Fac-360List this tenant's certificate versions with their state and validity
Returns every enrolled version of the authenticated tenant, newest first, with its status (DRAFT, ACTIVE or RETIRED), the certificate's identity and validity window, and currentlyValid, which answers whether the version could sign right now. Object keys and secret references are deliberately absent: they are the internal storage layout of the signing boundary and there is nothing a caller can do with them.
Returns every enrolled version of the authenticated tenant, newest first, with its status (DRAFT, ACTIVE or RETIRED), the certificate's identity and validity window, and currentlyValid, which answers whether the version could sign right now. Object keys and secret references are deliberately absent: they are the internal storage layout of the signing boundary and there is nothing a caller can do with them.
Authorization
bearerAuth Tenant-bound, scoped and expiring Apifact credential. Migrated legacy credentials are accepted only on deprecated v1 writes and tenant-scoped v2 read, poll and download routes. Each operation names the single scope it requires in x-required-scope; the scope array of the security requirement itself is empty because OpenAPI 3.0 requires it to be for a non-oauth2 scheme.
In: header
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/api/v2/certificates" \ -H "Authorization: Bearer apf_v2_tu_credencial"{ "schemaVersion": "2.0", "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6", "certificates": [ { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "version": 1, "environment": "BETA", "status": "DRAFT", "certificateId": "93038071-4553-48f6-8780-c7262cd9be88", "sha256": "string", "serialNumber": "string", "issuerName": "string", "subjectRuc": "string", "notBefore": "2019-08-24T14:15:22Z", "notAfter": "2019-08-24T14:15:22Z", "currentlyValid": true, "revokedAt": "2019-08-24T14:15:22Z", "validationMethod": "BETA_AUTHENTICATED", "createdAt": "2019-08-24T14:15:22Z", "activatedAt": "2019-08-24T14:15:22Z", "retiredAt": "2019-08-24T14:15:22Z", "activation": { "activationId": "a606ed3b-704a-4227-aa5c-f71d4aee9a1f", "status": "PENDING", "responseCode": "string", "responseMessage": "string", "failureCode": "string", "requestedAt": "2019-08-24T14:15:22Z", "finishedAt": "2019-08-24T14:15:22Z" } } ]}Generate a throwaway BETA certificate for this company and enrol it POST POST
The first thing an integration needs is a certificate, and in beta that certificate is a self-signed file the integrator produces with openssl -- a step that teaches nothing and where onboarding stalls. This generates one for you: a 2048-bit key whose subject is THIS COMPANY'S RUC, valid for two years, marked on the certificate itself as not fiscally valid, and enrolled through exactly the same path as an upload, with the same guards, the same sealing and the same DRAFT version. You still supply the SOL credentials, because SUNAT's test user is SUNAT's convention and not something this API is entitled to assume on your behalf. The PFX and its generated password are returned in this response and nowhere else -- keep them, they are the file you would have made yourself. BETA ONLY: it is refused with 409 for a company that issues against production, where a certificate this platform minted for itself proves nothing about who controls the RUC. Idempotency-Key behaves as it does on the upload route: a replay returns the first certificate rather than minting a second.
Enrol a signing certificate and its SOL credentials as a DRAFT version POST POST
Uploads the four secrets a Peruvian issuer needs: the PKCS#12 certificate (base64), its password, and the SOL user and password of the SUNAT secondary user. All four together, because a certificate signs the XML and the SOL credentials authenticate sendBill: one without the other cannot submit anything. The upload is validated BEFORE it is stored — the PFX must open with the supplied password, the certificate subject RUC must be this company's RUC, the validity window must cover now, and the declared environment must be the one the company is enrolled for — and only then sealed. The new version is created in DRAFT and signs NOTHING until POST /api/v2/certificates/{id}/activation. The certificate and the passwords are never stored in plaintext, never logged and never returned; only the sealed envelopes reach storage, and only their digests reach the database. A repeated Idempotency-Key answers 200 with replay=true and the version the first call produced, without re-sealing anything; the same key with a different certificate is a 409.