Fac-360
Companies

Stream one artifact

The bytes come from apps/artifact-worker, which re-verifies the SHA-256 and the byte size of what it reads before any of it reaches the caller. The object key never leaves the server. Use versions/{representationId} as the kind to fetch a specific PDF render.

GET
/console/v1/companies/{companyId}/documents/{documentId}/artifacts/{kind}

The bytes come from apps/artifact-worker, which re-verifies the SHA-256 and the byte size of what it reads before any of it reaches the caller. The object key never leaves the server. Use versions/{representationId} as the kind to fetch a specific PDF render.

Authorization

consoleSession
__Host-apf_console<token>

Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.

In: cookie

Path Parameters

companyId*string
Formatuuid
documentId*string
Formatuuid
kind*string

A public artifact kind (signed-xml, submission-zip, cdr-zip, cdr-xml, pdf-a4, pdf-ticket, qr-png), or versions/{representationId} for a specific PDF render.

Response Body

application/octet-stream

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/console/v1/companies/497f6eca-6276-4993-bfeb-53cbbbba6f08/documents/497f6eca-6276-4993-bfeb-53cbbbba6f08/artifacts/string" \  -H "Authorization: Bearer apf_v2_tu_credencial"
Empty

Everything the platform produced for one comprobante GET GET

Previous Page

Move this company from SUNAT beta to production POST POST

OWNER only, and only with a second factor enrolled -- the alta of a company is ADMIN and above, and this is deliberately stricter. It is ONE-WAY: after it the next comprobante this company issues is a real fiscal fact in the taxpayer's sales ledger, and there is no route back. Everything the company rehearsed in beta keeps its state, its CDR and the environment it was stamped with; a beta document that was created and never sent is CANCELLED here, because its only remaining move was a submission that would now be refused. It refuses while any beta submission is still in flight, and it refuses until the company already holds a production configuration that has been armed -- which means a real certificate whose subject RUC is this company's and a SOL account validated against production. Numbering does not carry over: correlativos are held per environment, so the first production F001 starts where a production F001 should. 404 answers both a company that does not exist and one this session may not act on, indistinguishably.