Why Phase 2 feels complicated
Phase 1 asked one thing of you: generate a proper e-invoice and put a QR code on it. Phase 2 asks your software to have a conversation with ZATCA — submitting invoices, receiving clearance, and proving nothing was altered afterwards. Once you separate the moving parts, it stops being mysterious.
The five building blocks
1. UBL 2.1 XML
Universal Business Language 2.1 is the international standard for electronic invoices. ZATCA requires invoices to be generated as UBL 2.1 XML documents carrying your VAT details, line items, totals, tax breakdown and payment terms. Any compliant system produces this natively — not by exporting a spreadsheet.
2. TLV QR code
The QR on a Saudi e-invoice encodes five TLV (Tag-Length-Value) fields: seller name, VAT registration number, invoice timestamp, invoice total and VAT total. Phase 2 invoices extend that with additional tags ZATCA defines. Scanning the code with the ZATCA app should always match the invoice itself.
3. Cryptographic stamp
After your e-invoice generation solution (EGS) is registered, ZATCA issues device registration identifiers and certificates. Each invoice is signed with that identity — so anyone can verify it came from your business and has not been modified.
4. Invoice hashing (the chain)
Every invoice embeds the hash of the previous invoice from the same device. Change invoice #100 and the hash on #101 no longer matches — tampering becomes mathematically obvious. This is what "cryptographic chaining" means in ZATCA documentation.
5. Clearance vs reporting
| Clearance (B2B) | Reporting (B2C) | |
|---|---|---|
| When | Before you issue the invoice | After you issue the invoice (within the permitted window) |
| Flow | Submit → ZATCA validates → approval or rejection → issue | Issue → batch submit → ZATCA acknowledges |
| Typical use | Invoices to VAT-registered businesses | Invoices to consumers |
EGS device onboarding, step by step
- Obtain your VAT credentials and secure your API access with ZATCA.
- Register your EGS (the software environment) and receive a device registration ID.
- Complete the compliance checks ZATCA runs against your first submissions.
- Receive your cryptographic certificates and start clearing in production.
- Monitor compliance statuses continuously — rejections must be fixed and resubmitted.
This is precisely the workflow inside DMIndex Software's EGS Device Onboarding (Phase 2) screen, with a Simulation Test Suite for dry runs and an API Integration Logs tab that shows every submission, response and error in plain language.
How to test before production
Never learn about compliance errors on a live customer invoice. Use the ZATCA sandbox with representative documents — standard invoice, simplified invoice, credit note, debit note, refund — and confirm each returns the expected compliance report. DMIndex ships that test suite in the product, so validation is a checkbox, not a project.
What breaks most integrations
- Missing or inconsistent VAT numbers between seller and buyer.
- Invoice totals that do not equal line items plus tax (rounding drift).
- Hash chains broken by manual edits or cloned company codes.
- Certificates expiring unnoticed because nobody watches the logs.
- Credit notes issued without a valid reference to the original invoice.
Next step
If you are preparing for Phase 2 — or you are failing clearance calls today — explore DMIndex Software or message us on WhatsApp. We will run your documents through the simulation suite and show you exactly what ZATCA sees.