Solo
One business, own invoices only
SAR 149/mo
~$40
- 500 inv/mo
- 1 company · 1 prod + 2 sandbox EGS
✦ ZATCA Phase 2 Compliant ✦
For businesses in Saudi Arabia
The fastest way to integrate ZATCA compliance into any system.
Esnad sits between your system and ZATCA Fatoora. You send invoice data. We handle the XML, certificates, cryptographic signing, PIH chain, and QR code. Your customers get ZATCA-compliant invoices. You write zero ZATCA code.
No credit card required · Sandbox provisioned within 24 hours · Data in AWS Middle East (me-south-1)
How It Works
01
Request a sandbox trial
Tell us your company name and plan. We provision your sandbox within 24 hours and email your dashboard login.
02
Add your first EGS unit
We generate keys, build the CSR, run the ZATCA compliance flow, and get your production cert. You provide the OTP from Fatoora. Takes ~60 seconds.
03
Issue invoices via one API call
POST JSON to our API. We sign, submit to ZATCA, and return the cleared invoice with UUID and QR.
You only touch Fatoora portal once per year — to generate an OTP for certificate renewal. Everything else is us.
What We Handle
✓
UBL 2.1 XML Generation
Saudi profile, all namespaces, correct field ordering
✓
TLV QR Code (B2C)
9-tag binary, base64, max 700 chars — generated automatically
✓
ECDSA Cryptographic Signing
secp256k1, DER-encoded, embedded in UBL extension
✓
PIH Chain Maintenance
We maintain the Previous Invoice Hash across every invoice, per EGS unit
✓
CSID Certificate Lifecycle
We alert 30/14/7/1 days before expiry. Renew in one API call.
✓
Retry & Queue
ZATCA down? We queue and retry. B2C 24h window absorbs short outages. You always get a response.
✓
B2B Clearance
Clearance inline when Fatoora is healthy; queued with retries when it is not.
✓
6-Year XML Archive
Production signed XML encrypted in AWS S3 for 6 years. Sandbox is not archived to S3.
✓
B2C Reporting
Issue first, we report to ZATCA within the required 24h window.
✓
Webhooks
We POST to your URL when invoices are cleared or reported. HMAC-signed.
✓
ZATCA updates & versioning
We track every ZATCA change. Your API contract stays the same — we absorb updates so you never go outdated.
✓
PDF Download
Download any cleared invoice as PDF via API. No extra setup.
✓
EGS unit per invoice
Send egs_unit_id on every invoice so each branch or POS is attributed correctly. One API key can serve many units.
✓
Idempotent Invoice Creation
Send the same idempotency key and get the same invoice back — safe retries.
✓
Rate Limits
Documented per-plan limits (req/min). No surprises.
✓
Audit Log
Full audit trail of API and dashboard actions in your account.
✓
Team & Invites
Invite team members to the dashboard. One account, multiple users.
✓
Multi-company & multi-VAT
One organization, many legal entities — each with its own VAT, CR, and EGS units. Switch companies in the dashboard; billing pools across the org.
✓
Two-Factor Authentication
TOTP-based 2FA for dashboard login. Your keys stay secure.
Always up to date with ZATCA
ZATCA changes requirements, error codes, and formats over time. Build directly and you risk constant rework. With Esnad, your API stays the same — we handle every update, data, and versioning. You get the complete solution; no one else.
Who Uses Esnad
POS Vendors & Resellers
You built the POS. Every merchant needs their own ZATCA entity. Add companies under one org, EGS per branch, optional white-label on Platform.
→ Studio or Platform plan
Dev Agencies & Integrators
Your Saudi client needs Phase 2 now. Integrate once, ship to them. Multi-entity accounts for holding groups and franchise networks.
→ Business plan SAR 349/mo
Accounting Firms
Manage ZATCA for 30+ client companies in one org. Separate VAT profiles, shared team access, pooled invoice quota, cert alerts across the board.
→ Studio plan SAR 799/mo
Your Data Stays in the Region
All invoice data, signed XML, and private keys are stored in AWS Middle East regions. No data leaves the GCC. ZATCA data residency guidelines compliant.
Signed XML
Production S3 — 6 yrs · Encrypted
Private Keys
Secrets Mgr · Never in DB
Invoice data
RDS MySQL · Encrypted
We issue our own invoices through Esnad. Every SAR you pay us is ZATCA-compliant.
Simple Pricing in SAR
14-day free trial on all plans. Request access — no credit card.
Most popular
Business
POS & agencies — up to 3 companies
SAR 349/mo
~$93
- 3,000 inv/mo
- Up to 3 companies · 2 keys + 1 prod EGS each
Studio
Firms & integrators — up to 10 companies
SAR 799/mo
~$213
- 10,000 inv/mo
- Up to 10 companies · 2 keys + 2 prod EGS each
Platform
White-label & reseller platform: multi-merchant ERPs, POS networks, franchise groups, API partners — custom volume, entities, and branding
Custom
Quoted after we learn your volume & use case
- Custom volume / Tailored
- Custom entities · Optional white-label
FAQ
You register once on the Fatoora portal to generate a one-time OTP — that's it. You paste the OTP into Esnad when setting up an EGS unit, and we handle the full ZATCA registration flow: CSR generation with the required cryptographic keys, compliance CSID acquisition, the 3-invoice compliance check, and final production CSID. After that, the only time you interact with Fatoora directly is when your certificate expires (once a year) and you need to generate a new OTP for renewal. Everything else — invoice signing, submission, retries, XML archiving — is handled by Esnad automatically.
We never fail your API call just because ZATCA is temporarily unavailable. For B2B (Standard) invoices, we queue the submission and retry with exponential backoff — ZATCA usually recovers within minutes and your invoice gets cleared without any action on your part. For B2C (Simplified) invoices, ZATCA's rules give you a 24-hour reporting window, so short outages are completely absorbed. Our load balancer uses a separate liveness endpoint that doesn't depend on ZATCA, so the Esnad API stays healthy and accepting requests even during ZATCA incidents. You'll see invoice status as "queued" during an outage and "reported" or "cleared" once ZATCA is back.
Standard Tax Invoices (B2B) require real-time clearance before you send the invoice to your buyer. We sign and persist immediately, try ZATCA inline, and return HTTP 200 when cleared in the same request. If Fatoora is slow or down, you get HTTP 202 with status queued — we retry automatically and send webhooks when cleared. Do not deliver B2B invoices to the buyer until status is cleared. Simplified Tax Invoices (B2C) work differently: you issue first with a QR code, then ZATCA requires reporting within 24 hours. We return the QR immediately (even when queued) so your customer gets their receipt; final reported status arrives via webhook or GET invoice.
Usually 60–90 seconds. You provide a unit name, invoice type (B2B, B2C, or both), and the OTP from the Fatoora portal. We generate the ECDSA key pair, build the CSR with ZATCA-required fields, submit to ZATCA's compliance endpoint, run the three mandatory compliance test invoices, and exchange for a production certificate — all automatically. The process is async and you poll a status endpoint until it shows "active." The OTP from Fatoora expires in about 5 minutes, so make sure to use it promptly after generating it.
Your invoice data and signed XML are stored in AWS me-south-1 (Bahrain) or me-central-1 (UAE). Both are Middle East regions with no data leaving the GCC. Private keys are stored in AWS Secrets Manager in the same region, never in the database, and never logged. Production signed XML is encrypted at rest in S3 and retained for 6 years per ZATCA's archiving requirements. Sandbox (test) invoices are not written to the long-term S3 archive. We do not transfer your data to servers outside the Middle East region. We also issue our own subscription invoices through Esnad — so our own billing is ZATCA-compliant and stored under the same data residency rules.
One API call
The fastest way to integrate ZATCA compliance into any system — without ZATCA boilerplate.
const response = await fetch('https://api.esnadapi.com/v1/invoices/simplified', {
method: 'POST',
headers: {
'Authorization': 'Bearer zatca_live_xxxxxxxxxxxx',
'Idempotency-Key': crypto.randomUUID(),
'Content-Type': 'application/json',
},
body: JSON.stringify({
egs_unit_id: 'egs_abc123',
invoice_number: 'INV-2026-001',
invoice_date: '2026-01-15',
seller: { name: 'Al Noor Trading', vat_number: '310122393500003' },
line_items: [{ description: 'Cappuccino', quantity: 2, unit_price: 18.00, vat_category: 'S' }],
currency: 'SAR'
})
});
const data = await response.json();
// data.uuid, data.qr_code, data.status === 'reported'Full API documentation
Flow & integration, API reference, invoices, EGS, webhooks, and rate limits — all on our docs site.
Open docs.esnadapi.com →Start Issuing ZATCA-Compliant Invoices Today
14-day free trial · 10 live invoices · Provisioned within 24 hours
Questions? support@esnadapi.com