ZATCA Phase 2 E-Invoicing ERP Integration: Technical Saudi Guide [2026]

The roll-out of ZATCA Phase 2 (Integration Phase) by the electronic invoicing mandate represents one of the most critical regulatory compliance milestones under the Saudi Vision 2030 digital economic transformation.

Understanding ZATCA Phase 2 (Integration Phase)

Unlike Phase 1 (Generation Phase), which primarily mandated generating QR-code compliant tax invoices without manual paper logs, Phase 2 requires real-time system-to-system integration between your Enterprise Resource Planning (ERP) system and the ZATCA Fatoora platform via RESTful APIs.

Every standard tax invoice (B2B) must undergo real-time clearance before it is legally issued to buyers, while simplified invoices (B2C) must be reported within 24 hours of transaction generation.

Core Technical Requirements: UUID, Cryptographic Stamp & Hash

A compliant Phase 2 invoice XML payload must adhere to strict UBL 2.1 syntax. The three foundational cryptographic artifacts are:

• Universally Unique Identifier (UUID): A 128-bit cryptographic identifier following RFC 4122.
• Cryptographic Stamp: An ECDSA digital signature utilizing a private key issued during onboarding via a Cryptographic Stamp Identifier (CSID).
• Previous Invoice Hash (PIH): A SHA-256 hash connecting the current document to its predecessor, creating an immutable blockchain-like ledger that prevents back-dating or tampering.

ERP Integration Architecture: Oracle, Odoo and Dynamics 365

Depending on your enterprise architecture, the integration can be executed via middleware (such as an iPaaS) or direct native API connectors:

• Odoo ERP: Impleway's localized Saudi module hooks into the account.move workflow, serializing invoice records into compliant XML payloads and handling asynchronous ZATCA API responses within milliseconds.
• Oracle ERP Cloud: Integration via Oracle Integration Cloud (OIC) connecting Financials Payables and Receivables to automated digital certificate management endpoints.
• Microsoft Dynamics 365: Leveraging native electronic messaging framework with Azure Key Vault for hardware security module (HSM) level key protection.

Step-by-Step Onboarding with the Fatoora Portal

The onboarding workflow requires generating a Certificate Signing Request (CSR), exchanging it for a Compliance CSID (CCSID), executing mandatory testing simulations against ZATCA sandbox endpoints, and finally requesting the Production CSID (PCSID) for live transactional clearance.

Common Implementation Pitfalls and Audit Safeguards

Common failures occur when line item VAT rate calculations disagree with invoice-level summaries, or when clock skew between server hardware and official Saudi standard time causes hash validation rejections. Establishing automated error queues and alerts is vital to avoid commercial billing disruptions.

Technical Architecture: UBL 2.1 XML Structure & Cryptographic Hashing

ZATCA Phase 2 (FATOORA integration phase) enforces uncompromising technical mandates for all taxable transactions across the Kingdom of Saudi Arabia. Rather than merely presenting an electronic PDF invoice, every enterprise resource planning system must construct invoices adhering to the Universal Business Language (UBL 2.1) XML standard, specifically complying with the OASIS Tax Invoice standard and Saudi specific Schematron rules. Every invoice payload incorporates mandatory technical elements:

• Universally Unique Identifier (UUID): A 128-bit RFC 4122 version 4 UUID uniquely referencing each transaction across the business ecosystem.
• Canonicalization & SHA-256 Digest: The XML document undergoes canonicalization (C14N) to standardize whitespace, attribute ordering, and namespace declarations before calculating the cryptographic document digest using SHA-256 algorithms.
• Digital Signature (ECDSA): For standard B2B tax invoices, the generated hash is digitally signed using an Elliptic Curve Digital Signature Algorithm (ECDSA) with the secp256k1 or prime256v1 curve and embedded into the UBL XML digital signature block.
• Cryptographic Invoice Hash Chaining: Each new invoice must embed the SHA-256 hash of the preceding invoice generated by the cryptographic stamping unit, forming an unbroken cryptographic blockchain that prevents retrospective tampering or invoice deletion.

Navigating this intricate payload generation requires enterprise-grade middleware capable of validating Schematron syntax prior to transmission. Impleway implements pre-validation schema parsers that verify VAT sub-totals, exempt line-item codes, and tax category tags against ZATCA business rules in memory. Review our proven implementation approaches in our ERP Implementation Services or explore our certified enterprise packages on our Services Overview.

ERP Integration Blueprints: Oracle Cloud, Dynamics 365 & Odoo

Integrating diverse enterprise systems with ZATCA's Fatoora API requires specialized architectural patterns suited to each ERP engine:

• Oracle Fusion Cloud ERP: Impleway configures Oracle Integration Cloud (OIC) orchestrations that monitor Oracle Accounts Receivable (AR) accounting events. When an invoice completes approval, OIC transforms the transaction into compliant UBL 2.1 XML, executes cryptographic signing via a secure serverless microservice, and calls ZATCA clearance endpoints within 800 milliseconds. Explore our specialized solutions on our Oracle ERP Services Page.
• Microsoft Dynamics 365 (F&O / Business Central): Our engineers utilize Azure API Management, Azure Key Vault, and asynchronous message queues to orchestrate cryptographic signing and ZATCA schema validation directly from posted customer ledgers. Discover our capabilities on our Dynamics 365 Services Page.
• Odoo Enterprise ERP: We deploy pre-configured Python integration modules that handle background invoice signing daemons, embed official ZATCA base64-encoded QR codes into receipt layouts, and synchronize clearance responses directly into Odoo accounting journals. Review our offerings on our Odoo ERP Services Page.
• Custom & Legacy ERP Platforms: For proprietary on-premises systems, Impleway builds secure API gateways and middleware microservices that decouple legacy billing databases from external ZATCA compliance requirements. See our Custom Software Development.

CSID Cryptographic Lifecycle: CCSID, PCSID & Automated Key Renewal

Every physical server, cash register, or cloud instance generating invoices in Saudi Arabia represents an Electronic Invoice Generation Solution (EGS) unit and must undergo formal cryptographic onboarding:

• CSR Generation: The enterprise generates a private-public key pair and crafts a Certificate Signing Request (CSR) embedding specific X.509 metadata—including the organization's VAT registration number, organizational unit, location code, and registered solution serial number.
• Compliance CSID (CCSID): Authenticating against ZATCA's developer portal using a one-time password (OTP), the EGS requests a temporary Compliance CSID to execute sandbox compliance validation tests across invoice, credit note, and debit note simulations.
• Production CSID (PCSID): Upon clearing all automated Schematron and business rule simulations without errors, ZATCA grants a Production CSID (PCSID) authorizing live transactional clearance and reporting.
• Automated Key Renewal: Cryptographic certificates expire periodically. Impleway's integration framework features automated certificate monitoring that triggers seamless key renewal 30 days prior to expiration, eliminating compliance disruption risks.

To guarantee ironclad infrastructure security throughout this lifecycle, our architects align all cryptographic key storage with National Cybersecurity Authority controls, utilizing Hardware Security Modules (HSM) or cloud key vaults. Learn more about our infrastructure safeguards in our Cybersecurity Advisory Practice.

Exception Handling, Rejection Codes & Offline POS Resilience

Real-world commercial operations cannot afford billing delays due to network timeouts. ZATCA establishes distinct operational protocols for standard B2B transactions versus B2C retail transactions:

• B2B Invoices (Clearance Mandate): Standard tax invoices require real-time clearance by ZATCA before being legally issued to commercial buyers. If ZATCA's API returns a 500 error or network timeout, the ERP must queue the payload and notify account managers without producing invalid non-cleared documents.
• B2C Simplified Invoices (Reporting Mandate): Point-of-sale retail transactions are stamped locally with cryptographic ECDSA signatures and dynamic QR codes containing ECDSA signatures, timestamp, total amount, and VAT. Retailers issue invoices immediately to consumers and have a 24-hour statutory window to transmit them to ZATCA via reporting APIs.
• Error Handling & Automated Retries: When ZATCA returns rejection codes (such as structural validation failures, duplicate invoice numbers, or cryptographic hash mismatches), Impleway's middleware routes failed payloads into dedicated administrative alert queues with actionable diagnostic error logs.

Whether operating high-throughput retail stores or large industrial enterprises across Riyadh and Jeddah, partnering with a certified technical integrator ensures total compliance peace of mind. Discuss your ZATCA integration roadmap with our senior technical consultants via our Saudi Compliance Desk.

Frequently Asked Questions (FAQs)

Schedule an Enterprise Advisory Consultation