The ZATCA XML Standard

Mandatory UBL Extensions

ZATCA adds custom extensions to the standard UBL 2.1 schema to handle cryptographic signatures and QR codes. The UBLExtensions block must contain:

• Digital Signature: XAdES-EPES compliant signature.
• QR Code: TLV encoded and Base64 formatted.
• Certificate: The Public Key used for signing.

The Hash Chain (PIH)

Every XML must reference the SHA-256 hash of the previous invoice issued by the same device. This ensures data integrity and prevents deletions.

<cac:AdditionalDocumentReference>
  <cbc:ID>PIH</cbc:ID>
  <cac:Attachment>
    <cbc:EmbeddedDocumentBinaryObject mimeCode="text/plain">
      [SHA-256 Hash of Previous XML]
    </cbc:EmbeddedDocumentBinaryObject>
  </cac:Attachment>
</cac:AdditionalDocumentReference>

Common Pitfalls

1. Encoding: XML must be UTF-8 without BOM.
2. Rounding: Line items must be rounded to 2 decimal places before summing.
3. UUID: Must be a valid Version 4 UUID.