Simple pricing. SAR and USD.

You register once on the Fatoora portal to generate a one-time OTP — that's it. You paste the OTP into Esnad when setting up an EGS unit, and we handle the full ZATCA registration flow: CSR generation with the required cryptographic keys, compliance CSID acquisition, the 3-invoice compliance check, and final production CSID. After that, the only time you interact with Fatoora directly is when your certificate expires (once a year) and you need to generate a new OTP for renewal. Everything else — invoice signing, submission, retries, XML archiving — is handled by Esnad automatically.

We never fail your API call just because ZATCA is temporarily unavailable. For B2B (Standard) invoices, we queue the submission and retry with exponential backoff — ZATCA usually recovers within minutes and your invoice gets cleared without any action on your part. For B2C (Simplified) invoices, ZATCA's rules give you a 24-hour reporting window, so short outages are completely absorbed. Our load balancer uses a separate liveness endpoint that doesn't depend on ZATCA, so the Esnad API stays healthy and accepting requests even during ZATCA incidents. You'll see invoice status as "queued" during an outage and "reported" or "cleared" once ZATCA is back.

Standard Tax Invoices (B2B) require real-time clearance before you send the invoice to your buyer. We sign and persist immediately, try ZATCA inline, and return HTTP 200 when cleared in the same request. If Fatoora is slow or down, you get HTTP 202 with status queued — we retry automatically and send webhooks when cleared. Do not deliver B2B invoices to the buyer until status is cleared. Simplified Tax Invoices (B2C) work differently: you issue first with a QR code, then ZATCA requires reporting within 24 hours. We return the QR immediately (even when queued) so your customer gets their receipt; final reported status arrives via webhook or GET invoice.

Usually 60–90 seconds. You provide a unit name, invoice type (B2B, B2C, or both), and the OTP from the Fatoora portal. We generate the ECDSA key pair, build the CSR with ZATCA-required fields, submit to ZATCA's compliance endpoint, run the three mandatory compliance test invoices, and exchange for a production certificate — all automatically. The process is async and you poll a status endpoint until it shows "active." The OTP from Fatoora expires in about 5 minutes, so make sure to use it promptly after generating it.

Your invoice data and signed XML are stored in AWS me-south-1 (Bahrain) or me-central-1 (UAE). Both are Middle East regions with no data leaving the GCC. Private keys are stored in AWS Secrets Manager in the same region, never in the database, and never logged. Production signed XML is encrypted at rest in S3 and retained for 6 years per ZATCA's archiving requirements. Sandbox (test) invoices are not written to the long-term S3 archive. We do not transfer your data to servers outside the Middle East region. We also issue our own subscription invoices through Esnad — so our own billing is ZATCA-compliant and stored under the same data residency rules.

Yes — this is a core use case for Business, Studio, and Platform. Create a legal entity (company) per merchant VAT under one organization, then EGS units per branch or POS. Team members switch companies in the dashboard; invoice usage and billing pool at the org level. Business includes up to 3 companies, Studio up to 10, Platform is custom. Optional white-label API domain and invoice branding are available on Platform — contact us.

All four types required for ZATCA Phase 2 compliance: Standard Tax Invoice (B2B clearance), Simplified Tax Invoice (B2C reporting), Credit Notes, and Debit Notes. Credit and debit notes reference the original invoice UUID and automatically follow the same flow as the original (clearance if B2B, reporting if B2C). We handle the UBL XML structure for all types, including the correct document type codes, reason codes, and reference fields ZATCA requires.

ZATCA periodically updates validation rules, error codes, and sometimes input/output formats. If you integrate directly with Fatoora, every change can mean rework and a constant risk of going outdated. With Esnad, your API contract stays the same — you send the same JSON, we return the same cleared invoice. We track every ZATCA update and release compatibility as soon as it's live. We handle data and versioning; you get the benefit without touching your code. It's part of every plan at no extra cost.

Certificate expiry is the #1 operational risk for ZATCA compliance — when a certificate expires, every invoice submission fails immediately. We alert you at 30, 14, 7, and 1 day before expiry via email and dashboard notification. Renewal is simple: generate a new OTP from the Fatoora portal, call POST /v1/egs/:id/renew with the OTP, and we run the full renewal flow automatically. Your existing key pair is reused (no data loss, invoice counter preserved). The renewal takes about 60 seconds. Your existing invoices remain valid and the hash chain is preserved across renewals.

Yes. Every Esnad account gets a sandbox environment linked to ZATCA's simulation endpoint. API keys prefixed zatca_test_ route to the sandbox automatically. You can create sandbox EGS units, issue test invoices (real ZATCA submission to simulation), and test webhooks — all without touching production. The sandbox uses a fixed ZATCA test OTP so you don't need Fatoora credentials to set up sandbox EGS units. Sandbox invoice quota is separate from your live quota. Sandbox signed XML is not written to the long-term S3 archive (production only).

We provide code examples for Node.js, Python, and PHP on the homepage and in the API reference. The API is a standard REST API with JSON, so any language that can make HTTP requests works. We don't have official SDK packages yet — our API is simple enough that wrapping it in a thin HTTP client is typically 10-20 lines. The docs site has flow & integration guides, endpoint reference with copy-paste examples, and cURL.

We never hard-block invoice submissions mid-month — cutting off a live transaction would mean your customer doesn't get their ZATCA receipt, which is unacceptable for a compliance product. Instead, we notify you at 80% and 95% of your quota, and allow overages billed at the end of your billing period. Overage rates are SAR 0.30/invoice (Solo), SAR 0.25 (Business), and SAR 0.15 (Studio). Platform overage is quoted with your custom plan. If you consistently exceed your quota, upgrading to the next plan is always cheaper than paying overages.

Yes on the Platform plan. We quote white-label API domain and custom invoice branding with your partnership terms. Your clients integrate under your brand while Esnad still runs Fatoora clearance, CSIDs, and compliance. Combine with multi-company orgs so each merchant keeps a separate VAT profile. Contact support@esnadapi.com or use the Platform CTA.

Yes. Business includes up to 3 legal entities, Studio up to 10, and Platform is custom. Each company has its own company profile (VAT, CR, address), EGS units, and invoice chain. You switch the active company in the dashboard; team access and invoice quotas are pooled at the organization level.

Esnad is a middleware API that integrates with ZATCA's official Fatoora endpoints. All invoices are submitted to and cleared/reported by ZATCA's own systems — we are a technical integration layer, not a parallel system. ZATCA's certification program for E-Invoicing Solution Providers is separate from our service. We operate by calling ZATCA's published APIs on your behalf, using credentials (CSID) that ZATCA issues to your business. Every invoice in our system has a UUID and clearance stamp issued directly by ZATCA.

Production signed XML is retained for the legally required 6 years (ZATCA mandates 6-year invoice retention) regardless of subscription status. You can download production invoice XML anytime via the API or dashboard invoice detail. Sandbox invoices are for testing and are not kept in the long-term S3 archive. After cancellation, your account is in read-only mode for 30 days — you can log in, download invoices, but not submit new ones. After 30 days, your account is archived. Production archive data is never deleted before the 6-year retention period expires.

An API key authenticates your company (tenant) to the API. One key can serve many EGS units — send egs_unit_id on every invoice. Extra keys help isolate apps or environments. For multiple merchant VATs, use separate legal entities under one organization rather than one key per merchant.

EGS (E-Invoicing Generation Solution) is ZATCA's term for a registered invoicing device or branch. Each EGS unit gets its own ZATCA certificate. One physical branch = one EGS unit.

A legal entity is one ZATCA taxpayer profile (VAT + CR) under your organization. Use it when you issue for multiple registered businesses — subsidiaries, franchisees, or client companies — without creating separate billing accounts.