Device authentication

Integration APIs authenticate the fiscal device with an HTTP header on each request (no portal JWT).

Headers

  • X-Device-Serial — device serial (same as batch deviceId)
  • X-Device-Api-Key — ksr_… key from portal device create or rotate

Endpoints

  • POST /api/invoices/batch — submit invoice batch (device must be ACTIVE)
  • GET /api/devices/{serial}/certificate — download ZIP ( cert.crt, certificate.pfx, key.key, revmax_csr.pem)
  • GET /api/fiscal-day/config — cached FDMS GetConfig for the authenticated device
  • POST /api/fiscal-day/config/refresh — fetch GetConfig from ZIMRA and update cache
  • GET /api/fiscal-day/status — fiscal day status (GetStatus)
  • POST /api/fiscal-day/open — open day (send {} for auto-open + offline session bundle)
  • POST /api/fiscal-day/close — close day (POS-built counters and signature)

Register a device via POST /api/register or through the merchant portal — both return apiKey once. Rotate a lost key under Devices → device → Rotate API key. Certificate ZIP for offline signing: GET /api/public/devices/{serial}/certificate (no auth) or the authenticated device certificate endpoint.