Get a download link
LiveServed by the v1 API in development with the same checks as production; production opens on the same contract. The capabilities from before v1 keep running in production at the path your account team gives you.
Returns a signed link to the stamped invoice on download.heru.app, valid for 15 minutes. format=xml is the CFDI XML as the SAT stored it, the document with fiscal validity; format=pdf is a printable PDF with the SAT seal and the QR to verify it.
Needs the invoices:download scope.
oauth2 invoices:downloadAuthorizationBearer <token>OAuth 2.0 client credentials. Exchange your client_id and client_secret at /oauth/token of the environment for a bearer token valid for one hour. The playground of every operation asks for your own client and keeps it in your browser tab only.
Scope: invoices:download
id*stringThe invoice id.
^inv_[0-7][0-9a-hjkmnp-tv-z]{25}$format*stringxml or pdf.
"xml""pdf"The link to the file.
application/json- response
url*stringSigned link to the file on download.heru.app. It works for anyone who has it until expires_at, so you can hand it to the worker or the customer. Request a new one after it expires.
uriexpires_at*stringWhen the link stops working. Each operation says how long its links last: 15 minutes for invoices, retention certificates and signed documents, 24 hours for IMSS documents.
date-timecontent_type*string"application/pdf""application/xml"filename*stringSuggested file name, e.g. the folio fiscal and the extension.
curl -X GET 'https://api.dev.b2b.heru.app/v1/invoices/inv_01m4ra8w8mfa8svf5396b2p5e1/download?format=pdf'{ "url": "https://download.heru.app/invoices/inv_01m4ra8w8mfa8svf5396b2p5e1/5829F7E9-4996-450C-BE13-9EE83FD56065.pdf?Expires=1791818348&KeyName=b2b-files&Signature=Hq3sY8pLmN2vKx9wQ7tB4cR6zA1d", "expires_at": "2026-10-12T15:19:08.000Z", "content_type": "application/pdf", "filename": "5829F7E9-4996-450C-BE13-9EE83FD56065.pdf"}Get an invoiceGET
Returns the stamped invoice with its parties, items, totals and, if requested, its cancellation. Needs the `invoices:read` scope.
Issue a retention certificatePOST
Issues the CFDI de retenciones e información de pagos: the certificate you give every month to the merchants and workers you withheld ISR and VAT from. **Who issues it.** Whoever withheld: your company, sealed with the CSD heru holds for it (see [Companies](/companies)), or `issuer.merchant_id` when a merchant withheld. heru never issues it in its own name. **Who receives it.** A worker or merchant you registered (`receiver.worker_id`, `receiver.merchant_id`), one of your companies, or any taxpayer by RFC, name, regime and postal code exactly as the SAT has them. **Platforms (retention_code 26).** Send one month in `period` and the services in `platform.services`. heru builds the complemento de servicios de plataformas tecnológicas and computes `amounts` and `withheld_taxes` with the SAT rules: the ISR rate of the service type and year, the VAT withheld on the VAT transferred, and cash services left out of both bases. Send them too if you want heru to check your own numbers. The [retention certificates guide](/guides/retention-certificates) walks through a merchant and a courier. **Checked before stamping.** Every SAT rule of the CFDI and the complement runs before the PAC sees it. A mistake answers `422` with the field and the value the SAT expects; nothing is stamped. **Synchronous.** heru stamps with the PAC before answering, usually in 2 to 5 seconds, and returns the certificate with its folio fiscal; `retention_certificate.stamped` follows. If the PAC or the SAT do not answer in time you get `503` and nothing is created: retry after `Retry-After` with the same `Idempotency-Key`. For a month of certificates, use a [batch](/guides/batches). **Files.** `GET /retention-certificates/{id}/download` returns a signed link to the XML or the PDF, valid for 15 minutes. Needs the `retention_certificates:write` scope.