Skip to main content
POST
Save a SAT credential (CIEC or FIEL)

Authorizations

Authorization
string
header
required

API key: Authorization: Bearer sk_test_... or sk_live_....

Headers

Invoice-Version
string

Pin a dated API release (Stripe-style). Omit to use the current version. An unknown value returns 400 request.invalid_version. Echoed back on every response.

Example:

"2026-07-10"

Invoice-Account
string

Connect: act on behalf of one of your connected accounts (its acct_…/org_… id). Omit to act as your own organization. Not honored on /v1/api_keys.

Example:

"org_2P9connectedacct"

Idempotency-Key
string

Safely retry any POST. A successful (2xx) response is stored for 24h and replayed byte-for-byte for identical retries (the replay adds an idempotent-replayed: true header). A non-2xx releases the key, so you can fix the cause and retry with the same key; pac.stamp_outcome_unknown, pac.auth_failed and download.request_failed are the exceptions and replay like a success. Reusing the key of a stored response with a different body is 409 idempotency.key_reuse; an in-flight duplicate is 409 idempotency.key_processing.

Example:

"a1b2c3d4-e5f6-4789-8abc-1234567890ab"

Path Parameters

id
string
required

The fiscal profile id, e.g. "fp_01H...".

Body

application/json
password
string
required

The taxpayer's SAT password (CIEC / contraseña) for the profile's RFC. Used once to save the credential and never stored by this API, in any form.

Required string length: 1 - 256

Response

Default Response

object
enum<string>
required

Always "sat_credential".

Available options:
sat_credential
fiscal_profile_id
string
required

The fiscal profile this credential belongs to.

rfc
string
required

The RFC the credential authenticates.

status
enum<string>
required

pending: the SAT login check is running. verified: SAT accepted the password at the time of the check. rejected: SAT explicitly refused it. inconclusive: the check could not tell (for example an outage or a CAPTCHA problem). expired: the saved credential has passed expires_at.

Available options:
pending,
verified,
rejected,
inconclusive,
expired
expires_at
string | null
required

When the saved credential expires, ISO-8601 UTC.

remediation
string | null
required

What to do next when status is rejected, inconclusive or expired; null otherwise. Written for humans and agents.

livemode
boolean
required

False for test-mode (simulated) credentials.