Upload a client company's signing certificate and SOL credentials
The same body, the same validation, the same sealing boundary and the same DRAFT outcome as POST /api/v2/certificates -- it is that path, reached with the tenant established by auth.bind_organization_company after verifying the company belongs to the caller's organization. The PKCS#12 and the three passwords cross the signing service binding and reach nothing durable in between. Activation is deliberately NOT available here: promoting the DRAFT sends a real signed factura to SUNAT under the client's RUC, and that is performed with the company credential this organization minted.
The same body, the same validation, the same sealing boundary and the same DRAFT outcome as POST /api/v2/certificates -- it is that path, reached with the tenant established by auth.bind_organization_company after verifying the company belongs to the caller's organization. The PKCS#12 and the three passwords cross the signing service binding and reach nothing durable in between. Activation is deliberately NOT available here: promoting the DRAFT sends a real signed factura to SUNAT under the client's RUC, and that is performed with the company credential this organization minted.
Authorization
bearerAuth Tenant-bound, scoped and expiring Apifact credential. Migrated legacy credentials are accepted only on deprecated v1 writes and tenant-scoped v2 read, poll and download routes. Each operation names the single scope it requires in x-required-scope; the scope array of the security requirement itself is empty because OpenAPI 3.0 requires it to be for a non-oauth2 scheme.
In: header
Path Parameters
uuidHeader Parameters
^[!-~]+$1 <= length <= 200Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/api/v2/organizations/companies/497f6eca-6276-4993-bfeb-53cbbbba6f08/certificate" \ -H "Idempotency-Key: b6a2f0e4-1c3d-4a5b-8e7f-9d0c1b2a3e4f" \ -H "Authorization: Bearer apf_v2_tu_credencial" \ -H "Content-Type: application/json" \ -d '{ "environment": "BETA", "pfxBase64": "MIIKlgIBAzCCClwGCSqGSIb3DQEHAaCCCk0EggpJMIIKRTCCBgYGCSqGSIb3DQEHAaCCBfcEggXzMIIF7zCCBesGCyqGSIb3DQEMCgECoIIE", "pfxPassword": "la-clave-del-pkcs12", "solUser": "MODDATOS", "solPassword": "moddatos" }'{ "schemaVersion": "2.0", "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6", "resourceId": "026d60bb-63a8-407e-bf67-01dcfc6022e6", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "version": 1, "environment": "BETA", "status": "DRAFT", "certificateId": "93038071-4553-48f6-8780-c7262cd9be88", "sha256": "string", "serialNumber": "string", "issuerName": "string", "subjectRuc": "string", "notBefore": "2019-08-24T14:15:22Z", "notAfter": "2019-08-24T14:15:22Z", "currentlyValid": true, "revokedAt": "2019-08-24T14:15:22Z", "validationMethod": "BETA_AUTHENTICATED", "createdAt": "2019-08-24T14:15:22Z", "activatedAt": "2019-08-24T14:15:22Z", "retiredAt": "2019-08-24T14:15:22Z", "activation": { "activationId": "a606ed3b-704a-4227-aa5c-f71d4aee9a1f", "status": "PENDING", "responseCode": "string", "responseMessage": "string", "failureCode": "string", "requestedAt": "2019-08-24T14:15:22Z", "finishedAt": "2019-08-24T14:15:22Z" }, "activationPath": "string", "replay": true}Register a client company under the calling organization POST POST
Creates the fiscal entity a platform will issue for. Requires an ORGANIZATION credential (apf_org_v2_...) carrying companies:manage; a company credential is refused by the token prefix before any lookup happens. The company is created ACTIVE but can sign nothing: it has no certificate, and since migration 000052 the only route to an ACTIVE certificate is a comprobante SUNAT accepted. Every call writes an ops.audit_events row naming the organization, the credential and the RUC, in the same transaction as the company.
Mint an API credential for a client company POST POST
Creates a COMPANY credential, which can issue comprobantes. ADR 0016 point 3 names this a privilege escalation and does not pretend otherwise: the mitigation is that it is recorded. The credential row and its ops.audit_events row are written in one transaction, and a DEFERRABLE constraint trigger on auth.api_credentials refuses at COMMIT to admit a credential for an organization-owned company without one -- so an unaudited mint is not a policy violation, it is a failed transaction. The token is returned exactly once.