Overview
Every VAT-registered business in Saudi Arabia has to comply with ZATCA's e-invoicing rules — Phase 1 for printable/PDF invoices with a QR stamp, Phase 2 for signed UBL documents submitted live to the tax authority. This add-on handles all of it: generating the Certificate Signing Request, uploading CSIDs, signing invoices, stamping QR codes, and submitting each invoice with status tracking.
It runs entirely on your own server — private keys never leave your infrastructure.
Activation
- 1Open Dashboard → Add-ons and find ZATCA.
- 2Click Activate. The add-on appears under Add-ons → ZATCA in your sidebar.
- 3Open ZATCA. If you have multiple locations, pick the one you want to configure — each location has its own certificate.
- 4The page has three tabs: Settings, Onboarding, Reporting. Work through them in order.
Business settings
The Settings tab captures everything ZATCA needs to know about the legal entity behind this location.
- Business name in Arabic and English.
- VAT number (15 digits) and Commercial Registration Number (CRN).
- Full street address: street, city, district, postal code, building number, additional number.
- Environment toggle: Sandbox for testing, Production for live invoices.
Prefill from the location
If you've already filled the location address under Settings → Locations, use Prefill from Location to pull it in. If this is your second branch using the same entity, Copy from Location clones another location's ZATCA config.
Certificate onboarding
ZATCA uses a two-stage certificate model — first a Compliance CSID for testing, then a Production CSID for live submissions. The add-on walks you through the whole handshake.
- 1Generate CSR — Momentfy creates a Certificate Signing Request tied to your VAT number and CRN.
- 2Compliance CSID — paste the OTP from the ZATCA Fatoora portal. Momentfy exchanges it for a compliance certificate.
- 3Compliance Check — Momentfy sends a few sample invoices to ZATCA's sandbox. A green Completed badge means the pipeline works end-to-end.
- 4Production CSID — after compliance passes, upgrade to a production certificate. From this moment your invoices are live.
Certificate expiry
Certificates expire. The Onboarding tab shows the expiration date; rotate before it hits zero or submissions start failing.
Reporting & invoices
Once certificates are in place, every sale auto-generates a ZATCA invoice document. The Reporting tab is the control panel.
- Stat cards: Pending, Accepted, Rejected, Warning, Total.
- Report Now pushes all currently-pending invoices to ZATCA in one batch.
- View Invoices opens the full invoice list — search, filter by status, open any invoice for its UUID, ICV, submission status, and error/warning details.
- Inline actions per row: Regenerate & Report, Retry Report — useful when a single invoice fails.
Retries & errors
A small share of invoices will get Rejected or land in Warning state — the error is attached to the invoice detail. Common causes: a client VAT number typo, an address missing a required field, or a transient network error on ZATCA's side.
- Transient network errors retry automatically via an hourly cron.
- Hard rejections (data issues) stay pending until you fix the underlying sale and click Regenerate & Report.
- Every attempt is kept on the invoice record, so there's always an audit trail.
Tips
- Always start in Sandbox. A failed compliance check is free there; a failed production invoice is a corrected sale.
- Rotate certificates well before expiry — set a calendar reminder one month ahead.
- Run Report Now at end of day — the hourly cron handles it passively, but a manual push catches anything stuck.