Skip to main content
POST
/
organizations
/
{organizationId}
/
fiscal-certificates
Provision a fiscal signing certificate
curl --request POST \
  --url https://api.openfiskal.com/v1/organizations/{organizationId}/fiscal-certificates \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "jurisdiction": "ES-PV-SS",
  "certificate_p12": "aSDinaTvuI8gbWludGxpZnk=",
  "passphrase": "<string>",
  "label": "Gipuzkoa TicketBAI 2026",
  "replace_existing": false
}
'
{
  "object": "<string>",
  "id": "cert_01HXYZ",
  "organization_id": "<string>",
  "jurisdiction": "ES-PV-SS",
  "label": "<string>",
  "status": "active",
  "subject": "CN=Acme S.L., OU=TicketBAI, O=FNMT, C=ES",
  "issuer": "<string>",
  "serial_number": "<string>",
  "valid_from": "2023-11-07T05:31:56Z",
  "valid_until": "2023-11-07T05:31:56Z",
  "fingerprint": "3a:7b:f2:...",
  "created_at": "2023-11-07T05:31:56Z",
  "revoked_at": "2023-11-07T05:31:56Z"
}

Authorizations

​
Authorization
string
header
required

Platform API key sent as Authorization: Bearer ofk_platform_.... Platform integrators also pass OpenFiskal-Organization: org_xxx to act on behalf of a merchant.

Path Parameters

​
organizationId
string
required

Body

application/json
​
jurisdiction
string
required

Jurisdiction this certificate covers. Use ISO 3166-2 subdivision codes for sub-national systems (TicketBAI requires one certificate per province).

Example:

"ES-PV-SS"

​
certificate_p12
string<byte>
required

Base64-encoded PKCS#12 bundle containing the certificate and private key. OpenFiskal stores this encrypted at rest and uses it only for document signing.

​
passphrase
string<password>
required

Passphrase protecting the PKCS#12 bundle

​
label
string

Human-readable label for internal reference

Example:

"Gipuzkoa TicketBAI 2026"

​
replace_existing
boolean
default:false

If true, replaces an existing active certificate for this jurisdiction. The previous certificate is immediately revoked. Use with caution — ensure the new certificate is valid before setting this.

Response

Certificate provisioned

​
object
string
Allowed value: "fiscal_certificate"
​
id
string
Example:

"cert_01HXYZ"

​
organization_id
string
​
jurisdiction
string
Example:

"ES-PV-SS"

​
label
string | null
​
status
enum<string>
Available options:
active,
expired,
revoked
​
subject
string

Certificate subject DN

Example:

"CN=Acme S.L., OU=TicketBAI, O=FNMT, C=ES"

​
issuer
string

Certificate issuer DN

​
serial_number
string
​
valid_from
string<date-time>
​
valid_until
string<date-time>

Renewal reminders are sent at 60, 30, and 7 days before this date. Document submission is blocked after expiry.

​
fingerprint
string

SHA-256 fingerprint of the certificate (hex)

Example:

"3a:7b:f2:..."

​
created_at
string<date-time>
​
revoked_at
string<date-time> | null