Validate a person's tax status
LiveServed by the v1 API in development with the same checks as production; production opens on the same contract. The capabilities from before v1 keep running in production at the path your account team gives you.
Checks the CURP and RFC against RENAPO and the SAT and returns the person's fiscal profile: registered name, tax address postal code, regimes, RFC status, e.firma and CSD validity, and whether invoices can be issued on their behalf. Asynchronous: you get a receipt with status received now and the result by webhook, usually within a minute.
Needs the fiscal_validations:write scope.
oauth2 fiscal_validations:writeAuthorizationBearer <token>OAuth 2.0 client credentials. Exchange your client_id and client_secret at /oauth/token of the environment for a bearer token valid for one hour. The playground of every operation asks for your own client and keeps it in your browser tab only.
Scope: fiscal_validations:write
Idempotency-Key*stringUnique per operation. Retrying with the same key returns the original result for 24 hours.
length <= 255application/json- body
Send a CURP, an RFC, or both.
external_id*stringYour own id for this person, merchant or record. Echoed back in every response and webhook.
length <= 128curp?stringCURP, 18 characters.
^[A-Z]{4}[0-9]{6}[HM][A-Z]{5}[A-Z0-9][0-9]$rfc?stringRFC, 12 characters (company) or 13 (individual).
^[A-ZÑ&]{3,4}[0-9]{6}[A-Z0-9]{3}$name?stringFull name. Required when you send only an RFC, so we can confirm the RFC belongs to this person.
Accepted
application/json- response
Acknowledgement that heru accepted the validation. Read the full validation with GET or wait for the webhook.
id*string^fv_[0-7][0-9a-hjkmnp-tv-z]{25}$status*"received""received"message*stringcreated_at*stringdate-timecurl -X POST 'https://api.dev.b2b.heru.app/v1/fiscal-validations' \ -H 'Idempotency-Key: try-it-0001' \ -H 'Content-Type: application/json' \ -d '{ "external_id": "FV-2026-004413", "curp": "HEGL900101HDFRRS06"}'{ "id": "fv_01m4ra8vqve0xv4yfe92canf5a", "status": "received", "message": "Request successfully accepted for processing", "created_at": "2026-10-12T15:04:05.115Z"}Get the caller of the tokenGET
Answers which client, organization, company and scopes the access token you send carries. Use it to check your credentials before you build on them. It needs no scope, only a valid token. Responses are never cached.
List fiscal validationsGET
Most recent first. Needs the `fiscal_validations:read` scope.