Skip to main content
POST
Submit the OTP and obtain the Compliance CSID
The request carries the party’s registration details plus the OTP generated in the ZATCA Fatoora portal. The company name and registered address are not part of the body — both are taken from the org.Party silo entry, which Register Party validates before publishing the onboarding link. The resulting credentials are stored securely and the queued registration task is poked so the workflow can continue.
Use this endpoint only after running the party registration workflow: it returns 404 when the silo entry has no registration and 409 when the party already holds a Compliance CSID, rather than issuing a second set of certificates. The OTP is short-lived, so generate it in the portal immediately before calling this endpoint.

Authorizations

Authorization
string
header
required

Authenticate using a valid Invopop enrollment token in the Bearer scheme.

Example: Authorization: Bearer <token>

Path Parameters

silo_entry_id
string
required

ID of the org.Party silo entry being onboarded.

Example:

"5b45453c-cdd0-11ed-afa1-0242ac120002"

Body

application/json
invoice_type
enum<string>
required

Which invoice transactions the CSID is requested for, encoded as ZATCA's 4-digit functionality map.

  • 1000 — standard tax invoices only.
  • 0100 — simplified invoices only.
  • 1100 — both standard and simplified invoices.
Available options:
1000,
0100,
1100
Example:

"1100"

branch_name
string
required

Name of the branch or organizational unit the certificate is issued for. In case of VAT Groups, this field should contain the 10-digit TIN number of the individual group member.

Example:

"Head Office"

business_category
string
required

Business category or industry of the supplier.

Example:

"Retail"

otp
string
required

6-digit One-Time Password generated in the ZATCA Fatoora portal for the registering device. Valid only for a short period.

Example:

"123456"

Response

OTP accepted, Compliance CSID obtained and credentials stored.