal is to successfully receive the requestID, binarySecurityToken, and secret from the compliance API.
I suspect that using dummy data during CSR generation may be causing issues, as I’m encountering the following error in the compliance API response within the simulation environment:
Note: I already have a valid OTP from the Fatoora portal, active for one hour.
For reference, I followed the steps outlined on pages 17 to 20 in this guide:
https://zatca.gov.sa/en/E-Invoicing/Introduction/Guidelines/Documents/Fatoora_Portal_User_Manual_English.pdf
Error Response:
{#1330 ▼ // app/Zatca/API.php:48
+"errors": array:1 [▼
0 => {#1329 ▼
+"code": "Invalid-OTP"
+"message": "The provided OTP is invalid"
}
]
}
Environment: PHP, Laravel.
API URL in use:
https://gw-fatoora.zatca.gov.sa/e-invoicing/simulation/compliance
Would using accurate information resolve this issue? If so, which information is required when generating the CSR certificate?
Dummy Information which I am passing:
$egs_unit = [
'uuid' => '6f4d20e0-6bfe-4a80-9389-7dabe6620f12',
'custom_id' => 'EGS1-886431145',
'model' => 'IOS',
'CRN_number' => '454634645645654',
'VAT_name' => 'Wesam Alzahir',
'VAT_number' => '399999999900003',
'location' => [
'city' => 'Khobar',
'city_subdivision' => 'West',
'street' => 'King Fahahd st',
'plot_identification' => '0000',
'building' => '0000',
'postal_zone' => '31952',
],
'branch_name' => 'My Branch Name',
'branch_industry' => 'Food',
'cancelation' => [
'cancelation_type' => 'INVOICE',
'canceled_invoice_number' => '',
],
];
