Fac-360The API credentials of this company
Any member may read it, VIEWER included. It carries no secret -- there is no column holding one -- and the public prefix it does carry is already reported for every operation by GET /console/v1/companies/{companyId}/activity, so hiding this list would be a rule with no content. Revoked and expired credentials stay in it.
Any member may read it, VIEWER included. It carries no secret -- there is no column holding one -- and the public prefix it does carry is already reported for every operation by GET /console/v1/companies/{companyId}/activity, so hiding this list would be a rule with no content. Revoked and expired credentials stay in it.
Authorization
consoleSession Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.
In: cookie
Path Parameters
uuidResponse Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/console/v1/companies/497f6eca-6276-4993-bfeb-53cbbbba6f08/credentials" \ -H "Authorization: Bearer apf_v2_tu_credencial"{ "schemaVersion": "console.1", "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6", "companyId": "8bb73d03-06b4-47c7-80c7-59301f770eda", "credentials": [ { "credentialId": "f568fec0-10b6-4b94-9daf-e62c50c9bf3e", "name": "string", "tokenPrefix": "string", "scopes": [ "string" ], "status": "ACTIVE", "expiresAt": "2019-08-24T14:15:22Z", "revokedAt": "2019-08-24T14:15:22Z", "lastUsedAt": "2019-08-24T14:15:22Z", "createdAt": "2019-08-24T14:15:22Z" } ]}Move this company from SUNAT beta to production POST POST
OWNER only, and only with a second factor enrolled -- the alta of a company is ADMIN and above, and this is deliberately stricter. It is ONE-WAY: after it the next comprobante this company issues is a real fiscal fact in the taxpayer's sales ledger, and there is no route back. Everything the company rehearsed in beta keeps its state, its CDR and the environment it was stamped with; a beta document that was created and never sent is CANCELLED here, because its only remaining move was a submission that would now be refused. It refuses while any beta submission is still in flight, and it refuses until the company already holds a production configuration that has been armed -- which means a real certificate whose subject RUC is this company's and a SOL account validated against production. Numbering does not carry over: correlativos are held per environment, so the first production F001 starts where a production F001 should. 404 answers both a company that does not exist and one this session may not act on, indistinguishably.
Mint an API credential POST POST
DEVELOPER and above, which is what ADR 0016 point 7 assigns to that role. The credential can issue comprobantes, so this is the privilege escalation the ADR names and does not pretend otherwise about: the mitigation is that it is recorded. The credential row and its ops.audit_events row are written in one transaction by the SAME function the provisioning API calls, and a DEFERRABLE constraint trigger on auth.api_credentials refuses at COMMIT to admit a credential for an organization-owned company without one -- so an unaudited mint is not a policy violation, it is a failed transaction. THE TOKEN IS IN THE 201 AND NOWHERE ELSE. A scope the caller's own role could not exercise is refused with 403 SCOPE_NOT_GRANTABLE rather than silently dropped.