Fac-360
Companies

Mint a new signing secret and read it once

DEVELOPER and above. Mints a new signing secret, returns it ONCE and invalidates the previous one. Its own route, and not a flag on the update, so that changing an event list cannot silently break every receiver verifying signatures.

POST
/console/v1/companies/{companyId}/webhooks/subscriptions/{subscriptionId}/secret-rotations

DEVELOPER and above. Mints a new signing secret, returns it ONCE and invalidates the previous one.

Its own route, and not a flag on the update, so that changing an event list cannot silently break every receiver verifying signatures.

Authorization

consoleSession
__Host-apf_console<token>

Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.

In: cookie

Path Parameters

companyId*string
Formatuuid
subscriptionId*string
Formatuuid

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/console/v1/companies/497f6eca-6276-4993-bfeb-53cbbbba6f08/webhooks/subscriptions/497f6eca-6276-4993-bfeb-53cbbbba6f08/secret-rotations" \  -H "Authorization: Bearer apf_v2_tu_credencial"
{  "schemaVersion": "console.1",  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",  "subscriptionId": "d079718b-ff63-45dd-947b-4950c023750f",  "secretVersion": 0,  "secret": "string"}

Stop notifying this destination DELETE DELETE

DEVELOPER and above. A subscription of another company answers 404, because under the tenant the database chose it does not exist.

The SIRE periods this company has opened, newest first GET GET

ADMIN and above, which is the same floor migration 000081 gave sire:read and sire:manage, so a person role and a credential scope cannot disagree about who may close a tax period. It runs on DB_RUNTIME and not on the console connection, for the reason every company-scoped console route does: apifact_console holds SELECT on exactly two tables and cannot read sire.*, while auth.bind_console_company can prove which company this session is entitled to. The book is named rvie or rce and never the SUNAT codes 140000 and 080000. That translation lives in one module, which is where nobody gets it wrong.