Wrong invoice hashing / QR Error During Simplified Invoice Validation

Signing process
1

Hi,

I’m encountering failure response when validating a simplified invoice via the ZATCA .NET SDK. Below is the console output:

Validate XSD [Success]
Validate EN Schematrons [Success]
Validate KSA Schematrons [Success]

Validate QR Code [Failed]
  **** [Error] CODE: hashedXml
       MESSAGE: hashedXml does not match QR‑code hashedXml or hashedXml is missing

Validate EInvoice Signature [Failed]
  **** [Error] CODE: invoiceSignedDataDigestValue – wrong invoice hashing.
  **** [Error] CODE: signatureValue – wrong signature value.

Validate EInvoice PIH [Success]
Overall status [Failed]

What I’ve Done so Far

  1. CSR → Certificate

    • Generated a CSR with the SDK CLI.
    • Posted CSR to the Compliance CSID API and received a binarySecurityToken.
    • Base64‑decoded the token and saved it as cert.pem.

  2. Signing the Invoice
    Command used:

    fatooraNet sign ^
   -invoice 6064-3111-unsigned.xml ^
   -certificate F:\fatoora\developer-portal\cert.pem ^
   -privateKey F:\fatoora\generated-private-key-20250711163807.key

    This ran without errors and produced 6064-3111-signedinvoice.xml.

  3. Validation

    fatooraNet validate ^
   -invoice 6064-3111-signedinvoice.xml ^
   -certificate F:\fatoora\developer-portal\cert.pem ^
   -pih <SDK>\Data\PIH\pih1.txt

    The result is the QR / hashing error shown above.

  4. Developer Portal API Check
    The same (signed) invoice fails when I use “GenerateRequest” command with:

    {
  "type": "ERROR",
  "code": "invalid-invoice-hash",
  "category": "INVOICE_HASHING_ERRORS",
  "message": "The invoice hash API body does not match the (calculated) Hash of the XML"
}

Is there an additional step required to embed or re‑calculate the invoice hash and QR code after signing? BTW, as per my understanding “SignDocument” will generate invoice hash, QR code and signature.

Any guidance or examples would be greatly appreciated.

Thank you in advance.

2

Dear @chkjamil,

Where have you posted the CSR? In Sandbox environment (developer portal)? because if you are posting it to simulation or production they will be unusable for the devloper portal environment (Sandbox).

Regarding the SDK validation error, it’s probably a mistake in placing the certificate file, try to run the command without -certificate -privatekey as the SDK will automatically trigger the default place holder for both of the certificate and privatekey, you are basically signing based on the obtained certificate but in terms of validation, it’s being done on the default certificate where it’s placed in the following path:

ZATCA’s SDK folder/Data/Certificates/Cert.pem

Try to replace the value with your obtained certificate, same is applied for the private key as well.

Regards,

3

Thanks, the issue is resolved. Actually, I was missing following line at the top of the xml file

<?xml version="1.0" encoding="UTF-8"?>