Certificates (e.firma / CSD)

The SAT issues two kinds of digital certificate to every taxpayer:

FIEL (e.firma) — the taxpayer's identity certificate, used to sign filings and authorize the CSDs.
Sello (CSD, Certificado de Sello Digital) — used to stamp CFDIs.

This endpoint returns every certificate registered to an RFC, with its serial number, status, type, and validity window. The result comes back synchronously — no credentials of your own required.

Use it to validate a FIEL a customer uploaded: confirm the serial number exists, its status is active, and its type is fiel.

Look up certificates

POST /v1/certificates

{ "tax_id": "XAXX010101000" }

Response (200 OK) — the certificates plus the taxpayer's legal name. One row per certificate:

{
  "tax_id": "XAXX010101000",
  "legal_name": "EMPRESA DEMO SA DE CV",
  "certificates": [
    {
      "id": "9b1f…",
      "serial_number": "00001000000500000123",
      "type": "fiel",
      "status": "active",
      "valid_from": "2025-01-15T18:30:00+00:00",
      "valid_to": "2029-01-15T18:30:00+00:00",
      "cer_available": true
    }
  ]
}

Each result is persisted. cer_url is a direct link to the certificate file (the public X.509 DER); cer_available indicates whether we also keep an archived copy you can pull via the API (see below). The lookup never fails just because a file could not be archived.

Value mapping

`status`	meaning	`type`	meaning
`active`	currently valid (Activo)	`fiel`	e.firma
`revoked`	revoked by SAT (Revocado)	`seal`	CSD (Sello)
`expired`	expired (Caduco)	`unknown`	unrecognized
`unknown`	unrecognized state

valid_from / valid_to are the certificate's UTC validity dates, returned as ISO-8601.

Responses

Every non-2xx response carries a stable reason:

Status	`reason`	What happened	What you should do
`200`	—	Certificates retrieved	Use the `certificates` array
`404`	`not_found`	The RFC has no certificates, or it is invalid	Verify the RFC
`503`	`unavailable`	The CAPTCHA could not be solved	Retry — the same request usually succeeds
`503`	`upstream_error`	The SAT source failed or answered something unexpected	Retry later; if it persists, contact support
`422`	— (Laravel `errors`)	Request failed validation (missing/invalid `tax_id`)	Fix the request body

The dashboard exposes the same lookup as a form at /dashboard/certificates.

Stored certificates (per entity)

GET /v1/certificates/{entity_id} — the certificates for one of your entities, newest first.

GET /v1/certificates/{id}/download — the certificate file as base64. Works whether or not the archived copy is present (it is retrieved on demand when needed):

{ "data": "MIIF…", "mime_type": "application/pkix-cert", "filename": "00001000000500000123.cer", "encoding": "base64" }

The certificate lookup is synchronous — the result comes back in the response, so there is no certificate webhook. Webhooks are only for asynchronous SAT extractions.