ZATCA Invoice Rejected?
Fix It Here.
Find your exact error code below, understand why it happened, and get the solution in seconds. This guide covers the 15 most common ZATCA Phase 2 rejection errors based on real integration data.
Invalid Invoice Hash
❌ Invoice hash does not match the computed hash value
API Response: 400 Bad Request | Error Code: INVALID_INVOICE_HASH
🔍 Why this happens:
The SHA-256 hash in the UBLExtensions doesn't match the actual invoice content. This happens when the invoice is modified after signing.
✅ Solution:
Regenerate the invoice hash after ALL fields are finalized. The hash must be computed on the canonicalized XML (C14N) before signing. Never modify the invoice after hashing.
Invalid QR Code Structure
❌ QR code does not contain all required TLV fields
API Response: 400 Bad Request | Error Code: INVALID_QR_STRUCTURE
🔍 Why this happens:
Phase 2 requires 9 TLV tags in the QR code (Tags 1-9). Phase 1 only required 5 tags. Many systems are still generating Phase 1 QR codes.
✅ Solution:
Ensure your QR code includes all 9 tags: Seller Name, VAT Number, Timestamp, Invoice Total, VAT Total, Invoice Hash, ECDSA Signature, Public Key, and Certificate Signature.
Missing Seller VAT Number
❌ Seller VAT registration number is required
API Response: 400 Bad Request | Error Code: MISSING_SELLER_VAT
🔍 Why this happens:
The AccountingSupplierParty section is missing the PartyTaxScheme/CompanyID element or it's empty.
✅ Solution:
Add the 15-digit VAT number in cac:AccountingSupplierParty > cac:Party > cac:PartyTaxScheme > cbc:CompanyID. Format: 3XXXXXXXXXX00003
Invalid VAT Number Format
❌ VAT number does not match ZATCA format requirements
API Response: 400 Bad Request | Error Code: INVALID_VAT_FORMAT
🔍 Why this happens:
Saudi VAT numbers must be exactly 15 digits, starting with '3' and ending with '00003'.
✅ Solution:
Verify the VAT number format: 3XXXXXXXXXX00003. First digit must be 3, last 5 digits must be 00003. The middle 10 digits are your unique identifier.
Invalid Invoice Type Code
❌ Invoice type code does not match allowed values
API Response: 400 Bad Request | Error Code: INVALID_INVOICE_TYPE
🔍 Why this happens:
Using incorrect InvoiceTypeCode. ZATCA only accepts specific codes for different invoice types.
✅ Solution:
Use correct codes: 388 (Standard Invoice), 381 (Credit Note), 383 (Debit Note). For B2C simplified invoices, the subtype must also be specified in the Name element.
CSID Certificate Expired
❌ Cryptographic stamp certificate has expired
API Response: 401 Unauthorized | Error Code: CERTIFICATE_EXPIRED
🔍 Why this happens:
Your CSID certificate has a validity period (typically 1 year). Once expired, all invoices will be rejected.
✅ Solution:
Renew your CSID through the Fatoora portal before expiration. Generate a new CSR and complete the renewal process. Qeemah monitors certificate expiry and alerts you 30 days in advance.
Missing Invoice Issue Date
❌ Invoice issue date (cbc:IssueDate) is required
API Response: 400 Bad Request | Error Code: MISSING_ISSUE_DATE
🔍 Why this happens:
The cbc:IssueDate element is missing or empty in the Invoice root element.
✅ Solution:
Add IssueDate in YYYY-MM-DD format. Example: <cbc:IssueDate>2026-01-08</cbc:IssueDate>. Must be a valid calendar date.
Missing Invoice Issue Time
❌ Invoice issue time (cbc:IssueTime) is required
API Response: 400 Bad Request | Error Code: MISSING_ISSUE_TIME
🔍 Why this happens:
Phase 2 requires both date AND time. Many Phase 1 systems don't include the time element.
✅ Solution:
Add IssueTime in HH:MM:SS format with timezone. Example: <cbc:IssueTime>14:30:00</cbc:IssueTime>. Use 24-hour format.
Invalid Digital Signature
❌ Digital signature verification failed
API Response: 400 Bad Request | Error Code: INVALID_SIGNATURE
🔍 Why this happens:
The ECDSA signature doesn't match the signed content, or the signature was created with the wrong private key.
✅ Solution:
Ensure you're signing the correct canonicalized XML content with the private key that matches your CSID certificate. Use secp256k1 curve for ECDSA.
Previous Invoice Hash Mismatch (PIH)
❌ Previous invoice hash does not match chain
API Response: 400 Bad Request | Error Code: PIH_MISMATCH
🔍 Why this happens:
The PIH (Previous Invoice Hash) must equal the hash of the previously submitted invoice. This creates a tamper-proof chain.
✅ Solution:
Store the hash of each submitted invoice. Use that stored hash as the PIH for the next invoice. For the first invoice, use a zero hash (64 zeros).
Incorrect VAT Category Code
❌ VAT category code does not match the tax percentage
API Response: 400 Bad Request | Error Code: VAT_CATEGORY_MISMATCH
🔍 Why this happens:
Using 'S' (Standard) category but specifying 0% VAT, or using 'Z' (Zero-rated) but specifying 15% VAT.
✅ Solution:
Match category codes with rates: S (Standard) = 15%, Z (Zero-rated) = 0%, E (Exempt) = 0%. Each line item must have consistent category and rate.
Missing Arabic Language Fields
❌ Arabic language required for visual invoice
API Response: 400 Bad Request | Error Code: MISSING_ARABIC_LANGUAGE
🔍 Why this happens:
Visual invoices (PDF/printed) must include Arabic text for seller name, item descriptions, and addresses.
✅ Solution:
Printed invoices must be bilingual or Arabic-only. XML can include both Arabic and English names. Use proper UTF-8 encoding for Arabic characters.
B2B Clearance Timeout
❌ Invoice issued before clearance approval
API Response: 303 See Other | Warning Code: PREMATURE_ISSUANCE
🔍 Why this happens:
Standard (B2B) invoices must receive clearance from ZATCA BEFORE being issued to the customer. You issued the invoice before getting approval.
✅ Solution:
Wait for the 202 Accepted response with ZATCA's cryptographic stamp before giving the invoice to your customer. This is a synchronous process for B2B.
Duplicate Invoice Number
❌ Invoice with this ID already exists
API Response: 409 Conflict | Error Code: DUPLICATE_INVOICE_ID
🔍 Why this happens:
You've already submitted an invoice with this exact Invoice ID (cbc:ID) for this seller.
✅ Solution:
Each invoice must have a unique ID within your organization. Use sequential numbering or UUIDs. If resubmitting a corrected invoice, use a credit note instead.
B2C Reporting Deadline Exceeded
❌ Simplified invoice reported after 24-hour deadline
API Response: 400 Bad Request | Error Code: LATE_REPORTING
🔍 Why this happens:
B2C (simplified) invoices must be reported to ZATCA within 24 hours of issuance. This deadline was missed.
✅ Solution:
Implement automatic reporting immediately after invoice generation. Qeemah reports invoices in real-time (<2 seconds after creation) to prevent this error.
No matching errors found
Try a different search term or browse all errors above
Never See These Errors Again
Qeemah validates 100+ BR-KSA rules using ZATCA's official SDK before every submission. We catch errors before they happen. Zero rejected invoices since launch.
Ready to eliminate ZATCA errors?
Join hundreds of Saudi businesses with zero rejected invoices. Start your free trial today.