Sign the carta manifiesto
curl --request POST \
--url https://api.newinvoice.dev/v1/fiscal_profiles/{id}/manifest \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: multipart/form-data' \
--form cer=@example-file \
--form key=@example-fileimport requests
url = "https://api.newinvoice.dev/v1/fiscal_profiles/{id}/manifest"
files = {
"cer": ("example-file", open("example-file", "rb")),
"key": ("example-file", open("example-file", "rb"))
}
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, files=files, headers=headers)
print(response.text)const form = new FormData();
form.append('cer', '{
"fileName": "example-file"
}');
form.append('key', '{
"fileName": "example-file"
}');
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
options.body = form;
fetch('https://api.newinvoice.dev/v1/fiscal_profiles/{id}/manifest', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.newinvoice.dev/v1/fiscal_profiles/{id}/manifest",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"cer\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"key\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: multipart/form-data"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.newinvoice.dev/v1/fiscal_profiles/{id}/manifest"
payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"cer\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"key\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.newinvoice.dev/v1/fiscal_profiles/{id}/manifest")
.header("Authorization", "Bearer <token>")
.body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"cer\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"key\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.newinvoice.dev/v1/fiscal_profiles/{id}/manifest")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"cer\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"key\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--"
response = http.request(request)
puts response.read_body{
"object": "manifest",
"fiscal_profile_id": "fp_2P9K3sample",
"status": "pending_signature",
"signed_at": "2026-07-10T18:25:43Z",
"already_signed": true,
"codigo": "string",
"mensaje": "string",
"xml_base64": "string",
"pdf_base64": "string"
}{
"type": "https://errors.invoiceapi.mx/auth_unauthorized",
"title": "Authentication required",
"status": 401,
"code": "auth.unauthorized",
"detail": "Missing or invalid API key.",
"remediation": "Send `Authorization: Bearer sk_test_...` (or sk_live_...) with a valid API key.",
"doc_url": "/docs/errors#auth-unauthorized",
"request_id": "req_2P9K3sample"
}{
"type": "https://errors.invoiceapi.mx/resource_not_found",
"title": "Resource not found",
"status": 404,
"code": "resource.not_found",
"detail": "No such id in this org + mode.",
"remediation": "Verify the id and that the key mode (test/live) matches the id.",
"doc_url": "/docs/errors#resource-not_found",
"request_id": "req_2P9K3sample"
}{
"type": "https://errors.invoiceapi.mx/fiscal_profile_in_use",
"title": "Fiscal profile is in use",
"status": 409,
"code": "fiscal_profile.in_use",
"detail": "The profile is referenced by issued invoices.",
"remediation": "Profiles with invoices are retained; rotate the CSD instead of deleting.",
"doc_url": "/docs/errors#fiscal_profile-in_use",
"request_id": "req_2P9K3sample"
}{
"type": "https://errors.invoiceapi.mx/fiscal_profile_invalid_csd",
"title": "Invalid CSD certificate or password",
"status": 422,
"code": "fiscal_profile.invalid_csd",
"detail": "The CSD .cer/.key pair could not be opened.",
"remediation": "Verify cer_base64 is the .cer, key_base64 is the .key, and the password.",
"doc_url": "/docs/errors#fiscal_profile-invalid_csd",
"request_id": "req_2P9K3sample"
}{
"type": "https://errors.invoiceapi.mx/rate_limit_exceeded",
"title": "Rate limit exceeded",
"status": 429,
"code": "rate_limit.exceeded",
"detail": "Too many requests for this key + request class (reads and writes are limited separately).",
"remediation": "Back off and retry after the number of seconds in the Retry-After header; batch work or lower your request rate.",
"doc_url": "/docs/errors#rate_limit-exceeded",
"request_id": "req_2P9K3sample"
}{
"type": "https://errors.invoiceapi.mx/internal_error",
"title": "Internal server error",
"status": 500,
"code": "internal.error",
"detail": "An unexpected error occurred.",
"remediation": "Retry later; contact support with the request_id if it persists.",
"doc_url": "/docs/errors#internal-error",
"request_id": "req_2P9K3sample"
}fiscal_profiles
Sign the carta manifiesto
Sign the carta manifiesto with the FIEL (e.firma) to AUTHORIZE CFDI stamping for this RFC. A fiscal profile is created on hold (status “requires_action”) and cannot stamp invoices until this is signed — do it once per profile. Uses the FIEL stored on the profile, or upload one raw via multipart — curl -F cer=@fiel.cer -F key=@fiel.key -F password=.... (The same FIEL is reused for descarga masiva.)
POST
/
v1
/
fiscal_profiles
/
{id}
/
manifest
Sign the carta manifiesto
curl --request POST \
--url https://api.newinvoice.dev/v1/fiscal_profiles/{id}/manifest \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: multipart/form-data' \
--form cer=@example-file \
--form key=@example-fileimport requests
url = "https://api.newinvoice.dev/v1/fiscal_profiles/{id}/manifest"
files = {
"cer": ("example-file", open("example-file", "rb")),
"key": ("example-file", open("example-file", "rb"))
}
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, files=files, headers=headers)
print(response.text)const form = new FormData();
form.append('cer', '{
"fileName": "example-file"
}');
form.append('key', '{
"fileName": "example-file"
}');
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
options.body = form;
fetch('https://api.newinvoice.dev/v1/fiscal_profiles/{id}/manifest', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.newinvoice.dev/v1/fiscal_profiles/{id}/manifest",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"cer\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"key\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: multipart/form-data"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.newinvoice.dev/v1/fiscal_profiles/{id}/manifest"
payload := strings.NewReader("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"cer\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"key\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.newinvoice.dev/v1/fiscal_profiles/{id}/manifest")
.header("Authorization", "Bearer <token>")
.body("-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"cer\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"key\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.newinvoice.dev/v1/fiscal_profiles/{id}/manifest")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request.body = "-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"cer\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001\r\nContent-Disposition: form-data; name=\"key\"; filename=\"example-file\"\r\nContent-Type: application/octet-stream\r\n\r\n{\r\n \"fileName\": \"example-file\"\r\n}\r\n-----011000010111000001101001--"
response = http.request(request)
puts response.read_body{
"object": "manifest",
"fiscal_profile_id": "fp_2P9K3sample",
"status": "pending_signature",
"signed_at": "2026-07-10T18:25:43Z",
"already_signed": true,
"codigo": "string",
"mensaje": "string",
"xml_base64": "string",
"pdf_base64": "string"
}{
"type": "https://errors.invoiceapi.mx/auth_unauthorized",
"title": "Authentication required",
"status": 401,
"code": "auth.unauthorized",
"detail": "Missing or invalid API key.",
"remediation": "Send `Authorization: Bearer sk_test_...` (or sk_live_...) with a valid API key.",
"doc_url": "/docs/errors#auth-unauthorized",
"request_id": "req_2P9K3sample"
}{
"type": "https://errors.invoiceapi.mx/resource_not_found",
"title": "Resource not found",
"status": 404,
"code": "resource.not_found",
"detail": "No such id in this org + mode.",
"remediation": "Verify the id and that the key mode (test/live) matches the id.",
"doc_url": "/docs/errors#resource-not_found",
"request_id": "req_2P9K3sample"
}{
"type": "https://errors.invoiceapi.mx/fiscal_profile_in_use",
"title": "Fiscal profile is in use",
"status": 409,
"code": "fiscal_profile.in_use",
"detail": "The profile is referenced by issued invoices.",
"remediation": "Profiles with invoices are retained; rotate the CSD instead of deleting.",
"doc_url": "/docs/errors#fiscal_profile-in_use",
"request_id": "req_2P9K3sample"
}{
"type": "https://errors.invoiceapi.mx/fiscal_profile_invalid_csd",
"title": "Invalid CSD certificate or password",
"status": 422,
"code": "fiscal_profile.invalid_csd",
"detail": "The CSD .cer/.key pair could not be opened.",
"remediation": "Verify cer_base64 is the .cer, key_base64 is the .key, and the password.",
"doc_url": "/docs/errors#fiscal_profile-invalid_csd",
"request_id": "req_2P9K3sample"
}{
"type": "https://errors.invoiceapi.mx/rate_limit_exceeded",
"title": "Rate limit exceeded",
"status": 429,
"code": "rate_limit.exceeded",
"detail": "Too many requests for this key + request class (reads and writes are limited separately).",
"remediation": "Back off and retry after the number of seconds in the Retry-After header; batch work or lower your request rate.",
"doc_url": "/docs/errors#rate_limit-exceeded",
"request_id": "req_2P9K3sample"
}{
"type": "https://errors.invoiceapi.mx/internal_error",
"title": "Internal server error",
"status": 500,
"code": "internal.error",
"detail": "An unexpected error occurred.",
"remediation": "Retry later; contact support with the request_id if it persists.",
"doc_url": "/docs/errors#internal-error",
"request_id": "req_2P9K3sample"
}Authorizations
API key: Authorization: Bearer sk_test_... or sk_live_....
Headers
Pin a dated API release (Stripe-style). Omit to use the current version. An unknown value returns 400 request.invalid_version. Echoed back on every response.
Example:
"2026-07-10"
Connect: act on behalf of one of your connected accounts (its acct_…/org_… id). Omit to act as your own organization. Not honored on /v1/api_keys.
Example:
"org_2P9connectedacct"
Safely retry any POST. The first response is stored for 24h and replayed byte-for-byte for identical retries (the replay adds an idempotent-replayed: true header). Reusing the key with a different body is 409 idempotency.key_reuse; an in-flight duplicate is 409 idempotency.key_processing. This makes retrying a 502/429 safe — no duplicate stamp.
Example:
"a1b2c3d4-e5f6-4789-8abc-1234567890ab"
Path Parameters
Fiscal-profile id, e.g. "fp_2P9K3sample".
Minimum string length:
1Body
multipart/form-dataapplication/json
Response
Default Response
Always "manifest".
Available options:
manifest The fiscal profile this manifiesto belongs to.
Resulting carta-manifiesto signing state.
Available options:
pending_signature, signed When the manifiesto was signed (ISO-8601 UTC), or null.
True when the service reported the manifiesto was already signed (no re-sign).
Raw PAC/SAT response code for the signing operation.
Raw PAC/SAT response message.
Signed carta-manifiesto XML, base64 (empty when the service reports it was already signed).
Signed carta-manifiesto PDF, base64 (empty when not returned).