What is ZATCA Phase 2?
Phase 2, known as the Integration Phase, requires your accounting software to connect directly with the ZATCA Fatoora portal. Unlike Phase 1, where storing a PDF locally was sufficient, Phase 2 mandates that every invoice is digitally signed and cleared (or reported) in real-time or near real-time.
1 Phase 1 (Generation)
- Generate PDF + XML
- Store locally
- Simple QR Code (5 tags)
- No internet required
2 Phase 2 (Integration)
- Clearance (B2B) before sharing
- Reporting (B2C) within 24h
- Complex QR Code (9 tags)
- Cryptographic Stamp (CSID)
The XML Standard (UBL 2.1)
ZATCA does not accept PDF files. It only accepts XML files based on the UBL 2.1 standard (Universal Business Language). Your PDF is merely a human-readable visualization of this XML.
Key XML Structure
A compliant XML must contain specific UUIDs and Hash chains. Here is a simplified view of the critical StandardInvoice structure:
<!-- Standard UBL Invoice Structure -->
<Invoice xmlns="urn:oasis:names:specification:ubl:schema:xsd:Invoice-2">
<cbc:ProfileID>reporting:1.0</cbc:ProfileID>
<cbc:ID>INV-2025-001</cbc:ID>
<cbc:UUID>8e6000cf-1a98-4174-b3e7-4933cc0341e5</cbc:UUID>
<cbc:IssueDate>2025-01-25</cbc:IssueDate>
<!-- Previous Invoice Hash (Critical for Chain) -->
<cac:AdditionalDocumentReference>
<cbc:ID>PIH</cbc:ID>
<cac:Attachment>
<cbc:EmbeddedDocumentBinaryObject mimeCode="text/plain">NWZIY2ViNjZm...</cbc:EmbeddedDocumentBinaryObject>
</cac:Attachment>
</cac:AdditionalDocumentReference>
...
</Invoice> QR Code Specifications (TLV)
The QR code in Phase 2 is not a URL. It is a Base64 encoded string containing fields in TLV (Tag-Length-Value) format.
| Tag | Field | Requirement |
|---|---|---|
| 1 | Seller Name | Mandatory |
| 2 | VAT Registration Number | Mandatory |
| 3 | Timestamp | Mandatory |
| 4 | Invoice Total (with VAT) | Mandatory |
| 5 | VAT Total | Mandatory |
| 6 | Hash of XML Invoice | Phase 2 Only |
| 7 | ECDSA Signature | Phase 2 Only |
| 8 | ECDSA Public Key | Phase 2 Only |
Common Rejection Errors
When integrating, you will likely encounter these errors from the ZATCA Validation SDK or API. Here is how to fix them.
💡 Need a complete troubleshooting guide?
Browse all 15 ZATCA rejection errors with detailed solutions →BR-KSA-26: Previous Invoice Hash
Error: The previous invoice hash is missing or incorrect.
BR-KSA-27: QR Code Validation
Error: The QR code does not match the computed values.
BR-KSA-03: UUID Format
Error: UUID is not valid.
xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx).