--- title: "Issue a tax ID transfer" method: POST path: "/accounts/{account}/nif-transfers" tags: ["Account"] --- # Issue a tax ID transfer `POST /accounts/{account}/nif-transfers` ## Request - Base URL: `https://api.factuarea.com/v1` - URL: `https://api.factuarea.com/v1/accounts/{account}/nif-transfers` - Auth: one of: - HTTP bearer - API key in header `X-API-Key` Issue a tax ID transfer over ONE tax ID of your account (`company_id`); returns 201 with its plaintext `secret`. - The secret is shown once and never stored (`null` on replay); requires `Idempotency-Key`. - Optional `recipient_account_id` restricts who can accept; `expires_at` defaults to 24 hours (max 7 days). - 403 `forbidden_action`; 404 `profile_not_found`. Requires the `nif_transfers:write` scope, which `*` does not cover: the API key must list it explicitly. ## Path parameters - `account` string, uuid, required ## Headers - `Idempotency-Key` string, required - `Factuarea-Version` string, date ## Request body - CreateNifTransferV1Request: Body of the tax ID transfer issuance. `company_id` is the opaque identifier (UUID v7) of the tax ID of your account that this transfer gives away; it must be within your credential scope and cannot be the owner company of the account. `recipient_account_id` is OPTIONAL and names the only account that will be able to accept the transfer. `expires_at` is OPTIONAL and is a REQUEST, not a command: pass an ISO 8601 instant in the future and within the product ceiling, or omit it and the product default applies. Nothing else is accepted — the issuing account and the acting person come from the authenticated credential, never from the body, because issuing a transfer is giving away control of a tax ID and the giver is always the account that holds it. - `company_id` string, uuid, required: Public identifier (UUID v7) of the company of your account that this transfer gives away. It cannot be the owner company of the account. - `expires_at` string, nullable: REQUESTED expiry of the tax ID transfer (ISO 8601). Optional: without it the default period (24 hours) applies, and the product enforces the ceiling (7 days). - `recipient_account_id` string, uuid, nullable: Public identifier (UUID v7) of the ONLY account that will be able to accept this transfer. Optional: without it, whoever holds the secret can accept it. ## Response `201` - object - `data` NifTransferWithSecret, required: The issuance response of a tax ID transfer: the fields of `NifTransfer` PLUS the plaintext `secret`. This is the ONLY representation that carries it, and the only time it is ever returned — it is not stored in the clear, not even in the idempotency cache, so an idempotent replay of the issuance returns `secret: null`. If it is lost, revoke the transfer and issue another one. - `id` string, uuid, required: Opaque identifier of the tax ID transfer, a UUID v7. - `object` 'nif_transfer', required: Always `nif_transfer`. - `company_id` string, uuid, required: Opaque identifier (UUID v7) of the NIF this transfer gives away. - `expires_at` string, date-time, required: Expiry instant (ISO 8601). - `status` 'active' | 'expired' | 'revoked' | 'consumed', required: Derived state against the clock. - `recipient_account_id` string, uuid, nullable, required: Opaque identifier (UUID v7) of the ONLY account that can accept this transfer, or `null` when whoever holds the secret can accept it. - `issued_at` string, date-time, nullable, required: When the transfer was issued (ISO 8601), or `null` when the instant is not recorded. - `consumed_at` string, date-time, nullable, required: When the transfer was accepted (ISO 8601), or `null` while nobody accepted it. It does not say WHICH account accepted it. - `revoked_at` string, date-time, nullable, required: When the issuing account revoked the transfer (ISO 8601), or `null` if it was not revoked. - `secret` string, nullable, required: The plaintext secret, returned ONCE and never again. Treat it as a credential: anyone holding it can take the NIF (or only the recipient account, when one is set). `null` only in an idempotent replay of the issuance, because the secret is never stored. ## Other responses - `400`: `parameter_unknown` with `subcode` `retired_active_profile_header`: the retired `X-Active-Profile` header was sent; the company goes in the path. `parameter_invalid_format` on `Factuarea-Version`: the header is not a `YYYY-MM-DD` date. `unsupported_api_version`: the `Factuarea-Version` date is not a supported version. - `401`: Missing or invalid API key. - `403`: The request is authenticated but not allowed: the API key lacks the required scope (`insufficient_scope`), the company does not include the public API (`addon_not_active`), the module is not available with a test key (`module_not_available_in_sandbox`), the credential holder does not administer the tax ID (`forbidden_action`) or the effective access of the credential to it is read-only (`company_read_only`). Issuing a transfer is never denied by plan: the plan gate of the transfer scopes runs when the credential is issued. - `404`: The requested resource does not exist or belongs to another company. `account_not_found`: the account in the path does not exist or is not the account of the API key. - `422`: Validation failed — e.g. the API key plan limit was reached, or an invoice language outside the allowed catalog (`es`, `en`, `ca`). The `error.param` field identifies which input is invalid, if any. `idempotency_key_reused`: the `Idempotency-Key` was already used with a different body; send a new key or the same body. `invalid_param_format` on `Idempotency-Key`: the key must be 1 to 255 printable ASCII characters. `idempotency_key_required`: this operation requires the `Idempotency-Key` header; the message names the rejected operation. - `429`: Rate limit exceeded. Retry after the duration in `Retry-After`. - `500`: Unexpected server error. --- [API](https://skmtc.dev/factuarea/apis/factuarea-public-api.md) · [All operations](https://skmtc.dev/factuarea/apis/factuarea-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/factuarea/apis/factuarea-public-api/revisions/718e77934422?raw)