Move a client company from SUNAT beta to production
ONE-WAY. After it the next comprobante this company issues is a real fiscal fact in the taxpayer's sales ledger, and there is no route back. It refuses until the company already holds a production configuration that has been ARMED -- a real certificate whose subject RUC is this company's, and a SOL account validated against production -- so promotion is never the step that discovers the taxpayer has no usable certificate. It also refuses while any beta submission is still in flight. Everything rehearsed in beta keeps its state, its CDR and the environment it was stamped with; a beta document created and never sent is CANCELLED in the same transaction, because its only remaining move was a submission that would now be refused. Correlativos are held per environment, so production numbering does not continue a rehearsal. The act and its audit row are written together, exactly as the alta is. 404 answers both a company that does not exist and one outside this organization, indistinguishably.
ONE-WAY. After it the next comprobante this company issues is a real fiscal fact in the taxpayer's sales ledger, and there is no route back. It refuses until the company already holds a production configuration that has been ARMED -- a real certificate whose subject RUC is this company's, and a SOL account validated against production -- so promotion is never the step that discovers the taxpayer has no usable certificate. It also refuses while any beta submission is still in flight. Everything rehearsed in beta keeps its state, its CDR and the environment it was stamped with; a beta document created and never sent is CANCELLED in the same transaction, because its only remaining move was a submission that would now be refused. Correlativos are held per environment, so production numbering does not continue a rehearsal. The act and its audit row are written together, exactly as the alta is. 404 answers both a company that does not exist and one outside this organization, indistinguishably.
Authorization
bearerAuth Tenant-bound, scoped and expiring Apifact credential. Migrated legacy credentials are accepted only on deprecated v1 writes and tenant-scoped v2 read, poll and download routes. Each operation names the single scope it requires in x-required-scope; the scope array of the security requirement itself is empty because OpenAPI 3.0 requires it to be for a non-oauth2 scheme.
In: header
Path Parameters
uuidHeader Parameters
^[!-~]+$1 <= length <= 200Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/api/v2/organizations/companies/497f6eca-6276-4993-bfeb-53cbbbba6f08/promotion" \ -H "Idempotency-Key: b6a2f0e4-1c3d-4a5b-8e7f-9d0c1b2a3e4f" \ -H "Authorization: Bearer apf_v2_tu_credencial"{ "schemaVersion": "2.0", "requestId": "0f6c1e5a-9b2d-4c73-9f18-3a5b7c9d1e20", "companyId": "6f1a2b3c-4d5e-4f60-8a91-2b3c4d5e6f70", "sunatEnvironment": "PRODUCTION", "cancelledDocuments": 3, "promotedAt": "2026-08-18T14:22:05.881Z"}Mint an API credential for a client company POST POST
Creates a COMPANY credential, which can issue comprobantes. ADR 0016 point 3 names this a privilege escalation and does not pretend otherwise: the mitigation is that it is recorded. The credential row and its ops.audit_events row are written in one transaction, and a DEFERRABLE constraint trigger on auth.api_credentials refuses at COMMIT to admit a credential for an organization-owned company without one -- so an unaudited mint is not a policy violation, it is a failed transaction. The token is returned exactly once.
Consolidated consumption across every company in the organization GET GET
A read, and only a read. ADR 0016 point 6 keeps the quota holder on the company: a platform with fifty clients has fifty subscriptions and each taxpayer pays its own. usage.consume_quota is untouched. Each company is reported against its own plan period, so a mixed portfolio of DAY and MONTH plans is not flattened onto a window this route picked.