--- title: "Accept a tax ID transfer" method: POST path: "/accounts/{account}/nif-transfers/accept" tags: ["Account"] --- # Accept a tax ID transfer `POST /accounts/{account}/nif-transfers/accept` ## Request - Base URL: `https://api.factuarea.com/v1` - URL: `https://api.factuarea.com/v1/accounts/{account}/nif-transfers/accept` - Auth: one of: - HTTP bearer - API key in header `X-API-Key` Accept a tax ID transfer with its `secret`: the tax ID moves to the account in the path. Irreversible. - The body carries only `secret`; requires `Idempotency-Key` (else 422 `idempotency_key_required`). - Plan gates run first, e.g. 402 `additional_nif_plan_required`, 402 `payment_method_required`. - 422 `nif_transfer_invalid` for an unusable secret; 422 `nif_transfer_expired`. Requires the `nif_transfers:write` scope, which `*` does not cover: the API key must list it explicitly. ## Path parameters - `account` string, uuid, required ## Headers - `Idempotency-Key` string, required - `Factuarea-Version` string, date ## Request body - AcceptNifTransferV1Request: Body of the tax ID transfer acceptance. It carries the plaintext `secret` exactly as the issuance response returned it, and nothing else. There is NO `company_id` here and it is not an omission: the tax ID is named by the TRANSFER, not by whoever presents it, so accepting one would allow aiming a transfer at a tax ID it does not cover — the request rejects it explicitly instead of ignoring it in silence. The secret travels from the body to the command and dies there: it is never logged, never recorded in any audit metadata, and never returned in the response, not even in the one that spends it. - `secret` string, required: Plaintext secret of the tax ID transfer, exactly as its issuance response returned it. ## Response `200` - object - `data` NifTransfer, required: A voucher that hands ONE NIF of an account over to another account. Issuing one is already giving away control of that NIF: whoever accepts the secret gets the NIF, and taking it back requires the OTHER party to act. The plaintext secret is NOT part of this representation and cannot be: only its irreversible fingerprint is stored, so no later read can return it. - `id` string, uuid, required: Opaque identifier of the tax ID transfer, a UUID v7. - `object` 'nif_transfer', required: Always `nif_transfer`. - `company_id` string, uuid, required: Opaque identifier (UUID v7) of the NIF this transfer gives away. - `expires_at` string, date-time, required: Expiry instant (ISO 8601). - `status` 'active' | 'expired' | 'revoked' | 'consumed', required: DERIVED state, read against the clock: the table has no status column. `revoked` means the issuing account withdrew it before anyone accepted it. A consumed or revoked transfer and one that never existed are deliberately indistinguishable on acceptance. - `recipient_account_id` string, uuid, nullable, required: Opaque identifier (UUID v7) of the ONLY account that can accept this transfer, or `null` when whoever holds the secret can accept it. - `issued_at` string, date-time, nullable, required: When the transfer was issued (ISO 8601), or `null` when the instant is not recorded. - `consumed_at` string, date-time, nullable, required: When the transfer was accepted (ISO 8601), or `null` while nobody accepted it. It does not say WHICH account accepted it. - `revoked_at` string, date-time, nullable, required: When the issuing account revoked the transfer (ISO 8601), or `null` if it was not revoked. ## Other responses - `400`: `parameter_unknown` with `subcode` `retired_active_profile_header`: the retired `X-Active-Profile` header was sent; the company goes in the path. `parameter_invalid_format` on `Factuarea-Version`: the header is not a `YYYY-MM-DD` date. `unsupported_api_version`: the `Factuarea-Version` date is not a supported version. - `401`: Missing or invalid API key. - `402`: The operation requires a payment that could not be completed: either no payment method is on file (`error.details.payment_setup_url` links to the Billing Portal where it can be set up), the immediate charge was declined by the payment provider, the account lacks the plan or add-on this operation bills against, the annual document limit is reached (`plan_limit_exceeded`, with `error.details.period_end` indicating the end of the period — wait until it has ended or upgrade the plan to continue now), or the account has reached its maximum usage (`storage_quota_exceeded`, raised by upload operations such as signing a delivery note or attaching a file to an expense — contact support before retrying). Nothing was created or modified — resolve the cause and retry the same request. Version note: `error.type` is `payment_required_error` from `Factuarea-Version: 2026-09-01` onwards; earlier versions receive `invalid_request_error` for the three codes that predate that cut (`payment_method_required`, `employee_seat_payment_method_required` and `employee_seat_charge_failed`; every other 402 code, such as `addon_required`, `plan_limit_exceeded` or the additional tax ID codes, is newer and always carries `payment_required_error`). `error.code` is stable across every version. - `403`: The request is authenticated but not allowed: the API key lacks the required scope (`insufficient_scope`), the company does not include the public API (`addon_not_active`), the module is not available with a test key (`module_not_available_in_sandbox`), the credential does not reach the titular company of the receiving account or its holder does not administer it (`forbidden_action`), the effective access of the credential to that company is read-only (`company_read_only`), the plan of the receiving account does not allow additional tax IDs (`additional_nif_not_in_plan`) or its billing is managed by another account (`billing_managed_by_provider`). The plan gate of the transfer scopes runs when the credential is issued, never on this request. - `404`: The requested resource does not exist or belongs to another company. `account_not_found`: the account in the path does not exist or is not the account of the API key. - `409`: The request conflicts with data that already exists or with a request running at the same time. `resource_conflict` with `subcode` `empty_registration_company_not_empty`: the empty company created at sign-up was going to be replaced by the transferred NIF, but it already has business data. Nothing was transferred. `customer_offer_phase_incompatible` with `param` `quantity`: the conditions already acquired for the additional tax ID seat cannot be preserved by this purchase. `details.reason` is `phase_incompatible`. No company is created or activated and no charge is attempted. `customer_offer_operation_in_progress`: an operation for the same concept is still pending. Continue that operation instead of starting another. `customer_offer_legacy_outcome_unknown`: a previous billing operation of the account is still being verified. `details.operation_id` is that operation; read its state before repeating the request. - `422`: Validation failed — e.g. the API key plan limit was reached, or an invoice language outside the allowed catalog (`es`, `en`, `ca`). The `error.param` field identifies which input is invalid, if any. `idempotency_key_reused`: the `Idempotency-Key` was already used with a different body; send a new key or the same body. `invalid_param_format` on `Idempotency-Key`: the key must be 1 to 255 printable ASCII characters. `idempotency_key_required`: this operation requires the `Idempotency-Key` header; the message names the rejected operation. - `429`: Rate limit exceeded. Retry after the duration in `Retry-After`. - `500`: Unexpected server error. --- [API](https://skmtc.dev/factuarea/apis/factuarea-public-api.md) · [All operations](https://skmtc.dev/factuarea/apis/factuarea-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/factuarea/apis/factuarea-public-api/revisions/718e77934422?raw)