heru API
One API to check that the people and merchants you work with are in order with the SAT and the IMSS, and to issue their CFDI 4.0 invoices and retention certificates. You send the data you already have; heru deals with the SAT, the certificates and the paperwork.
This is version 1.0.0-draft.10 of the contract, published on 30 October 2026. Every service and every operation carries one of three labels, so you know what you can call today. Every operation labeled Live is served by the v1 API in the development environment, with the same checks as production, so you can build your integration now with your own credentials.
Services
| Service | What it does | Status of its operations |
|---|---|---|
| Authentication | Exchange your client id and secret for a one-hour bearer token, and check what a token can do. | 2 live |
| Fiscal validation | RFC status, tax regimes, registered name and postal code, and e.firma and CSD validity, from a CURP or an RFC. | 3 live |
| Social security (IMSS) | Find a person’s NSS, or start their IMSS registration when they have none. | 3 live |
| Workers | Register a worker, get their consent through the enrollment link, and a compliance view of everyone you work with. | 5 live1 planned |
| e.firma and CSD | Generate a worker’s CSD from their e.firma, and collect signatures on digital contracts. | 1 building2 planned |
| Invoices | CFDI 4.0 invoices from your companies, merchants or workers, with their cancellation and files. | 5 live |
| Retention certificates | CFDI de retenciones for the ISR and VAT you withhold from workers, merchants or any taxpayer. | 5 live |
| Batches | Invoices and retention certificates from a CSV file, for high volumes. | 6 live |
| Point of sale | Merchants, card charges and a single-use self-invoicing QR per sale. | 10 live5 building |
| Branding | The name, colour, help mailbox, footer and logo your merchants show on their invoicing page and emails, inherited from the company when a merchant sets none. | 4 building |
| Reports | Monthly retention totals per worker, and your API usage. | 1 building1 planned |
| Webhooks | Register URLs to receive signed events. One company can hold up to 10 subscriptions, each with its own secret, a delivery log and replays. | 9 building |
Every live operation can be tried from its reference page against the development environment with your own credentials.
Two ways to integrate
Platforms with independent workers. Delivery, ride-hailing, crowdsourcing. You validate each worker before you pay them, decide the withholding, and issue their invoices and retention certificates every week or month. Read Platforms with workers.
Acquirers and point of sale. Card terminals, payment apps, checkouts. Each approved card payment gets a single-use QR; the customer invoices themselves and the merchant does nothing. Read Point of sale.
Where to start
- Getting started: environments, authentication and your first request, in about five minutes.
- Development environment: your credentials, what runs there and the runnable cases.
- Webhooks: most operations finish asynchronously, so you will want these early.
- Retention certificates: the monthly CFDI de retenciones for your merchants and couriers.
- Glossary: CURP, RFC, CSD, e.firma, NSS and the other Mexican tax terms used across these docs.
Spanish
These docs are in English. Your account team works with your product and engineering teams in Spanish, from the first call to the go-live; ask them for a walkthrough of any guide in Spanish.