Fac-360
Companies

Comprobantes with their state

GET
/console/v1/companies/{companyId}/documents

Authorization

consoleSession
__Host-apf_console<token>

Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.

In: cookie

Path Parameters

companyId*string
Formatuuid

Query Parameters

cursor?string
limit?integer
Range1 <= value <= 100
Default25
state?string
documentType?string

Value in

  • "01"
  • "03"
  • "07"
  • "08"

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/console/v1/companies/497f6eca-6276-4993-bfeb-53cbbbba6f08/documents" \  -H "Authorization: Bearer apf_v2_tu_credencial"
{  "schemaVersion": "console.1",  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",  "documents": [    {      "documentId": "4704590c-004e-410d-adf7-acb7ca0a7052",      "documentType": "01",      "series": "string",      "number": "string",      "state": "string",      "fiscalState": "ISSUED",      "stateVersion": 1,      "environment": "BETA",      "createdAt": "2019-08-24T14:15:22Z",      "updatedAt": "2019-08-24T14:15:22Z"    }  ],  "nextCursor": "string"}

Select a company to operate GET GET

The tenant binding of ADR 0016 point 5. auth.bind_console_company verifies the membership and sets app.tenant_id in ONE statement inside ONE transaction, and mints a binding token derived from a secret the console database role cannot read; every table the console can read carries a restrictive policy that demands it. Setting app.tenant_id by hand therefore widens nothing. A company in another organization and a company that does not exist both answer 404.

One comprobante, with the SUNAT verdict and what it means GET GET

The response code and description are verbatim from the CDR. The severity/standing/action/guidance block is derived from the catalog in @apifact/sunat at read time and is not stored, so it cannot drift; catalogVersion, by contrast, reports the version recorded on the attempt, because claiming yesterday's rejection was judged by today's catalog would forge the audit trail.