New Guide 2025

ZATCA Phase 2 Explained
Integration Phase

The transition from "generating" invoices to "integrating" with Fatoora portal. Here is everything technical and operational you need to know.

What is ZATCA Phase 2?

Phase 2, known as the Integration Phase, requires your accounting software to connect directly with the ZATCA Fatoora portal. Unlike Phase 1, where storing a PDF locally was sufficient, Phase 2 mandates that every invoice is digitally signed and cleared (or reported) in real-time or near real-time.

1 Phase 1 (Generation)

  • Generate PDF + XML
  • Store locally
  • Simple QR Code (5 tags)
  • No internet required

2 Phase 2 (Integration)

  • Clearance (B2B) before sharing
  • Reporting (B2C) within 24h
  • Complex QR Code (9 tags)
  • Cryptographic Stamp (CSID)

The XML Standard (UBL 2.1)

ZATCA does not accept PDF files. It only accepts XML files based on the UBL 2.1 standard (Universal Business Language). Your PDF is merely a human-readable visualization of this XML.

Key XML Structure

A compliant XML must contain specific UUIDs and Hash chains. Here is a simplified view of the critical StandardInvoice structure:

invoice.xml
<!-- Standard UBL Invoice Structure -->
<Invoice xmlns="urn:oasis:names:specification:ubl:schema:xsd:Invoice-2">
    <cbc:ProfileID>reporting:1.0</cbc:ProfileID>
    <cbc:ID>INV-2025-001</cbc:ID>
    <cbc:UUID>8e6000cf-1a98-4174-b3e7-4933cc0341e5</cbc:UUID>
    <cbc:IssueDate>2025-01-25</cbc:IssueDate>
    
    <!-- Previous Invoice Hash (Critical for Chain) -->
    <cac:AdditionalDocumentReference>
        <cbc:ID>PIH</cbc:ID>
        <cac:Attachment>
            <cbc:EmbeddedDocumentBinaryObject mimeCode="text/plain">NWZIY2ViNjZm...</cbc:EmbeddedDocumentBinaryObject>
        </cac:Attachment>
    </cac:AdditionalDocumentReference>
    ...
</Invoice>

QR Code Specifications (TLV)

The QR code in Phase 2 is not a URL. It is a Base64 encoded string containing fields in TLV (Tag-Length-Value) format.

Tag Field Requirement
1 Seller Name Mandatory
2 VAT Registration Number Mandatory
3 Timestamp Mandatory
4 Invoice Total (with VAT) Mandatory
5 VAT Total Mandatory
6 Hash of XML Invoice Phase 2 Only
7 ECDSA Signature Phase 2 Only
8 ECDSA Public Key Phase 2 Only

Common Rejection Errors

When integrating, you will likely encounter these errors from the ZATCA Validation SDK or API. Here is how to fix them.

💡 Need a complete troubleshooting guide?

Browse all 15 ZATCA rejection errors with detailed solutions →

BR-KSA-26: Previous Invoice Hash

Error: The previous invoice hash is missing or incorrect.

Fix: You must store the SHA256 hash of the previous invoice and include it in the current invoice's XML. This creates a blockchain-like tamper-proof chain.

BR-KSA-27: QR Code Validation

Error: The QR code does not match the computed values.

Fix: Ensure tags 6, 7, and 8 are correctly generated from the signed hash. Common mistake: encoding the base64 string again instead of the raw bytes.

BR-KSA-03: UUID Format

Error: UUID is not valid.

Fix: Use standard UUID version 4 format (e.g., xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx).

Is your software ready for Phase 2?

Qeemah is the most ZATCA-obsessed accounting platform in Saudi Arabia. We handle the XML, Crypto Stamps, and Reporting for you.

No credit card required • Setup in 5 minutes

Chat with us on WhatsApp