ZATCA · Fatoora · Saudi Arabia
What is Fatoora? ZATCA's e-invoicing platform explained
Fatoora (فاتورة) is the Zakat, Tax and Customs Authority (ZATCA) platform where Saudi VAT-registered businesses onboard EGS units, obtain CSID certificates, and submit invoices for clearance (B2B) or reporting (B2C). If you search for Fatoora, ZATCA e-invoicing, or how to connect your POS/ERP — this is the government system your software must talk to in Phase 2.
Fatoora vs ZATCA — what's the difference?
ZATCA is the government authority that sets e-invoicing rules, VAT policy, and compliance waves. Fatoora is ZATCA's operational platform: the portal at fatoora.zatca.gov.sa and the REST APIs at gw-fatoora.zatca.gov.sa that your E-Invoice Generation Solution (EGS) uses.
Phase 1 only required generating structured e-invoices locally (with QR codes). Phase 2 (Integration) requires a live connection to Fatoora — every standard (B2B) invoice must be cleared before delivery; simplified (B2C) invoices must be reported within 24 hours.
Businesses still log into the Fatoora portal to see their Phase 2 wave, register devices, and generate OTP codes for CSID onboarding or renewal. Day-to-day invoice submission happens via API from your billing system, POS, or middleware like Esnad.
How to use the Fatoora portal
1. Log in at fatoora.zatca.gov.sa
Use your VAT-registered business credentials (often linked to Absher or ZATCA portal login). Developer Portal credentials are separate — used for sandbox API keys and documentation.
2. Check your Phase 2 wave & deadline
ZATCA assigns integration waves by annual VAT turnover. Your deadline is visible in the portal. Missing it can lead to penalties and blocked operations.
3. Register EGS units
Each branch, POS, or logical invoicing device needs an EGS unit. Onboard via the portal, then generate a one-time OTP to link your e-invoicing solution.
4. Generate OTP for CSID
OTP codes expire in about 5 minutes. Paste them into your integration (or Esnad dashboard) to obtain Compliance CSID, pass test invoices, then Production CSID.
Phase 2: clearance vs reporting on Fatoora
Standard tax invoices (B2B) go through the Clearance API — ZATCA validates and stamps the invoice before you send it to the buyer. Simplified tax invoices (B2C) are issued to the customer immediately with a QR code; your system reports them to Fatoora within 24 hours via the Reporting API. Both require UBL 2.1 XML, ECDSA signing, and a PIH (Previous Invoice Hash) chain per EGS unit.
Fatoora platform APIs (overview)
| API | Purpose |
|---|---|
| Compliance CSID | Onboard EGS — obtain pre-production certificate after OTP + CSR |
| Compliance invoices | Run mandatory test invoices before production go-live |
| Production CSID | Issue or renew live signing certificate (typically annual) |
| Clearance (single) | B2B standard invoices — must succeed before buyer delivery |
| Reporting (single) | B2C simplified invoices — submit within 24h of issue |
Fatoora compliance waves (2026–2027)
ZATCA rolls out Phase 2 in revenue-based waves. Wave 23 (31 March 2026) and Wave 24 (30 June 2026) cover higher VAT-subject revenue bands. Wave 25 requires Fatoora integration by 1 February 2027 for taxpayers over SAR 187,500 in any of 2022–2025. Check your exact wave in the Fatoora portal.
Three ways to integrate with Fatoora
Direct API integration
Build against gw-fatoora.zatca.gov.sa yourself: ECDSA keys, UBL 2.1 XML, XAdES signing, PIH chains, retry queues. Full control; weeks to months of engineering.
Middleware API (Esnad) →
POST JSON invoices; we handle Fatoora onboarding, signing, clearance, reporting, webhooks, and 6-year archive. Stable REST contract while ZATCA rules evolve.
ERP / POS module →
If your software vendor ships a certified ZATCA module, you may integrate through them. Verify Phase 2 clearance/reporting — not just Phase 1 QR generation.
Fatoora & ZATCA — frequently asked questions
- What is Fatoora in Saudi Arabia?
- Fatoora is ZATCA's e-invoicing platform — the portal and APIs used for Phase 2 integration. VAT-registered businesses use it to register EGS units, manage CSID certificates, and submit invoices for government clearance or reporting.
- Is Fatoora the same as ZATCA?
- No. ZATCA is the tax authority; Fatoora is ZATCA's technical platform for e-invoicing. You comply with ZATCA rules by connecting your systems to Fatoora.
- Do I need a Fatoora account if I use Esnad?
- Yes, once per year at minimum. You log into the Fatoora portal to generate OTP codes for EGS onboarding and CSID renewal. Esnad handles all API submission, signing, and archiving after you paste the OTP.
- What is the Fatoora portal URL?
- Production portal: https://fatoora.zatca.gov.sa. API base: https://gw-fatoora.zatca.gov.sa. ZATCA also provides a Developer Portal and simulation environment for sandbox testing.
- What happens if I miss my Fatoora Phase 2 deadline?
- ZATCA may impose penalties, and you risk being unable to issue legally compliant tax invoices. Integrate before your wave deadline — sandbox testing can start weeks earlier.
- Fatoora vs Fatoorah — which spelling is correct?
- ZATCA uses Fatoora (فاتورة) officially. Searchers often type Fatoorah; both refer to the same ZATCA e-invoicing platform.
Skip the Fatoora boilerplate
Esnad is middleware between your app and Fatoora. One JSON API for EGS onboarding, B2B clearance, B2C reporting, and certificate renewal — with sandbox in hours, not weeks.
ZATCA Phase 2 guide →ZATCA API for developers →How to register on Fatoora →