REST API v1
Preflight, idempotent creation, status lookup, imports, and webhooks share one stable tenant-aware contract.
VERIFACTU REST API · SDK · WEBHOOKv0.1.0 published
VeriFactu REST API for ERP, SaaS, and custom software without implementing the AEAT layer in every application.
Kairoseth Fiscal provides a VeriFactu API for developers with REST v1, a server-side SDK, webhooks, and MappingProfiles. Your backend supplies data while the secure runtime centralizes preflight, identity, idempotency, state, and supported fiscal transport.
VERIFACTU API FOR DEVELOPERS
REST API + server-side SDK so your system can keep speaking its own language.
Integrate the canonical contract directly or keep your current payload and translate it through a server-side MappingProfile.
Server-side SDK for developers
The SDK wraps authentication, routes, idempotency, and normalized errors so integrators do not need to know AEAT SOAP or XML.
Server-side MappingProfile
Your ERP can keep NUM_FACTURA, fecha_doc, or any internal vocabulary. Mapping is configured once and resolved on the server.
Low-code webhook
Systems that can issue an HTTP POST can use a webhook protected by HMAC-SHA256, anti-replay timestamps, and idempotency.
Server-authoritative identity
organizationId, installationId, sourceSystem, fiscal environment, permissions, and credentials are not trusted from client payloads.
Reconciliation and idempotency
The same key and content return the same resource. Uncertain remote outcomes are reconciled rather than blindly resent.
REST API V1
VeriFactu API endpoints for integration and operation.
The same API covers validation, creation, lookup, file imports, and low-code ingress.
Validate a canonical intent without side effects.
Create an idempotent operation using Idempotency-Key.
Retrieve normalized state and available presentation metadata.
Inspect CSV/XLSX and prepare mapping.
Validate imported rows before fiscalization.
Signed low-code ingress with a server-side profile.
HOW IT WORKS
Fiscal integration with server-controlled identity and idempotency.
The client provides data. The server decides tenant, installation, permissions, fiscal environment, and sensitive configuration.
Authenticate the integration
Use server-side connector credentials. API keys must never be exposed to a browser or public application.
Send canonical or mapped data
Build InvoiceIntent v1 directly or send your source payload through a server-side MappingProfile.
Run preflight
Validate before creation and receive structured errors that point to source, mapping, or configuration issues.
Create once, then query
Creation requires Idempotency-Key. After recordId exists, operational retries query or reconcile instead of duplicating.
INTEGRATION SECURITY
Credentials and fiscal authority are not delegated to the client payload.
The runtime resolves organization, installation, sourceSystem, fiscal environment, and credentials from authenticated context. The SDK is server-side only and webhooks add HMAC signatures plus anti-replay protection.
FAQ
Questions about VeriFactu API, AEAT, SDK, and webhooks.
For developers, technical teams, SaaS vendors, and integrators.
Does Kairoseth Fiscal provide a VeriFactu API?
Yes. Puente VeriFactu exposes a REST v1 API with preflight, idempotent creation, status lookup, imports, and webhooks, plus a server-side SDK.
Is this the official AEAT VeriFactu API?
No. Kairoseth Fiscal provides an integration API so ERP, SaaS, and custom software can use a stable REST contract. The runtime connects to AEAT mechanisms supported by the product, but the Kairoseth API should not be confused with an official API published by the Spanish Tax Agency.
Is the VeriFactu API designed for developers?
Yes. Integration is backend-oriented: REST API v1, server-side SDK, Idempotency-Key, normalized errors, MappingProfiles, and signed webhooks. Credentials must never be exposed in frontend code.
Does my ERP need to generate AEAT XML?
No. The API and SDK are designed so your software provides commercial/canonical data while Kairoseth Fiscal centralizes the AEAT transport and technical rules supported by the product.
Can I send the JSON my ERP already uses?
Yes, when a server-side MappingProfile translates it. The source system does not need to rename every field to match the canonical contract.
How are duplicate invoices prevented?
POST /v1/fiscal-records requires Idempotency-Key. The same key with the same content returns the same resource; the same key with different content returns a conflict.
Can I use webhooks?
Yes. Webhook ingress uses a server-side profileId, HMAC-SHA256 signatures, anti-replay timestamps, and idempotency.
Can the API key live in browser JavaScript?
No. The SDK and connector credentials are server-side only. Integration keys must never be exposed to a browser or public application.
Is Fiscal API available?
Yes. Kairoseth Fiscal v0.1.0 is published and an API integration can be diagnosed, prepared, and validated. AEAT production remains controlled access and requires its own gate; neither the plan nor payment enables it automatically.
TRUST & CONTROL
Authority stays explicit as the platform grows.
Kairoseth separates identity, organization scope, product roles and product capabilities. A login route, browser state or AI response never becomes an authorization boundary by itself.
KAIROSETH PLATFORMCONTROL PLANE
- Identity
- Shared account
- Verified
- Organization
- Tenant scope
- Required
- Product
- RBAC assignment
- Explicit
- Sensitive actions
- Policy gate
- Controlled
Organization scope
Customer resources and access are resolved inside an active organization context rather than treated as global account state.
Product-scoped roles
Owner, Admin and Member authority is assigned per product. Organization membership alone does not automatically grant every product.
Server authority
Sensitive access, policy and capability decisions remain authoritative on the server instead of trusting client UI state or model output.
Controlled execution
Capabilities that can act are introduced behind explicit grants, staged gates and audit rather than implied autonomy.
Public trust evidence
Review the customer-facing policies that define privacy, security reporting, acceptable use and the current legal operating framework.
KAIROSETH FISCAL API
Review my VeriFactu API integrationTell us what data your software exposes and we will choose the smallest API integration needed.
REST, SDK, MappingProfile, webhook, or connector: the architecture adapts to your capabilities without moving AEAT logic into your application.